May 12, 2026 · #54

Episode 54 — 12 May 2026 1. Hackers Used AI to Develop First Known Zero-Day 2FA Bypass for Mass Exploitation Source: The Hacker News Google on Monday disclosed that it identified an unknown threat actor using a zero-day exploit that it said was likely developed with an artificial intelligence (AI) system, marking the first time the technology has been put to use in the wild in a malicious context for... 2. Official CheckMarx Jenkins package compromised with infostealer Source: Bleeping Computer Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace. The compromise was claimed by the TeamPCP hacker group, which initiated a spree of supply-chain attacks that included... 3. Instructure confirms hackers used Canvas flaw to deface portals Source: Bleeping Computer Education technology giant Instructure has confirmed that a security vulnerability allowed hackers to modify Canvas login portals and leave an extortion message. BleepingComputer has learned that both the breach and defacements involved multiple cross-site scripting (XSS)... 4. cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor Source: The Hacker News A threat actor named Mr_Rot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager... 5. Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages Source: The Hacker News TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign. The affected npm packages have... 6. TrickMo Android banker adopts TON blockchain for covert comms Source: Bleeping Computer A new variant of the TrickMo Android banking malware, delivered in campaigns targeting users across Europe, introduces new commands and uses The Open Network (TON) for stealthy command-and-control communications. The TrickMo banker was first spotted in September 2019 and has... 7. Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak Source: The Hacker News Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory. The out-of-bounds read flaw, which likely impacts over 300,000 servers... 8. Hackers abuse Google ads, Claude.ai chats to push Mac malware Source: Bleeping Computer Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install...