Top 5 Cybersecurity News Stories May 22, 2026

This week didn't produce one headline. It produced five.

And every single one of them happened inside something organisations treat as trusted infrastructure — not as attack surface.

A Visual Studio Code extension. GitHub, OpenAI, and Mistral AI's internal repositories were breached through an Nx Console extension that was live on the Visual Studio Marketplace for exactly 18 minutes. TeamPCP's ninth supply chain attack since January. Microsoft's durabletask Python SDK was compromised separately on the same day.

The first AI-generated zero-day. Google's Threat Intelligence Group confirmed this week what no one wanted to confirm: a threat actor used an AI model to discover and weaponize a previously unknown vulnerability in Webmin — a 2FA bypass — and staged it for mass exploitation. First AI zero-day. In active use. Not a research paper.

Microsoft Defender, exploited again. CVE-2026-41091. A symbolic link flaw in the Malware Protection Engine delivers SYSTEM privileges from a standard user account. No additional authentication required. The second exploited Defender zero-day in three weeks.

Drupal's emergency patch. Score 20/25. No login required. Full read and write access to all non-public data on affected sites. Drupal runs government portals, university systems, and healthcare infrastructure across Europe. NIS2 personal liability applies to a significant share of the affected organisations.

And CISA confirmed that five CVEs from 2008 to 2010 are being actively exploited in 2026. Sixteen to eighteen years after public disclosure. Someone is still reaching those systems.

→ The attack surface doesn't end at the perimeter. It runs through the developer tools used to build it, the security software used to defend it, the platforms used to run public services on it, and the systems forgotten before the perimeter was even defined.
→ Five incidents. Five different exposure layers. One structural failure: assuming that infrastructure is not attack surface.
→ The question is not whether your managed assets are patched. It is whether your threat model accounts for everything that's actually connected.

Full article link in the comments.

Видео Top 5 Cybersecurity News Stories May 22, 2026 канала DIESEC