← Cybersecurity Headlines
Cybersecurity Headlines
A.I. software flaw hackers, Forza Horizon 6 leak, Linux kernel hit again
00:07:46
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Tuesday, May 12, 2026. I'm Sarah Lane. AI hackers find software Flaw Google says it has identified the first known case of hackers using AI to discover and exploit a previously unknown software Flawless. The AI assisted attack targeted a popular open source administration tool and could have let attackers bypass two factor authentication, though Google patched the vulnerability before damage occurred. Xbox leaks Forza Horizon 6 Forza Horizon 6 leaked online more than a week before launch after unencrypted PC files briefly appeared on Steam Leak, letting pirates crack and distribute the game. Early reports blamed a preload error, but Microsoft later said the leak was not the result of a preload issue, suggesting the files may have come from a reviewer or early access source. Instead, Microsoft has begun issuing franchise wide bans to players using the Cracked version, though the game remains playable. Offline Linux kernel hit by second flaw Researchers discovered a new Linux kernel vulnerability dubbed Dirty Frag, the second major Linux flaw revealed in two weeks after the earlier copy fail bug. The chained vulnerabilities let attackers with basic access gain root privileges and escape cloud containers by explosion. How Linux handles files in memory while leaving little trace for security tools to detect. The flaw was publicly released after a disclosure embargo collapsed, accelerating patch efforts across major Linux distributions including Red Hat, Ubuntu and Alma Linux. Fake Claude code page pushes PowerShell stealer researchers uncovered a malware campaign using fake Claude code installation pages to infect developers with a new PowerShell based information stealer. The malware targeted Chromium based browsers to steal cookies, passwords and payment data while evading detection through heavily obfuscated scripts and minimal native code activity. Researchers warned that compromised developer machines could give attackers access to source code, repositories, cloud infrastructure and CICD pipelines. Huge thanks to our sponsor Doppel Social engineering attacks look trustworthy. It's a routine request, an internal email, a familiar face on a call. But Doppel sees through the disguise. Its AI native platform detects and disrupts attacks across every channel, while training employees to recognize deepfakes and deceptions. They fight relentlessly to protect your business, your brand and your people. Doppel Outpacing what's next in social engineering? Learn more@doppel.com that iS-O-P p e l.com Netflix sued over surveillance Machinery Texas Attorney General Ken Paxton sued Netflix, alleging the company secretly collected and shared subscriber data with advertisers and data brokers without proper consent the lawsuit claims Netflix tracked viewing habits, locations, device data and children's profiles while publicly downplaying its data collection practices, sharing information with firms including Experian, Axiom and and Google's ad platforms. Texas is seeking fines and restrictions on Netflix's data practices, including changes to autoplay settings on Kids accounts. Team PCP compromises check marks Checkmarks confirmed that attackers linked to Team PCP published a malicious version of its Jenkins AST plugin to the Jenkins Marketplace, which weeks after the group compromised the company's Kix, Docker image and developer tools in a separate supply chain attack. Researchers say Team PCP briefly took over the plugin's GitHub repository and inserted credential stealing malware, raising concerns that the group either retained access to checkmark systems or exploited incomplete remediation from the earlier breach. Spy agencies seek more power the Washington Post reports that the US Administration is divided over whether US Intelligence agencies should gain a larger role in evaluating advanced AI models amid growing cybersecurity concerns tied to systems like Anthropic's Mythos. National security officials want the Office of the Director of National Intelligence to oversee AI testing, while Commerce Department officials argue their existing AI evaluation programs are better suited and warn against heavier regulation that could slow U.S. competitiveness against China. Canvas data leak, extortion deadline looms Instructure, parent company of Canvas, is facing more pressure after cybercriminal group Shiny Hunters the threatened to leak data allegedly stolen from more than 8,800 school systems using the Canvas learning platform. The attackers claimed to have stolen 3.65 terabytes of student, teacher and school data and escalated the extortion campaign by defacing Canvas login pages and setting a new ransom deadline after the company reportedly refused to pay. The breach exposed usernames, email addresses, enrollment details and messages, but some are questioning the company's response and warning the incident could become one of the largest education sector data exposures on record. There's no doubt that AI will displace some portion of current knowledge workers, including in cybersecurity. But if it can displace all of them, how do businesses differentiate? Will cybersecurity become commoditized by everybody using the same LLMs? That is one of the topics we're tackling on this week's episode of the CISO series podcast. Look for the episode can you please train the AI on your way out the door, wherever you get your podcasts? And if you have some thoughts on the news from today or about our show in general, be sure to reach out to us and feedbackisoseries.com we'd love to hear from you. I am Sarah Lane, reporting for the CISO series. You stay safe out there.
- [07:30]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.