← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Wednesday, May 13, 2026 I'm Rich Stroffelino Instructure reaches an agreement with Shiny Hunters in things that won't come back to bite them later news Instructure, the company that makes the edtech platform Canvas, said it reached an agreement with the group that breached their systems twice in two weeks. Shiny Hunters, the company said the group provided evidence that the stolen data from its systems was destroyed and received assurance that Canvas customers would not be extorted. No word on any specific financial terms paid by Instructure or what meaningful assurance they could have possibly received. Shiny Hunters removed Instructure from its leak site. Shai Hulud Campaign is back since its appearance last September, the campaign by Team PCP has undergone several iterations, all focused on supply chain attacks to steal developer credentials. This latest effort saw the group use valid OpenID Connect tokens to publish dozens of malicious packages for Tanstack on NPM before spreading to other projects such as Minstrel, AI, OpenSearch and UiPath. Since these used valid tokens, developers saw them as cryptographically authentic. Endor Labs highlights a novel trick used by the an orphan commit pushed to a Tanstack fork, making it accessible through GitHub's shared fork object storage. This commit was then referenced in the malicious dependencies. Once infected, the InfoStealer malware writes itself to VS code and Claude code autorun hooks, ensuring it persists even after uninstallation. The malware implements geofencing logic to prevent execution when Russian language settings are detected, and includes probabilistic recursive wipe commands. If the environment appears to be in Israel or Iran, OpenAI launches Daybreak. This new cybersecurity initiative uses OpenAI's Codex Security and several GPU CT 5.5 models to create an editable threat model for a repository with an emphasis on real world attack paths and high impact code. It will then test vulnerabilities in a sandbox and propose mitigations and full out fixes. Daybreak isn't generally available yet. On its launch site, users can request a vulnerability scan or contact sales to request access. Like the mythos rollout, OpenAI says it's working with industry and government partners to get ready to deploy these kinds of cyber capable models. EU members exporting surveillance tech According to export records obtained through Freedom of Information requests by Human Rights Watch, 6 European Union member countries have exported surveillance tech to countries with previous records of Human Rights abuses. Bulgaria, the Czech Republic, Denmark, Finland and Poland sold surveillance technologies to over two dozen countries with documented cases of repressing activists and journalists. This may only represent a subset of the countries involved in the practice, as France, Germany, Germany, Greece, Italy and Spain declined to share any export data. The data obtained by Human Rights Watch does not specify the names of the companies exporting the tech. The EU introduced regulations in 2021 to heavily regulate the export of surveillance technologies and now a huge thanks to our sponsor for today, Doppel Social Engineering Attacks look trustworthy A routine request, an internal email, A familiar face on a call. But Doppel sees through the disguise and their AI native platform detects and disrupt attacks across every channel while training employees to recognize deepfakes and deception. They fight relentlessly to protect your business, brand and people. Doppl outpacing what's next in social engineering? Learn more at doppel.com that'S-O-P-P-E-L.com the government giveth and taketh away AI models Last week, the U.S. commerce Department announced that it reached an agreement with Google, XAI and Microsoft to test these models for security vulnerabilities on their systems ahead of their general release. However, this week, the U.S. commerce Department removed that announcement from its site. No word from the department on why the change was made. If this materially affects any deal or they just took down the announcement. In related news, the Pentagon announced it's deploying Anthropic's mythos model to look for vulnerabilities across the US government. According to DoD Chief Technology Officer Emil Michael, the Pentagon still plans to remove Anthropic products from its work in the coming months, but said that Mythos represented a national security moment. Android gets Intrusion Logging Google announced a new feature for Android developed in partnership with Amnesty International called Intrusion Logging. This is a feature of Android Advanced Protection Mode and is designed to provide logs specifically made for forensic investigations. These logs will record security incidents such as unlocking physical access to a device and the installation or removal of spyware. At launch, this is only available on Android 16 and only on Pixel devices. Amnesty International frames this as the first major vendor to proactively address the challenge of detecting advanced attacks on device cross platform. End to End Encrypted RCS arrives on mobile Apple and Google announced a beta rollout of end to end encrypted rich communication services or RCS messaging. The rollout implements the GSM Association's RCS Universal Profile 3.0. This will be available on iOS 26.5 and the latest version of Google Messages, although availability still relies on carrier activation. Encrypted messages will show a lock icon in chat. This feature will be enabled by default, with Apple committing to applying encryption to existing RCS threats as well. Up until Now, Android and iOS have each had native end to end messaging, but this didn't extend Cross Platform West Pharmaceutical Still Recovering from Ransomware According to filings with the U.S. securities and Exchange Commission, the pharma giant West Pharmaceutical Services suffered a ransomware attack on May 4, causing a proactive shutdown and isolation of affected on premise infrastructure. This caused a temporary disruption to the company's business operations globally. As of this recording, core enterprise systems and processes around shipping, receiving and manufacturing have restarted at some locations, but but the company does not yet have a complete timeline for a full restore. No known ransomware group has claimed responsibility for the attack, which may indicate that a ransom was paid. It's unclear what data was stolen and how many people might have been impacted. RubyGems suspends account signups the standard package manager for Ruby, creatively named RubyGems, announced it's dealing with a major malicious attack. This has impacted hundreds of packages, although those are mostly targeting RubyGems itself itself, but some carry active exploits. As a result, it temporarily suspended new account signups. No word on who is behind the attack. The company securing RubyGems men IO said it will release more details once it contains the attack. Remember to register for this week's Super Cyber Friday event Hacking the Cloud Security Playbook we'll be spending an hour digging into what's changed in cloud security in the age of AI development, what principles are holding fast and what needs to adapt to to the shifting landscape. Head on over to our Events page to register and if you share the event on LinkedIn, you'll have a chance to win some CISO series. Swag live on the show. We do it right up front. You'll know if you're a winner. See you there. And if you have some thoughts about the news from today or about the show in general, be sure to reach out to us. Feedbackisoseries.com we'd love to hear from you. Reporting for the CISO series, I'm Rich Stroffeliano, reminding you to have a super sparkly day.
- [07:36]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.