Cybersecurity News | Daily Recap [18 May 2026]

Daily Recap, Multiple breaches and supply-chain weaknesses dominated headlines, including 7-Eleven confirming a breach tied to a ShinyHunters ransom demand and Grafana warning that a stolen GitHub token enabled attackers to steal part of its codebase. On the exploit and identity fronts, DirtyDecrypt Linux privilege escalation, in-the-wild exploitation of NGINX CVE-2026-42945, the Windows MiniPlasma zero-day (SYSTEM access), and Tycoon2FA device-code phishing targeting Microsoft 365 accounts were highlighted. #ShinyHunters #7-Eleven #Grafana #GitHub #DirtyDecrypt #NGINX #CVE-2026-42945 #MiniPlasma #OpenClaw #Claw%20Chain #Tycoon2FA #Microsoft%20365 #BlackFile #UNC6671 #Qilin #The%20Gentlemen #Kimsuky #Gamaredon #Pwn2Own%20Berlin%202026 #KB5089549

Multiple high-profile breaches exposed sensitive data, with millions impacted across U.S. healthcare organizations and 7-Eleven confirming a breach after a ShinyHunters ransom demand, while Canvas warned that prevention alone is no longer enough. – Healthcare Breach, 7-Eleven Breach, Canvas Breach
Grafana said a stolen GitHub token allowed hackers to steal part of its codebase, highlighting supply-chain and source-code access risk. – Grafana Token

An exploit for the new DirtyDecrypt Linux root escalation flaw is already available, enabling root compromise on affected systems. – DirtyDecrypt Flaw
NGINX CVE-2026-42945 is being exploited in the wild, causing worker crashes and potentially leading to RCE. – NGINX CVE
A new Windows MiniPlasma zero-day reportedly grants SYSTEM access, and a proof of concept has been released. – MiniPlasma Zero-Day
OpenClaw flaws in the Claw Chain can enable sandbox escape and backdoor delivery. – OpenClaw Flaws

Tycoon2FA is hijacking Microsoft 365 accounts through device-code phishing, reinforcing the surge in identity-based attacks. – Tycoon2FA Phishing
Weekly threat research highlighted workflow poisoning, malicious npm republishing, and AI-assisted device-code phishing tied to BlackFile / UNC6671 and Tycoon 2FA, alongside ransomware and espionage activity from groups such as Qilin, The Gentlemen, Kimsuky, and Gamaredon. – Weekly Recap

Hackers earned $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026, underscoring the growing value of exploit research. – Pwn2Own Berlin
Sean Plankey, the former CISA nominee, was named US CEO of a defense startup. – Plankey Named

Microsoft is testing a resizable taskbar and Start menu in Windows 11, while also confirming installation issues affecting the KB5089549 security update. – Windows 11 UI, KB5089549 Issues

SHARE THIS STORY