iOS security researchers at Mysk have revealed that WhatsApp stores chat histories in an unencrypted SQLite database accessible to other Meta apps on the same Apple device. While end-to-end encryption protects messages in transit, there is no equivalent protection once those messages are stored locally.
Zimperium zLabs uncovered a 10-month Android malware campaign involving 250 fake apps that silently enrolled victims in premium SMS services across four countries. The operation abused Google’s SMS Retriever API and hidden WebViews to bypass user consent and intercept authentication codes.
Europol and international partners dismantled First VPN, a service widely used by ransomware gangs, seizing 33 servers and arresting its alleged administrator. The operation, codenamed Saffron, also exposed thousands of users whose data is now in the hands of investigators across 16 countries.
A single XSS vulnerability can silently register an attacker-controlled passkey on a victim’s account, creating a persistent authentication backdoor with zero user interaction. The widespread deployment of passkeys without attestation requirements makes this a critical and largely overlooked threat.
CISA’s own GitHub repository was left publicly accessible for six months, exposing hundreds of megabytes of plain-text passwords, AWS credentials, private keys, and cloud tokens with alarmingly obvious filenames. The repository was taken down within 26 hours after a GitGuardian researcher escalated the disclosure through security journalist Brian Krebs.
The week of May 11–17, 2026 brought a wave of cybersecurity incidents including a JDownloader malware supply chain attack, deepfake sextortion targeting schools, and a one-in-eight employee insider threat statistic. CyDhaal rounds up all ten major stories you need to know about.
Microsoft has acknowledged a critical installation failure in its May 2026 Patch Tuesday update KB5089549 for Windows 11, causing error 0x800f0922 due to insufficient EFI System Partition space. The company is actively rolling out a fix while advising administrators to monitor the Windows Release Health Dashboard.
CISA has added CVE-2026-42897, an actively exploited Microsoft Exchange Server XSS vulnerability, to its Known Exploited Vulnerabilities catalog. Federal agencies have until May 29, 2026 to remediate the flaw, which enables spoofing attacks via Outlook Web Access.
A dangerous new class of AI attacks called prompt injection is targeting Kubernetes-hosted LLM applications in ways that traditional security tools cannot detect. CrowdStrike’s Falcon AIDR now delivers runtime visibility at the prompt layer, identifying malicious intent inside natural language interactions without proxies or architectural changes.
Researchers have disclosed four chained vulnerabilities in OpenClaw, collectively dubbed Claw Chain, enabling attackers to steal data, escalate privileges, and establish persistence through the AI agent’s own runtime. All flaws have been patched in OpenClaw version 2026.4.22 and users are urged to update immediately.