Security briefing: May 2026

Big breaches, bigger consequences

In May, some big attacks were conducted by some big threat actors. And unfortunately, some big operational mistakes were made. (It was a big month, if you can’t tell…)

There were massive platforms targeted this month, along with trusted ecosystems being compromised and vulnerabilities exploited within hours. All of these incidents — and many more — highlight the uncomfortable truth that the most damaging exposures still come down to missed best practices and poor security choices.

Early May: Ransomware group wins out with persistence

• The ShinyHunters ransomware group gained access to a vulnerable teacher account program in late April. On May 1, they claimed to have exfiltrated the data for approximately 275 million people from Canvas, a learning management platform.
• Canvas’s parent company, Instructure, stated on May 6 that the breach was contained, but the next day, ShinyHunters defaced the login portals of over 300 educational and corporate institutions. 
• Instructure settled with the ransomware group, but the FBI is warning both students and staff to beware of extortion attempts.

May 18: GitHub breached from within

• TeamPCP tossed a line in the water, and they didn’t catch a fish — they caught a whale.
• They deployed a backdoored version of the Nx Console on the Microsoft Visual Studio Code (VS Code) Marketplace, which was only live for 18 minutes before being taken down.
• However, during that 18-minute timeframe, a GitHub employee downloaded the malicious extension, and TeamPCP walked away with approximately 3,800 cloned repositories.  
• Even in the small window of opportunity, the attacker capitalized, using their self-replicating worm to automate and spread the supply chain attack. The greatest risk from this attack is the opportunity for future attacks. 

May 18: Contractor exposes privileged AWS GovCloud credentials

• A GitGuardian security researcher reached out to KrebsOnSecurity on May 15, claiming that he found highly sensitive information exposed.
• A CISA contractor disabled the default setting that would block publishing SSH keys and secrets to public repositories.
• Therefore, CISA’s AWS GovCloud administrative keys, credentials, files, tokens, passwords, logs, and more were all exposed for six months.
• Fortunately, there were no indications of compromise. But a six-month-long credential exposure at the cyber governing body of the United States because someone turned off a basic guardrail? You can’t make this stuff up...   

Additional Sysdig TRT findings

An LLM-driven attack on marimo in four moves

• On May 26, Sysdig TRT detailed the first LLM-driven intrusion they’ve captured.
• The attack ran start to finish in less than one hour and made four pivots.
• The threat actor’s agent exploited a publicly exposed marimo notebook (CVE-2026-39987) and stole two cloud credentials.
• Using the credentials, a private key was identified, allowing SSH authentication on an SSH bastion server. 
• The entire configuration of an internal PostgreSQL database was then exfiltrated in two minutes.
• A scripted attack requires an operator building a playbook. Reusing it against a new target costs engineering time. LLM-driven attacks are shifting the bar from playbook authorship to inference budget.
• Agents are also more likely to leave different fingerprints on each target, rendering signature-based detections useless. Detecting behavioral intentions is increasingly important. 

PraisonAI authentication bypass in under four hours

• On May 11, GitHub published an advisory (CVE-2026-44338) for the open-source multi-agent orchestration framework PraisonAI. 
• Authentication was disabled by default for the legacy api_server.py entry point, exposing the endpoints GET /agents and POST /chat to any caller.
• In less than four hours, a scanner was probing and validating the vulnerable endpoint.
• This finding is another example of the broader trend Sysdig TRT has observed over the past several months: An increasing number of CVEs, particularly those that have to do with AI, are being exploited within hours of disclosure. 
• In all of these cases, until an upgrade or patch is possible, detection is imperative. Work from the disclosure or find threat research such as ours to deploy detection rules in your environment.  

Attackers modernizing infrastructure with novel NATS-as-C2

• On May 15, Sysdig TRT published a blog detailing a novel command-and-control technique dubbed NATS-as-C2.
• Rather than the usual HTTP-based panels or chat platforms, an attacker was found routing attack coordination through a NATS server, operating the same way modern cloud-native organizations do, and very intentionally not looking like malware. 
• The attacker began with an unauthenticated RCE in Langflow (CVE-2026-33017), then downloaded a Python worker and a Go binary over the course of 30 minutes.
• Langflow, n8n, and similar platforms don’t need broad outbound access. Block outbound traffic to identified IoCs and maintain an egress allowlist for AI tooling workloads. 

Azure VMAccess detection gap

• On May 20, the Sysdig TRT published research regarding a detection gap they found in the process for Azure VM password resets and VMAccess naming. 
• The issue is that the {name} segment of .../virtualMachines/{vm}/extensions/{name} is unconstrained. This means anyone (including an attacker) can name a VMAccess extension anything they want, making it invisible to any detection rule meant to trigger on specific extension names. 
• According to Microsoft, this is not considered a security vulnerability. If you operate in Azure, review the blog above and ensure your detections are sufficient. 

Also in the news

• DirtyFrag: This is a local escalation vulnerability chain (CVE-2026-43284, CVE-2026-43500) that was published ahead of patches being released in early May. These CVEs affect the Linux kernel’s xfrm-ESP and RxRPC subsystems, therefore impacting nearly every major distro running kernels since 2017. A working proof of concept was published the same day. Organizations with affected kernel versions should patch immediately or deploy detections. See the Sysdig TRT blog for more information. 
• German critical infrastructure targeted: Attackers hit a third-party billing processor used by medical centers across the country in mid-May. The scale of the breach varied by hospital, but tens of thousands of names, addresses, and other information were disclosed. 
• MuddyWater masquerades as Chaos ransomware: What initially appeared to be a routine Chaos ransomware-as-a-service incident turned out to be a false-flag operation attributed to the Iranian advanced persistent threat (APT) group MuddyWater. Rather than typical ransomware encryption, attackers quickly refocused on social engineering and data exfiltration techniques. Threat actors often use the tactics, techniques, and tools of others. Don’t always be so quick to judge and attribute; a breach is a breach, no matter who’s behind it. 

Closing thoughts

Stop us if you’ve heard this one before, but the defining trend in May was once again time compression between disclosure, exploitation, and operational impact. Threat actors are using automation, AI, and cloud-native infrastructure to move faster. And many incidents still stem from preventable issues like exposed credentials, disabled guardrails, overly permissive accounts, and poor visibility. 

Speed matters now just as much, if not more, than prevention. Prioritize rapid detection, runtime signals, aggressive credential hygiene, and behavioral monitoring capable of identifying intent. Attackers are modernizing. Defenders’ strategies must modernize faster.

‍