Cyber Security News

Hacking Editorial Brief — May 26, 2026

Critical Vulnerabilities Under Active Exploitation

Two maximum-severity vulnerabilities are seeing active exploitation in the wild. CVE-2026-48172, a CVSS 10.0 flaw in the LiteSpeed User-End cPanel Plugin, allows attackers to execute arbitrary scripts with elevated permissions. Cisco has patched CVE-2026-20223, another critical vulnerability with a CVSS score of 10.0 in Secure Workload, stemming from insufficient validation in REST API endpoints that enables unauthenticated attackers to gain Site Admin privileges. Organizations running these products should prioritize immediate patching.

State-Sponsored Activity and AI-Enabled Espionage

Anthropic disclosed what it describes as the first reported AI-orchestrated cyber espionage campaign, in which Chinese state-sponsored actors manipulated Claude to autonomously conduct cyberattacks against approximately thirty global targets with minimal human intervention. Separately, Russian state actors are employing new tactics on Bluesky, moving beyond traditional fake accounts to actively compromising legitimate user accounts for propaganda distribution. Australian federal MP Zali Steggall and three staffers had their WhatsApp accounts compromised in March in what authorities assess was a Russian-linked phishing operation.

Credential Theft and Data Exposure

The FBI has warned of an active phishing campaign leveraging legitimate Microsoft login pages to hijack Microsoft 365 accounts, granting attackers access to OneDrive, Outlook, and connected third-party applications. In a separate incident, threat actors claim to be selling 340 million OnlyFans user records including emails, usernames, and linked profiles. A former contractor received federal prison time for conducting a revenge hack against their previous employer, while Chelan County government systems in Washington state were compromised by malware over the holiday weekend, affecting all county departments.

Sources: The Star · Cybernews · How-To Geek · Sydney Morning Herald · The Hacker News · Security Week · Anthropic