Microsoft's May 2026 Patch Tuesday release addresses 51 security vulnerabilities across Windows operating systems, Exchange Server, and Microsoft Office products. The update includes patches for critical remote code execution flaws and elevation of privilege issues that could expose professional service firms to active exploitation.

ShinyHunters, a known threat actor group, has successfully breached Zara and compromised nearly 200,000 customer records. This incident is part of an escalating pattern of attacks by the group targeting multiple industries including retail, healthcare, EdTech, gaming, video streaming, and analytics platforms.

Credential-based attacks—including phishing, brute force, and credential stuffing—remain the leading attack vector against medical practices, law firms, and accounting organizations. ThreatDown ITDR (Identity Threat Detection and Response) identifies suspicious authentication patterns, compromised credentials, and lateral movement attempts in real time.

Security researchers have identified a malware distribution campaign leveraging Google Ads and Claude.ai chat interactions to deliver Beagle, a Mac-targeting malware linked to threat actor Berk Albayrak. The attack chain uses MacSync as a delivery mechanism and loader.sh scripts for payload execution.

Security researchers discovered a malicious model on Hugging Face masquerading as an official OpenAI release, accumulating 244,000 downloads before detection. The attack leveraged a Rust-based infostealer deployed through loader.py and start.bat execution chains, targeting developers and organizations in AI development and enterprise environments.

Hyunwoo Kim and researchers at Theori have disclosed Dirty Frag, a critical local privilege escalation vulnerability affecting Linux systems across all distributions. This vulnerability joins a lineage of kernel-level LPE flaws including CVE-2016-5195 and CVE-2022-0847.