26 Years for Dark Web Drug Sales Built on Free Meth Samples
San Jose man Darren Hughes sentenced to 26+ years for fentanyl and meth sales on Nemesis Market, paid in cryptocurrency.
Threats
Polyfill.io Wakes Up Again, Hitting Toshiba and Muji Users
Polyfill.io reactivated in late May 2026, serving HTTP 401 prompts that tricked browsers on Toshiba and Muji sites into showing fake login screens.
SolarWinds Serv-U Flaw Lets Attackers Crash Servers Without Logging In
CISA confirms active exploitation of CVE-2026-28318, a Serv-U denial-of-service flaw requiring no credentials. Federal agencies must patch by June 19.
WFP Breach Exposes 600,000 Gaza Households to Targeted Fraud Risk
Attackers breached the WFP's Gaza self-registration platform on May 14, stealing names, ID numbers, phone numbers, and location data from roughly 600,000 househ
Agentic AI in Classified Networks Has a Security Problem Already
Agentic AI is moving into defense networks fast. The security infrastructure underneath it isn't keeping pace.
Two npm Worms Are Stealing Secrets and Rewriting Code
IronWorm and a new Miasma variant have compromised over 50 npm packages, stealing credentials and self-propagating through GitHub repositories.
Hola Browser's Supply Chain Breach Quietly Installed a Monero Miner
A cryptominer was found inside the Windows version of Hola Browser after a supply chain compromise went undetected until routine certification checks flagged it
Android Spyware Asin Targets Arabic Journalists Through Fake Conflict Apps
ESET has identified Android spyware called Asin spreading through fake news, PDF, and war map apps targeting Arabic-speaking users since early 2025.
Cisco's Unified CM Has a File-Write Flaw and Public Exploit Code
CVE-2026-20230 lets unauthenticated attackers write files and escalate to root. A public PoC exists and the version 15 patch isn't due until September.