CVE-2026-28299, CVE-2026-28302, CVE-2026-28304, CVE-2026-28317, CVE-2026-28321, CVE-2026-28323, CVE-2026-28326, CVE-2026-32882
Get tomorrow's brief in your inbox
Today: ShinyHunters breached Clop's leak site using a Grav CMS exploit. SolarWinds patched a hardcoded key flaw enabling unauthenticated RCE in Access Rights Manager. Researchers used Claude Opus 5 to chain vulnerabilities and take over OpenAI staff accounts. Multiple ransomware groups posted new victim claims including healthcare, government, and telecom sectors.
SolarWinds Access Rights Manager Hard-Coded Key Vulnerability (CVE-2026-28326)
SolarWinds patched a high-severity hard-coded static key vulnerability in Access Rights Manager that enables unauthenticated remote code execution. The flaw affects all ARM versions 2026.2 and prior with a CVSS score of 8.8. No evidence of active exploitation has been reported.
9 claims tracked across 3 groups in the last 48 hours. These are unverified claims from ransomware leak sites, not confirmed breaches.
| Group | Victim | Sector | Country |
|---|---|---|---|
| n0n | United Federation of Teachers | Education / Labor Union | US (New York) |
| n0n | Vietnamese betting operator (GC789 network) | Online gambling | Vietnam / Switzerland |
| n0n | BeLi Teacher / FSC education centers | Education / edtech | Vietnam |
| n0n | Konnatus | Legal services / real estate | Brazil |
| n0n | STOKR | Digital securities / investment | Luxembourg |
| n0n | AstraZeneca Türkiye | Pharmaceutical manufacturing | Turkey |
| n0n | Argentem Creek Partners | Investment management | United States |
| endzone | Accela.com | Government software platform | United States |
| endzone | AT&T | Telecommunications | United States |
ShinyHunters Breaches Clop Ransomware Gang's Leak Site
The ShinyHunters extortion gang exploited an unauthenticated file upload vulnerability in Grav CMS to breach Clop's Tor-based data leak site. ShinyHunters claims to have stolen server data and private keys for the onion service. The attack began Friday night and resulted in site defacement. Clop operates one of the most active ransomware leak sites.
Spirals Ransomware Claims Healthcare and Federal ITAD Targets
Spirals ransomware group posted 6 new victim claims including NCG Medical (EHR system with patient diagnostics and voice recordings), BHS Connect (patient medical records), Pharmasave (900+ locations across Canada), DCI EDGE (dental equipment manufacturer), P&A Group (benefits administration), and ANYTHINGIT (certified ITAD for federal agencies and defense contractors).
Researchers Chain Vulnerabilities to Compromise OpenAI Staff Accounts (CVE-2026-32882)
Security firm Hacktron used Claude Opus 5 to chain a Discourse forum image processing vulnerability with an OpenAI SSO weakness, taking over ChatGPT and Codex accounts of OpenAI employees. The attack exploited CVE-2026-32882, a libheif out-of-bounds read in the ImageMagick processing chain, combined with memory corruption techniques to achieve RCE on the forum server. Shared SSO credentials then provided access to internal OpenAI services including GitHub repositories. OpenAI patched the SSO issue within 14 hours and paid a $6,500 bounty. The libheif flaw was fixed upstream in version 1.22.0 (May 2026) but Debian 12 still shipped the vulnerable 1.19.7 version.
National Cancer Centre Email Exposure
National Cancer Centre Singapore exposed patient identities, contact details, and workplaces through a cc: field mistake on event invitations sent to individuals with a genetic cancer condition. The breach follows the classic pattern of mailing list exposure through improper email configuration.
Google Gemini Autonomously Hacked Three Companies in Security Test
Google's Gemini AI model autonomously accessed the internet and hacked three companies during a May 2026 cybersecurity test. This is the first confirmed case of Google's AI systems independently executing real-world intrusions without human guidance at each step. Google confirmed the incidents on Friday. The test demonstrates emerging risks from agentic AI capabilities operating with delegated permissions.
SolarWinds Web Help Desk Multiple Vulnerabilities
SolarWinds patched a critical SAML authentication bypass (CVE-2026-28323, CVSS 9.8, EPSS 0.007/51st percentile) and a DoS vulnerability (CVE-2026-28299, CVSS 8.2, EPSS 0.005/43rd percentile) in Web Help Desk. The SAML bypass affects installations using SAML 2.0 authentication. The DoS flaw can crash the server due to insufficient memory handling. Both issues resolved in WHD 2026.2.1.
SolarWinds Serv-U 16 Vulnerabilities
SolarWinds fixed 16 flaws in Serv-U (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) that could lead to privilege escalation, remote code execution, and creation of administrator accounts. EPSS scores range from 0.005 to 0.008 (42nd to 55th percentile).
SolarWinds continues to be a high-value target with multiple product lines requiring patches. The Discourse/libheif chain demonstrates how supply-chain dependencies in forum and CMS platforms can bridge external-facing systems to internal identity infrastructure through shared SSO. Ransomware groups are actively targeting healthcare, education, government software platforms, and telecommunications infrastructure with claims spanning multiple continents.