Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On 2026-05-22, an attacker rewrote every repository tag across four Composer packages in the Laravel-Lang ecosystem to point at malicious commits. The affected packages are laravel-lang/lang, laravel-lang/attributes, laravel-lang/http-statuses, and laravel-lang/actions. The rewrite took place on 2026-05-22 into the early hours of 2026-05-23. Every malicious commit makes the same two-file change: one entry added to composer.json, and one new file at src/helpersphp.

For decades, finding a zero-day flaw followed a predictable script: a highly skilled human researcher spent weeks staring at source code, digging for edge cases, and manually stitching together an exploit. In April 2026, Anthropic flipped that script by announcing Claude Mythos. This frontier model didn’t just mark an incremental upgrade; it introduced autonomous, machine-speed vulnerability hunting.

A GitHub breach occurred on May 18, 2026 when a threat actor called TeamPCP pushed a malicious version of Nx Console (a widely used VS Code extension with 2.2 million installs) to Microsoft’s official Visual Studio Marketplace.

Suppose that the hospital allows a vital software update of its infusion pumps to go through, and all security tests pass. The signature looks valid. The certificate is scrapless. Everything appears legitimate. The update was forged by an attacker who cracked a key that was considered unbreakable just five years ago. The general perception of most individuals is that after encryption or after data is digitally signed, it stays secure indefinitely. That assumption is now perilously outdated.

Your database is one apostrophe away from a breach. SQL injection has been the most common web vulnerability for three consecutive years. The 2025 Verizon DBIR reports it contributed to 12% of all data breaches, up from 9% the year before. In December 2024, a PostgreSQL SQL injection zero-day gave state-sponsored attackers a path into the US Treasury. In 2023, a single campaign used it to steal 2 million job seeker records across 65 websites in one month. The fix has been known for two decades.

The security industry spent a good chunk of early 2026 debating whether Anthropic’s Mythos and OpenAI’s Daybreak are truly dangerous or just good marketing. It's a reasonable debate. But while we're having it, attackers are asking a different question: how do we use tools like this to move faster than defenders can respond?

In a significant security incident unfolding on May 20, 2026, GitHub confirmed unauthorized access to its internal repositories. The breach involved the exfiltration of sensitive internal source code and organizational data, reportedly totaling around 3,800 to 4,000 private repositories. A threat actor surfaced on underground forums advertising the stolen materials for sale, complete with directory listings of compressed archives and sample verification offers.

SophosLabs analysts investigated WantToCry ransomware attacks that involved the threat actors abusing the Server Message Block (SMB) service for initial access and then exfiltrating files to attacker-controlled infrastructure for remote encryption. The detection surface is significantly reduced because WantToCry operates without local malware execution, and there is no post-compromise activity beyond exfiltrating files and rewriting them to disk.