ClickFix finds a backup plan in PySoxy proxy chains

ReliaQuest observed attackers pairing ClickFix with the PySoxy proxy tool to establish redundant encrypted access paths and persistence on compromised systems.

ICS Patch Tuesday: New Security Advisories From Siemens, Schneider, CISA

Many ICS vendors have not released new advisories for the May 2026 Patch Tuesday.

Government to Scrutinize Instructure Over Canvas Disruption, Data Breach

The Committee on Homeland Security has requested to be briefed on the incident and Instructure’s remediation steps.

Ransomware: Over Half of CISOs Would Consider Paying Ransom to Hackers

Survey of cybersecurity leaders suggests that majority would strongly consider paying cybercriminals, if that’s what it took to help restore systems

Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including 29 Critical RCE Flaws

Microsoft’s May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code exec...

OpenAI Launches ‘Daybreak’ to Help Build Secure By Design Software

With Daybreak, OpenAI wants its frontier AI models to be used to deploy secure by design software from the ground up

TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack

Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.

Foxconn confirms cyberattack impacting North American factories

A spokesperson for the company confirmed the incident but declined to provide specifics on how many factories in North America were impacted. Foxconn has factories in Wisconsin, Ohio, Texas, Virginia,...

West Pharmaceutical Services Hit by Disruptive Ransomware Attack

The company took systems offline globally after hackers exfiltrated data and deployed file-encrypting ransomware.

New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution

Exim BDAT flaw affects 4.97–4.99.2 GnuTLS builds, causing heap corruption and possible code execution.

New TrickMo Variant Uses TON C2 and SOCKS5 to Create Android Network Pivots

A new TrickMo Android banking trojan variant uses TON blockchain infrastructure for stealthy command-and-control communications.

Fake Claude Code Page Pushes PowerShell Stealer at Devs

Ontinue uncovers fake Claude Code installer pushing PowerShell stealer abusing Chrome's IElevator2