Patch Tuesday, May 2026 Edition
2026-05-16T01:23:31Z•2b35c1d4fcf2738149ce01acaacad6c49770e31b7c0ada5db2c300d6ff4b079c
AisuruBlueHammerBrazilCanisterWormCanvasDDoSIoTIran-backedJackSkidKimwolfMossadScattered Spider','Tylerb','UNKN','Daniil-Shchukin','law-enforcеSharePointStrykeranti-DDoS-abusebotnetdata-extortioneducation-technologypatchingransom-extortionrouter-vulnerabilitiestoken-harvestingvulnerability-managementwiperzero-day
What happened
Collection of KrebsOnSecurity items (Mar–May 2026) describing multiple high-impact incidents and broad vulnerability remediation: a large data-extortion campaign against Canvas that defaced logins and threatened to leak data on ~275 million students/faculty across ~9,000 institutions; massive vendor patching (Apple, Google, Microsoft, Mozilla, Oracle) including Microsoft fixes for 167 vulnerabilities—notably a SharePoint Server zero-day and a disclosed Windows Defender issue dubbed “BlueHammer”; a campaign by Russia-linked actors harvesting Microsoft Office auth tokens via known router flaws (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- krebs_on_security
- Record identifier
- 2b35c1d4fcf2738149ce01acaacad6c49770e31b7c0ada5db2c300d6ff4b079c
- Enrichment time
- 2026-05-16T01:23:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.