Vimeo confirms breach via third-party vendor impacts 119K users
2026-05-05T20:51:45Z•899753abe32508de98b022b3b4bcbba2d4ea29f8fcdc2d592cb849275da80d96
AI and vulnerability discoveryAndroid RCEAnodotBluekitCISA KEVIBM ItalyInstructureLinux kernelMOVEit AutomationSalt TyphoonVimeoauth token theftcPanel exploitationdata breacheducation sectorphishingphishing kitsupply chainthird‑party compromise
What happened
A collection of high‑impact security incidents and vulnerability disclosures: Vimeo confirmed a third‑party (Anodot)–linked breach exposing ~119K users; Google patched a critical Android RCE (CVE‑2026‑0073); Microsoft disclosed a large phishing campaign stealing auth tokens from ~35K users; Instructure is investigating a breach potentially affecting ~9,000 schools. Critical vulnerabilities under active exploitation include MOVEit Automation auth bypass/privilege escalation (CVE‑2026‑4670, CVE‑2026‑5174) and a cPanel flaw (CVE‑2026‑41940) targeting governments/MSPs; CISA added Linux kernel CVE‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 899753abe32508de98b022b3b4bcbba2d4ea29f8fcdc2d592cb849275da80d96
- Enrichment time
- 2026-05-05T20:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.