Over Security

The report presents key trends and statistics on malware that targeted personal computers running Windows and macOS, as well as Internet of Things (IoT) devices, during Q1 2026.

This report contains mobile threat statistics for Q1 2026, along with noteworthy discoveries and quarterly trends: new versions of SparkCat and Triada.

Microsoft has finally brought back the resizable taskbar and Start menu to Windows 11 in the latest preview version rolling out to Insiders in the Experimental channel.

Celebrate 10 years of ANY.RUN with special offers on Interactive Sandbox and Threat Intelligence solutions for faster triage and stronger SOC response.

Cleafy's TIR team identified and analyzed two previously undocumented Android NFC relay malware families, DevilNFC and NFCMultiPay, actively targeting European and LATAM banking customers.

L’AI non è più solo uno strumento di supporto: oggi individua vulnerabilità, reagisce agli attacchi e automatizza operazioni cyber offensive. Un’evoluzione che cambia il ruolo umano nella cyber security e apre nuovi interrogativi su controllo e responsabilità

Una vulnerabilità Windows corretta nel 2020 potrebbe non essere mai stata davvero risolta. Con MiniPlasma, il ricercatore Chaotic Eclipse dimostra che il vecchio PoC di Google Project Zero funziona ancora su sistemi Windows 11 aggiornati. Il caso evidenzia i limiti del patch management e il rischio di falle “riaperte” negli aggiornamenti successivi

Dubai Police warns against viral energy drink videos on social media, citing serious health risks for children and teenagers.

Group-IB introduces Prevyn AI, the cognitive core of the Unified Risk Platform. Rather than an isolated AI assistant or product feature, Prevyn AI is a central intelligence capability that reasons over data, coordinates specialist agents, and prepares insights in Threat Intelligence and actions in Managed XDR.

Microsoft has confirmed that the May 2026 Windows 11 security update (KB5089549) fails to install on some systems and triggers 0x800f0922 errors.

A recently patched local privilege escalation vulnerability in the Linux kernel's rxgk module now has a proof-of-concept exploit that allows attackers to gain root access on some Linux systems.

To reduce risks, the NCSC urged organizations to adopt agentic AI gradually instead of deploying it across critical systems from the outset.

Shadow AI is creating major enterprise security and compliance risks as unmanaged AI tools spread beyond CISO visibility.

The Pwn2Own Berlin 2026 hacking contest has concluded, with security researchers collecting $1,298,250 in rewards after exploiting 47 zero-day flaws.

A cybersecurity researcher has released a proof-of-concept exploit for a Windows privilege escalation zero-day dubbed "MiniPlasma" that lets attackers gain SYSTEM privileges on fully patched Windows systems.

The Tycoon2FA phishing kit now supports device-code phishing attacks and abuses Trustifi click-tracking URLs to hijack Microsoft 365 accounts.

A security researcher claims Microsoft quietly fixed an Azure Backup for AKS vulnerability after rejecting his report, and without issuing a CVE. Microsoft disputes the claim, telling BleepingComputer the behavior was expected and that "no product changes were made," despite the researcher documenting a silent fix.

There's one question that, once it anchors how we evaluate these products, makes the difference between picking a triage tool and picking a detection partner. The global median dwell time, days from first attacker foothold to the moment someone noticed, came in at 14 days. Triage speed doesn't close it. The IBM 2025 Cost of a Data Breach Report puts mean time to identify at around 181 days globally, down from 194 the year before. But the directional signal is consistent: detection completeness is where the next layer of value lives. Dwell time is the metric. Days from foothold to detection. What we measure today, what we don't measure yet The agentic-SOC category has standardized on a set of performance metrics that are easy to measure cleanly: per-ticket investigation time, alert closure rate, response latency on already-detected incidents. That's a different kind of measurement than triage speed, and it's the one the category hasn't fully built out yet. Here's the distinction, side by side: Metric category What it measures What it tells you about the product Triage-speed metrics (broadly available) How fast the system processes alerts that already fired How efficient your SOC becomes at handling known signal Detection-completeness metrics (still maturing) Whether the system surfaces threats it didn't already have a rule for Whether the product is meaningfully shortening attacker dwell time Both matter. That said, there's a meaningful distinction between triage speed and detection completeness, and understanding it helps you get full value from the agentic wave. The way to make sure the right 60% survives is to measure outcomes that map to the actual threat: how many days did the attacker have before detection, and did that number go down? Here's the question to anchor on: "Show me your customers' median dwell time before deployment and after. Dwell time." Pay attention to what happens next. If they pivot to triage speed, they're likely early on the measurement maturity curve, which is where most of the category is right now. If they say "dwell time is a lagging indicator that's hard to attribute to a single tool," they're being honest about a genuinely hard problem. Products built around that metric are the ones most likely to deliver on what this category can genuinely do: meaningfully shorten the time between an attacker's first move and the moment someone stops them.

Microsoft May 2026 Patch Tuesday fixes 120 vulnerabilities, including critical RCE flaws affecting Office, SharePoint, DNS, and more.

EU Surveillance Technology exports face scrutiny over alleged sales to governments accused of rights abuses, says Human Rights Watch.

NCSC warns organisations to strengthen cyber hygiene and oversight before adopting AI vulnerability management tools.

Foxconn cyberattack disrupts North American sites as Nitrogen ransomware claims theft of 8TB of data and 11 million files.

The Americas cyber threat landscape also highlighted the continued targeting of critical infrastructure sectors during Q1 2026.

The Exim BDAT vulnerability CVE-2026-45185 affects GnuTLS builds and may allow memory corruption and remote code execution.

As part of the response to the TanStack npm supply chain attack, OpenAI is requiring all macOS users to update their app before June 12, 2026.

Malicious node-ipc npm package versions used tarballs and DNS TXT queries to steal credentials from developers and CI systems.

Fragnesia flaw in Linux Kernel XFRM ESP-in-TCP lets attackers gain root access through page-cache corruption vulnerabilities.

The Cyber Express weekly roundup covers AI cyberattacks, ransomware incidents, supply chain breaches, vulnerabilities, and global cyber risks 2026.

The following interview, which we publish in full, was conducted in May 2026 by Erez, a member of the deepdarkCTI community. The MedusaLocker ransomware gang is a persistent cybercriminal operation first observed in late 2019. It operates primarily as a Ransomware-as-a-Service (RaaS) model, where developers provide the malware to affiliates in exchange for a percentage