Daily cybersecurity briefing for CISOs and security leaders.

🎧 Listen to this episode

Today's episode covers 8 stories across 3 topic areas, including: Verizon Breach Report: Vulnerability Exploitation Surges; Four AI supply-chain attacks in 50 days exposed the release pipeline red teams aren't covering; The New Phishing Click: How OAuth Consent Bypasses MFA.

BankInfoSecurity · May 19 · Relevance: █████████░ 9/10

Why it matters to CISOs: The 2026 Verizon DBIR is essential board-level intelligence — the finding that half of all breaches now involve ransomware and that vulnerability exploitation continues to surge provides concrete data to justify patch management and resilience investments.

📖 Read full article

VentureBeat Security · May 18 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Four supply-chain incidents hitting OpenAI, Anthropic, and Meta in 50 days expose a critical blind spot in AI release pipelines — CISOs adopting AI tooling must extend third-party risk assessments to cover CI/CD, dependency, and packaging integrity beyond model safety evaluations.

📖 Read full article

The Hacker News · May 19 · Relevance: ████████░░ 8/10

Why it matters to CISOs: The EvilTokens PhaaS platform compromised 340+ M365 orgs in five weeks by abusing OAuth device code flows to bypass MFA entirely — CISOs must evaluate conditional access policies and consider blocking device code authentication flows.

📖 Read full article

Krebs on Security · May 18 · Relevance: █████████░ 9/10

Why it matters to CISOs: A CISA contractor publicly exposing GovCloud credentials and internal deployment details is a worst-case supply chain and insider risk scenario — CISOs should use this to justify stricter secrets management and CI/CD pipeline audits across their own organizations.

📖 Read full article

TechCrunch Security · May 18 · Relevance: █████████░ 9/10

Why it matters to CISOs: A 1.8M-record healthcare breach involving biometric data (fingerprints) raises the stakes on irreversible data exposure — CISOs should reassess biometric data handling, storage, and incident response plans given that biometrics cannot be reset like passwords.

📖 Read full article

The Record (Recorded Future) · May 18 · Relevance: ████████░░ 8/10

Why it matters to CISOs: Grafana's breach via a stolen GitHub token and public refusal to pay ransom is a case study in token/secret management failures and incident response transparency — CISOs should audit PAT and service account hygiene across development environments.

📖 Read full article

BleepingComputer · May 19 · Relevance: ███████░░░ 7/10

Why it matters to CISOs: ShinyHunters claiming another major retailer reinforces the persistent threat to large consumer-facing enterprises — CISOs in retail and adjacent sectors should ensure threat intelligence covers this prolific extortion group's evolving TTPs.

📖 Read full article

Dark Reading · May 18 · Relevance: █████████░ 9/10

Why it matters to CISOs: An actively exploited Exchange zero-day (CVE-2026-42897) with no patch available demands immediate mitigation action — CISOs with OWA-exposed environments should implement compensating controls and monitor for mailbox compromise.

📖 Read full article

Jordan: A CISA contractor left highly privileged AWS GovCloud credentials sitting in a public GitHub repository. Not encrypted. Not rotated. Public. Security researchers are calling it one of the most egregious government data leaks in recent history. And it's Tuesday.

Alex: Welcome to Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves.

Alex: Today we are not short on material. The 2026 Verizon DBIR dropped and the headline numbers deserve your attention. We've got an Exchange zero-day with no patch, a PhaaS platform that's making MFA irrelevant for hundreds of Microsoft 365 organizations, AI supply chain attacks hitting the biggest names in the industry, and two major breaches — one involving 1.8 million people's fingerprints. Let's get into it.

Jordan: Start with the DBIR because this is your board ammunition for the next budget cycle. Verizon's 2026 report confirms two things that should not surprise anyone in this audience but will absolutely land differently when you're citing an industry benchmark. Vulnerability exploitation as an initial access vector continues to surge. And half — half — of all successful breaches now involve some form of ransomware action. The other number that matters: patch rollout timelines are slowing. Not holding steady. Slowing. Exploitation is going up, patching speed is going down. That's not a trend, that's a collision.

Alex: And here's the strategic framing for your CFO conversation. This report gives you third-party validation to defend every dollar you're spending on patch management tooling, vulnerability prioritization, and ransomware resilience. The board doesn't want to hear your threat model. They want to hear what happened to everyone else. The DBIR is that story. Use it.

Jordan: Speaking of patches that don't exist yet — CVE-2026-42897. Active exploitation, no fix. This is an XSS vulnerability in Exchange hitting Outlook Web Access mailboxes. If you have OWA exposed to the internet, this is not a watch-and-wait situation.

Alex: The compensating controls conversation here is straightforward: restrict external access to OWA where you can, implement WAF rules targeting the XSS vector, and get your SOC hunting for mailbox manipulation indicators now. Don't wait for Microsoft's patch cadence to protect an exposed attack surface.

Jordan: What I'd add — and this is worth flagging for anyone still running on-premises Exchange — this vulnerability is a reminder that legacy mail infrastructure sitting on the perimeter is a persistent liability. The pressure to migrate isn't just about features.

Alex: Let's talk about OAuth phishing, because this is the MFA story that should make you revisit your conditional access architecture today. The EvilTokens PhaaS platform compromised more than 340 Microsoft 365 organizations across five countries in five weeks. Here's the mechanism: attackers send targets a message asking them to visit microsoft.com/devicelogin and enter a short code. The user does it. They complete their normal MFA challenge. They think they've authenticated into something legitimate. They haven't. They've handed attackers a persistent OAuth token tied to their account.

Jordan: The genius of this attack — and I use that word reluctantly — is that there is no phishing page. The victim goes to a real Microsoft domain, completes a real MFA prompt, and walks away feeling secure. The attack abuses the device code flow, which was designed for scenarios like smart TVs and printers that can't handle browser-based authentication. It was never intended to be an enterprise identity pathway, and it's being weaponized systematically.

Alex: The action item is direct: evaluate whether your organization actually needs device code authentication flows enabled. For most enterprise environments, the answer is no. Block it in conditional access. If you can't block it entirely, scope it tightly and alert on it. 340 organizations in five weeks is a significant deployment rate for a platform that's been live since February.

Jordan: Now let's spend some time on AI supply chain, because four incidents in 50 days across OpenAI, Anthropic, and Meta is a pattern, not a coincidence. The critical insight here is that none of these attacks targeted the model itself. They targeted the release pipeline — CI runners, dependency hooks, packaging gates.

Alex: This is the maturity gap in how most organizations are thinking about AI risk. Vendor questionnaires ask about model safety evaluations, responsible disclosure processes, red team assessments. Almost none of them ask about artifact integrity, dependency management, or CI/CD security for the AI tooling you're ingesting. That's the gap these attackers are walking through.

Jordan: The Mini Shai-Hulud worm is the specific case worth examining. On May 11th, it published 84 malicious package versions across 42 npm packages in the tanstack namespace — in six minutes. The packages carried valid SLSA Build Level 3 provenance. Build-level attestation did not save anyone here. The integrity signal was legitimate. The packages were not.

Alex: Which means your third-party risk program needs a new appendix. If you are onboarding AI tooling — and you are — your vendor security assessments need to include questions about CI/CD pipeline integrity, artifact signing beyond basic provenance, and incident response for supply chain compromise scenarios. This is not covered by most existing frameworks.

Jordan: Two breach stories that belong together because they share a root cause: secret sprawl and token hygiene.

Alex: Start with CISA, because the irony is uncomfortable. A CISA contractor maintained a public GitHub repository containing credentials to highly privileged AWS GovCloud accounts. The repo also included internal documentation on how CISA builds, tests, and deploys software. Experts are calling it one of the most egregious government data leaks in recent history. The agency responsible for protecting critical infrastructure had a contractor exposing its own deployment architecture to the public internet.

Jordan: The lesson here isn't to pile on CISA. The lesson is that this exact scenario is replicating itself silently in enterprise environments right now. Developer repos with hardcoded credentials, service account tokens committed alongside application code, CI/CD pipelines with embedded secrets that have never been audited. This is the baseline. Not the exception.

Alex: Your action coming out of this story: run a secrets scanning pass across your GitHub organizations this week. Tools exist for this. The question is whether you've prioritized it. CISA's incident should make that prioritization easier.

Jordan: Grafana reinforces it. Hackers gained access to Grafana Labs' entire codebase through a stolen GitHub access token. Grafana publicly refused to pay the ransom, which I respect as a posture, but the access vector is the story. One compromised personal access token. That's the blast radius.

Alex: And Grafana is widely deployed observability infrastructure. If you're running it in your environment, your security team should already be reviewing whether your Grafana instance has been updated and whether any downstream integrity concerns apply to your deployment.

Jordan: Quickly on 7-Eleven — ShinyHunters has confirmed another major brand. Retail CISOs know this group well. They are systematic, they are prolific, and their TTPs evolve. If you're in consumer-facing enterprise and you're not actively tracking ShinyHunters' current playbook in your threat intel program, fix that.

Alex: The breach story with the longest tail is NYC Health + Hospitals. 1.8 million people. Stolen medical records. And fingerprints. This is where healthcare breach severity calculus changes.

Jordan: You cannot issue someone new fingerprints. That's the distinction that matters. Every other credential compromise has a remediation path — reset the password, revoke the token, reissue the card. Biometric data is permanently compromised once it's stolen. The irreversibility changes the liability picture and it should change how you store it.

Alex: If your organization collects biometric data — and increasingly they do, whether for access control, fraud prevention, healthcare records — your incident response plan needs a biometric-specific track. What's your notification obligation? What's your remediation offer to affected individuals? What does recovery actually look like when the compromised data can't be replaced? Most IR playbooks haven't answered those questions yet.

Jordan: Outlook for the week. The theme I keep coming back to across everything we've covered today is that defenders are being systematically outpaced in the areas they assumed were mature. Patch management — slowing. MFA — bypassed. Supply chain attestation — circumvented. Secrets management — still failing at CISA. The adversary surface isn't expanding because attackers found new zero-days. It's expanding because the fundamentals aren't holding.

Alex: What I'd tell any CISO walking into a board meeting this week: the 2026 DBIR gives you the macro narrative. The Exchange zero-day gives you immediate urgency. The OAuth story gives you a reason to reopen your identity architecture conversation. And the CISA breach gives you the internal audit justification you may have been waiting for. This is a week where the news cycle actually hands you leverage. Use it deliberately.

Jordan: Watch the Exchange patch timeline closely. Microsoft has not committed to an out-of-band release as of this recording. If that changes, we'll flag it.

Alex: That's Cleartext for Tuesday, May 19th. Show notes and links to every story we covered today are at cleartext.fm. If this was useful, share it with a peer who needs it. We'll be back tomorrow.

Cleartext is an automated daily podcast for CISOs and security leaders. Generated 2026-05-19.

Sources are pulled from: CyberScoop, The Record, SecurityWeek, Krebs on Security, Dark Reading, Cybersecurity Dive, BleepingComputer, Wired, Ars Technica, TechCrunch, Help Net Security, VentureBeat, Risky Business News, The Hacker News, CISA, and BankInfoSecurity.