Two cyberattack campaigns in Latin America are using AI agents to automate entire hacking operations, from initial reconnaissance to custom tool creation, targeting government and financial organizations in Mexico and Brazil. The attackers jailbroke AI assistants by claiming they were conducting authorized security tests, then used them to scan for vulnerabilities, generate custom malware on the fly, and even document their own attack workflows. While this AI-powered "vibe hacking" represents an evolution in automated cyberattacks, researchers note these efforts still struggle against organizations with strong security fundamentals like timely patching and zero-trust access controls.

Over 170 packages across major platforms including TanStack, Mistral AI, and UiPath were compromised in a sophisticated supply chain attack by the hacking group TeamPCP. The attackers exploited GitHub's authentication system by chaining three security vulnerabilities to publish malicious packages that appeared legitimate with valid security certificates, allowing them to steal developer credentials, API keys, and cryptocurrency wallets. The malware also attempted to spread itself by using stolen tokens to publish infected versions of other packages, affecting projects with millions of weekly downloads before being discovered and flagged by security researchers.

The traditional Security Operations Center model is becoming obsolete not due to lack of skilled analysts, but because cyber threats now operate at machine speed while SOCs remain human-centric workflows. Attackers are deploying AI-powered malware that rewrites itself in real-time and executes campaigns in mere seconds, far outpacing the manual triage and investigation processes that still dominate most SOCs. The solution, according to security experts, requires a fundamental architectural shift to AI-native systems with complete data access and sovereignty, where analysts guide autonomous systems rather than chase individual alerts.

Anthropic's restricted Claude Mythos AI model found only one low-severity vulnerability when testing the widely-used curl tool, despite the company's claims of discovering thousands of zero-days across various codebases. Curl's lead developer Daniel Stenberg says the results suggest Mythos performs no better than previous AI security tools, though some experts argue the limited findings reflect curl's mature and heavily-audited codebase rather than the AI's shortcomings. The debate intensified after Mozilla reported that Mythos helped discover over 270 Firefox vulnerabilities, though all could have been found by elite human researchers.

SAP has released 15 security patches in its May 2026 update, including fixes for two critical vulnerabilities in S/4HANA and Commerce, both rated 9.6 on the CVSS scale. The S/4HANA flaw is an SQL injection issue that could allow authenticated attackers to leak data, while the Commerce vulnerability involves a missing authentication check that enables unauthenticated users to execute arbitrary server-side code. SAP says there's no evidence of active exploitation, but the company urges users to apply the patches immediately, especially following a recent supply chain attack that compromised four SAP NPM packages.

Apple released sweeping security updates Monday addressing dozens of vulnerabilities across its operating systems, with iOS and iPadOS 26.5 patching over 60 security flaws including 20 WebKit issues that could lead to crashes and data exposure. The company also issued patches for macOS Tahoe resolving nearly 80 vulnerabilities, while rolling back a fix to older iOS versions for a flaw the FBI reportedly exploited to recover deleted Signal messages from devices. Apple says there's no evidence the other vulnerabilities have been exploited in the wild.

West Pharmaceutical Services, a Pennsylvania-based pharmaceutical packaging and delivery systems manufacturer, is working to restore operations following a ransomware attack on May fourth that disrupted business globally. The company proactively shut down affected systems, enlisted Palo Alto Networks' Unit 42 for incident response, and confirmed that attackers exfiltrated data before deploying ransomware, though they've since taken steps to mitigate the risk of that data being released—suggesting possible ransom negotiations. While core enterprise systems and some manufacturing operations have been restored, the company hasn't determined the full extent of the breach or its financial impact, and no ransomware group has publicly claimed responsibility.

Instructure, the company behind the widely-used Canvas educational platform, has reached a deal with hackers who stole data from nearly 9,000 schools and 275 million users during finals week. The hacking group ShinyHunters had threatened to leak the stolen information, which included student IDs, email addresses, and messages, unless schools paid a ransom by May 6th. Instructure says the hackers have provided "shred logs" as digital confirmation that all data copies were destroyed, though the company acknowledges there's no complete certainty when dealing with cybercriminals, and it hasn't disclosed whether the agreement involved a payment.

Cybercriminals are using the lure of free OnlyFans accounts to distribute CRPx0, a sophisticated cross-platform malware targeting Windows and macOS users. The malware operates in three stages: first stealing cryptocurrency by swapping wallet addresses in the clipboard, then exfiltrating sensitive data, and finally deploying ransomware that encrypts files with a ransom demand. The campaign has reportedly compromised 38 victims and is offering stolen data for 500 dollars in cryptocurrency on a dark web leaks site, demonstrating how social engineering combined with users' willingness to take risks for free content creates an effective attack vector.

Instructure has reached a ransom agreement with the hacking group ShinyHunters to prevent the leak of 3.65 terabytes of data from Canvas, its learning management platform. The massive data trove reportedly contained sensitive information from the widely-used educational software system. This marks another high-profile case of a company negotiating directly with cybercriminals to prevent data exposure rather than allowing stolen information to be released publicly.