Twenty years ago, Dark Reading published a groundbreaking column about a penetration test where a security expert scattered rigged USB thumb drives in a credit union parking lot, successfully exploiting employee curiosity when workers plugged them into company computers. The article by Steve Stasiukonis became Dark Reading's first viral hit and remains a landmark story in cybersecurity journalism, demonstrating how human behavior can be the weakest link in security even before social engineering attacks became a widely recognized threat.

Education technology company Instructure, maker of the widely-used Canvas learning platform, has disclosed a data breach following a cyberattack that disrupted services over the May Day weekend. The company says attackers accessed personal information including names, email addresses, and student ID numbers, while the hacker group ShinyHunters claims to have stolen 3.65 terabytes of data affecting 275 million students and teachers at nearly 9,000 institutions worldwide. Instructure has revoked privileged credentials, reissued application keys, and deployed security fixes, though they haven't confirmed the full scope of the breach or specifically attributed the attack to ShinyHunters.

More than 40,000 servers have been compromised in an ongoing campaign exploiting a recently patched cPanel zero-day vulnerability. The flaw, tracked as CVE-2026-41940, allows attackers to bypass authentication and gain full administrative access to servers, potentially compromising all hosted websites and databases. The vulnerability was likely exploited since late February before being publicly disclosed on April 28, and CISA has now added it to its Known Exploited Vulnerabilities catalog, giving federal agencies just four days to patch their systems.

OpenAI has launched Advanced Account Security, an opt-in feature designed for ChatGPT users at higher risk of targeted attacks, including journalists, researchers, and political dissidents. The security upgrade requires physical security keys or passkeys instead of passwords, replaces traditional email and SMS recovery with backup keys, shortens session times, and automatically excludes user conversations from AI training. The feature is now available through a dedicated enrollment page, with OpenAI partnering with Yubico to offer discounted security keys for those who want the extra protection.

CISA is warning that attackers are actively exploiting a nearly decade-old Linux kernel vulnerability dubbed Copy Fail that allows authenticated users to escalate privileges to root shell access. The vulnerability, tracked as CVE-2026-31431, has been added to CISA's Known Exploited Vulnerabilities catalog, with federal agencies given two weeks to patch. Microsoft reports limited exploitation so far but warns the flaw is particularly dangerous in cloud and Kubernetes environments because a public proof-of-concept exists and any local unprivileged user can reliably exploit it to gain full system control.

DigiCert has revoked 60 fraudulently obtained security certificates after hackers breached its support portal in April. The attackers delivered malware through customer chat disguised as a screenshot, infected two systems, then exploited support analyst access privileges to obtain initialization codes for EV Code Signing certificates. Among the revoked certificates, 11 were used to sign the Zhong Stealer malware, and DigiCert has since implemented stronger security controls including mandatory multi-factor authentication and restricted file-sharing capabilities in support channels.

Cybersecurity mergers and acquisitions remained robust in April 2026 with 33 deals announced, reflecting continued industry consolidation around AI security and identity protection. Notable transactions include Palo Alto Networks acquiring AI gateway firm Portkey for up to 140 million dollars, Cyera buying Ryft for an estimated 100 to 130 million dollars to strengthen its agentic AI security platform, and Silverfort acquiring Fabrix Security to bolster identity protection for human, machine, and AI agents. The deals signal that cybersecurity firms are racing to build capabilities around emerging threats from autonomous AI systems and expanding attack surfaces.

Cybersecurity firm Trellix has disclosed a breach of part of its source code repository, though the company says there's no evidence the code was exploited or that its release process was compromised. The timing suggests a possible connection to a wider supply chain campaign linked to hacker groups TeamPCP and Lapsus Dollar, which has also hit other security companies including Checkmarx, Aqua Security, and Bitwarden through compromised development pipelines. Trellix is working with forensic experts and law enforcement while promising more details after the investigation concludes.

Cisco announced plans to acquire Astrix Security, a startup specializing in securing non-human identities like API keys and OAuth tokens, for a reported $400 million. The acquisition addresses growing security concerns around AI agents and machine-to-machine access, as these automated identities rapidly expand the enterprise attack surface. Cisco plans to integrate Astrix's technology, which discovers and governs non-human identities and detects threats like compromised credentials and rogue agent behavior, into its broader security platform including Duo IAM.

A critical cPanel vulnerability is actively being exploited by threat actors targeting government agencies and managed service providers. The security flaw in the widely-used web hosting control panel software has been weaponized in active attacks, allowing hackers to potentially compromise hosting infrastructure. Security experts are urging administrators to immediately patch their systems, as the vulnerability provides attackers with a powerful entry point into sensitive networks.