International law enforcement has successfully dismantled the GlassWorm malware infrastructure, which was being used to target software developers in a sophisticated supply chain attack. The operation disrupted a campaign that threatened to compromise developer environments and potentially poison legitimate software with malicious code. Authorities are continuing to investigate the scope of the attack and identify affected organizations.

Dark Reading is marking its 20th anniversary by looking at how cybersecurity has evolved from perimeter-focused defenses in 2006 to today's complex, AI-driven security landscape. The shift was driven by major infrastructure changes including cloud computing, mobile devices, and the Internet of Things, which forced security teams to move beyond simple firewalls and antivirus software to address identity management, data protection, and an expanding attack surface. While the technology and tactics have transformed dramatically, analysts note that core security principles remain the same—organizations still need to protect infrastructure, update systems, and train employees on security best practices.

Dutch authorities have arrested two men, ages 57 and 39, who allegedly provided bulletproof hosting services to Russian hackers through front companies designed to evade European Union sanctions. The suspects reportedly helped Stark Industries, a sanctioned web hosting provider run by Moldovan nationals, continue operating by transferring its infrastructure to Dutch companies that rented and resold server space, obscuring the real customers and facilitating Russian cyber attacks against EU targets. The operation resulted in searches at five locations and the seizure of laptops, phones, and over 800 servers.

Lithuanian authorities are investigating a massive data breach involving over 600,000 entries from national real estate and legal entity registers, which was accessed using legitimate login credentials from authorized institutions. Officials suspect a foreign country, likely Russia, orchestrated the breach as part of ongoing hybrid warfare operations against the Baltic nation. The head of Lithuania's Centre of Registers has resigned, and authorities have implemented emergency cybersecurity measures including blocking suspected accounts, while expressing concern that sensitive information about military personnel, intelligence officers, and diplomats may have been compromised.

DockSec is a new open source security tool that uses AI to help developers actually fix vulnerabilities in Docker images, not just find them. While existing scanners can detect hundreds of vulnerabilities in container images, DockSec runs tools like Trivy and Docker Scout, then uses an LLM to correlate findings, eliminate duplicates, and provide plain-English explanations with exact Dockerfile fixes. The project, recently adopted by OWASP, has been downloaded nearly 18,000 times and represents a methodology that could be adapted to other areas where AI detection outpaces remediation capabilities.

SecurityWeek's Threat Detection and Incident Response Summit, which took place on May 20th, is now available for free on-demand viewing for a limited time. The virtual event features sessions from leading security professionals covering critical topics including AI-driven defense, breach response strategies, identity protection, and modern detection techniques to help security teams combat alert fatigue and evolving cyber threats. Attendees can also access technical resources and explore the virtual expo hall.

Hackers exploited a zero-day vulnerability in KnowledgeDeliver, a learning management system widely used in Japan, to deploy web shells and Cobalt Strike backdoors. The flaw, tracked as CVE-2026-5426, stemmed from hardcoded encryption keys in Digital Knowledge deployments that allowed attackers to craft malicious payloads and compromise systems through ViewState deserialization attacks. Google's Mandiant says the threat actors used Godzilla web shells to modify access permissions and deliver fake security alerts before ultimately infecting systems with custom backdoors, and all KnowledgeDeliver deployments before February 24, 2026 are potentially at risk.

Anthropic has expanded Claude's enterprise appeal by announcing integrations with 28 major security and compliance platforms, including CrowdStrike, Palo Alto Networks, Microsoft, and Okta. Through the new Claude Compliance API, IT and security teams can now access conversation content and activity logs, allowing them to monitor and govern Claude using the same policies they apply to other workplace software. The move addresses a critical barrier to enterprise AI adoption by making Claude fit more seamlessly into existing corporate security infrastructure.

7-Eleven suffered a data breach in April impacting approximately 185,000 individuals, according to breach notification website HaveIBeenPwned. The attack, which occurred on April 8th and targeted the company's Salesforce systems containing franchise documents, exposed personal information including names, addresses, email addresses, and dates of birth. The notorious extortion group ShinyHunters claimed responsibility for stealing 600,000 Salesforce records, demanded ransom payment, and later published the data online after initially offering it for sale on a Russian hacking forum.

Check Point researchers report that Iranian APT group Nimbus Manticore, linked to Iran's Revolutionary Guard, has updated its tactics to target aviation and software companies in Saudi Arabia, Australia, and increasingly the United States. The group is now using a technique called AppDomain hijacking instead of DLL sideloading, deploying new backdoors like MiniFast through fake job offers and trojanized software downloads, including a malicious Zoom installer and fake SQL Developer website. Security researchers believe the threat actors may be using AI-assisted development tools to rapidly adapt their malware and maintain their infrastructure.