Weekly Threat Intelligence Digest — May 11 to May 18, 2026

Weekly threat intelligence digest from 481 items (72 critical, 159 high).

LIVETHREAT WEEKLY THREAT DIGEST May 11 – May 18, 2026 This week’s data confirms a growing reality: attacks are no longer aimed directly at your own firewalls, they are slipping through the doors of your trusted vendors. Zero‑day exploits built with AI, supply‑chain compromises of npm/PyPI packages, and privileged‑account hijacks in SaaS admin consoles dominate the breach landscape. From the OpenAI TanStack supply‑chain breach to the Cisco SD‑WAN zero‑day and the Funnel Builder WordPress skimmer, the common thread is the abuse of trusted access rather than a flaw in your own code. 👉 The highest‑risk vector this week is privileged third‑party access, not unpatched software inside your perimeter. 🚨 EXECUTIVE RISK SNAPSHOT * Supply‑chain entry points explode → MSPs, CI/CD pipelines, SaaS admin APIs, and open‑source package feeds were the primary compromise routes. * Privilege determines impact → A single hijacked cloud admin account enabled ransomware at Foxconn and data loss of 3.6 TB from Canvas, affecting thousands of downstream customers. * Blind spots remain massive → OT/IoT devices, fourth‑party services, and unmanaged plugins are absent from most TPRM inventories, leaving critical exposure invisible. 🔍 WHAT CHANGED THIS WEEK * AI‑assisted exploits accelerated, with Google confirming the first AI‑crafted zero‑day and a 2FA bypass used in the wild. * Third‑party dependency attacks surged; malicious TanStack npm packages compromised two OpenAI workstations and forced macOS updates. * Critical vulnerabilities in widely‑used infrastructure (Cisco SD‑WAN, NGINX rewrite module, Fortinet Sandbox) were actively exploited within days of disclosure. * Ransomware shifted focus to high‑impact manufacturers (Foxconn) and SaaS platforms (Canvas), leveraging existing privileged access to amplify downstream disruption. 🎯 WHERE YOU ARE MOST LIKELY EXPOSED * SaaS admin consoles – especially API providers like OpenAI, Grafana, and Cloud Hosting platforms. * WordPress ecosystems – any site running Funnel Builder, WooCommerce, or other third‑party plugins. * Network edge devices – Cisco SD‑WAN controllers, NGINX web servers, and Fortinet security appliances. * CI/CD pipelines – Jenkins, Checkmarx, and other build tools that ingest third‑party packages. * Cloud hosting accounts – Azure, AWS, and Google Cloud admin credentials used by Managed Service Providers. ⚡ WHAT TPRM LEADERS SHOULD DO THIS WEEK 1. Verify privileged access inventories  • Request updated admin‑account lists from all SaaS and cloud vendors. 👉 Ask: “Which accounts have full admin rights to your production environment and how are they audited?” 2. Audit third‑party code dependencies  • Demand SBOMs for all software components, focusing on npm, PyPI, and container images. #Cybersecurity #TPRM #VendorRisk #SupplyChainSecurity #ThreatIntel #LiveThreat #VerisqAI

Daily breach, advisory, and vulnerability briefs publish every weekday.