Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On May 26, 2026, at 14:00 UTC, the CrowdStrike Counter Adversary Operations team executed a coordinated takedown of the Glassworm botnet, a global threat targeting software developers through the open-source supply chain. In collaboration with Google and the Shadowserver Foundation, we struck all four of Glassworm's command-and-control (C2) channels simultaneously, severing the operators from their infected machines and their ability to deliver new malicious payloads.

In the IT world, there is something quietly sinister about a bank holiday. It’s not the holiday itself – who doesn’t love a bank holiday – a long weekend, a reason to grill something in unpredictable weather, the particular pleasure of feeling like you’ve slipped a Monday… The sinister part is structural.

Ransomware has moved beyond simple malware attacks. It is now operating under a structured business model that disrupts operations, not just systems. Attackers are not depending on phishing or malicious files to deploy ransomware. They instead use compromised identities and existing tools present within environments to move undetected. By the time encryption starts, the attack has already progressed across systems.

On 2026-05-22, an attacker rewrote every repository tag across four Composer packages in the Laravel-Lang ecosystem to point at malicious commits. The affected packages are laravel-lang/lang, laravel-lang/attributes, laravel-lang/http-statuses, and laravel-lang/actions. The rewrite took place on 2026-05-22 into the early hours of 2026-05-23. Every malicious commit makes the same two-file change: one entry added to composer.json, and one new file at src/helpersphp.

On May 22, 2026, we detected an active supply chain attack against Laravel-Lang. We filed a report with the maintainers immediately. The attacker published malicious version tags across three widely used repositories, injecting credential-stealing code that loads automatically via composer’s autoloader feature. What makes this particularly sneaky is that the malicious code was never committed to the official repos at all.

On May 22 and May 23, 2026, an attacker republished hundreds of malicious versions under historical release tags for four community-maintained Laravel localization libraries that are published on Packagist under the laravel-lang namespace.

For decades, finding a zero-day flaw followed a predictable script: a highly skilled human researcher spent weeks staring at source code, digging for edge cases, and manually stitching together an exploit. In April 2026, Anthropic flipped that script by announcing Claude Mythos. This frontier model didn’t just mark an incremental upgrade; it introduced autonomous, machine-speed vulnerability hunting.

A GitHub breach occurred on May 18, 2026 when a threat actor called TeamPCP pushed a malicious version of Nx Console (a widely used VS Code extension with 2.2 million installs) to Microsoft’s official Visual Studio Marketplace.

Suppose that the hospital allows a vital software update of its infusion pumps to go through, and all security tests pass. The signature looks valid. The certificate is scrapless. Everything appears legitimate. The update was forged by an attacker who cracked a key that was considered unbreakable just five years ago. The general perception of most individuals is that after encryption or after data is digitally signed, it stays secure indefinitely. That assumption is now perilously outdated.