Cyber Briefing: 2026.05.12
The "Mini Shai-Hulud" supply chain attack and critical SAP vulnerabilities represent high-impact systemic risks, while the record GM settlement and the formation of the ACI signal a shift toward...
Welcome to Cyber Briefing, your daily source for all things cybersecurity. We bring you the latest advisories, alerts, incidents, and news every weekday.
The cybersecurity landscape is currently facing a dual threat from sophisticated supply chain attacks and critical software vulnerabilities. The “Mini Shai-Hulud” campaign successfully compromised over 170 software packages, impacting major entities like Mistral AI and TanStack by infiltrating downstream dependencies. Concurrently, SAP has issued urgent patches for critical flaws in its Commerce Cloud and S/4HANA platforms, while Škoda Auto confirmed a data breach involving customer information due to a exploited web shop vulnerability. These events underscore a persistent trend where attackers target the foundational software and third-party tools that modern enterprises rely on for core operations.
In response to shifting federal support and emerging technologies, the private sector and regulators are taking more assertive stances on security and privacy. Major U.S. firms have formed the Alliance for Critical Infrastructure (ACI) to bridge gaps left by federal cutbacks, while California’s $12.75 million settlement with General Motors sets a new precedent for enforcing data privacy under the CCPA. Amidst these changes, the role of the CISO is evolving into a strategic board-level position, focused on governing AI adoption and securing cross-platform communication, such as the new end-to-end encryption standards implemented between Apple and Google devices.
Listen to our podcast here ⏬
⚡THREAT LANDSCAPE
Mini Shai-Hulud Supply Chain Attack
A supply chain attack called Mini Shai-Hulud compromised over 400 malicious versions of 170 software packages, targeting prominent organizations including TanStack, Mistral AI, and UiPath. The campaign represents a significant threat to software supply chains by distributing compromised packages that could affect downstream users and systems. Organizations using these packages should immediately audit their dependencies and verify package integrity. Read More
SAP fixes critical vulnerabilities in Commerce Cloud, S/4HAN
SAP released May 2026 security updates fixing 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA ERP systems. The critical vulnerabilities could allow attackers to compromise enterprise e-commerce platforms and core business systems. Organizations using these SAP products should apply the security patches immediately to prevent potential exploitation. Read More
🚨INCIDENTS & REAL-WORLD IMPACT
Škoda online shop breach via vulnerability
Škoda Auto discovered attackers exploited a vulnerability in its online shop software to gain temporary unauthorized access to customer data. The company took the shop offline, patched the vulnerability, engaged IT forensics specialists, and notified data protection authorities. Technical analysis confirmed that stored customer data was accessed during the breach. Read More
🔓 EXECUTIVE RISK & CYBERNOMICS
Critical Infrastructure Coalition Launches
Major U.S. critical infrastructure operators including JPMorgan Chase, Mastercard, AT&T, and Berkshire Hathaway Energy have formed the Alliance for Critical Infrastructure (ACI) to coordinate cybersecurity efforts across sectors as federal support diminishes. The initiative responds to Trump administration cutbacks at CISA, elimination of the Critical Infrastructure Partnership Advisory Council, and reduced government capacity to support infrastructure protection. The ACI will focus on analyzing cross-sector dependencies, developing polycrisis response protocols, expanding information sharing, and advising policymakers while working alongside existing sector groups and remaining federal agencies. Read More
Apple, Google enable E2EE RCS messaging
Apple and Google have launched beta support for end-to-end encrypted Rich Communication Services (RCS) messaging between iPhone and Android devices, ending years of cross-platform messages traveling in plaintext. The feature requires iOS 26.5 and the latest Google Messages app, with availability varying by carrier and region. Users will see a lock icon in RCS conversations when encryption is active, bringing cross-platform texting security closer to apps like WhatsApp and Signal. Read More
🛡️ POLICY, REGULATION & LEGAL SIGNALS
California Settles $12.75M CCPA Case Against GM
California Attorney General Rob Bonta announced a $12.75 million settlement with General Motors for illegally collecting and selling driver data without proper consent, marking the largest California Consumer Privacy Act (CCPA) penalty to date. GM allegedly shared geolocation and driving behavior data from its OnStar platform with data brokers Verisk Analytics and LexisNexis Risk Solutions between 2020 and 2024, violating data minimization requirements. Under the settlement, GM must stop selling driving data to consumer reporting agencies for five years, delete retained data within 180 days, and establish a comprehensive privacy compliance program. Read More
💻 CAREER ENABLEMENT
CISOs Step Into AI Spotlight
Chief Information Security Officers (CISOs) are taking on expanded strategic roles as they manage AI adoption across enterprises, with 95% now engaging with boards multiple times monthly and 31% reporting directly to boards rather than CIOs. Security leaders are implementing AI governance frameworks to enable rapid business innovation while managing risks from AI-powered attacks, including sophisticated phishing campaigns and automated vulnerability exploitation. CISOs emphasize embedding security early in AI development, maintaining strong data governance and identity management, and positioning security as a business enabler rather than an obstacle. Read More
Copyright © 2026 CyberMaterial. All Rights Reserved.
Follow CyberMaterial on:
Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium