Full Daily Digest

The Dutch operation against THE.Hosting underscores the limitations of localized law enforcement actions against globally distributed cybercriminal networks. The attackers leveraged ASN retention and BGP announcements to quickly resume operations from unaffected servers in other countries. Mitigation requires cross-border collaboration to blackhole malicious IP blocks and disrupt BGP routing. Defenders should monitor for scanning activity from AS209847 and harden IoT devices and web applications against opportunistic attacks. The case also highlights the need for stricter RIR policies to prevent abuse of IP allocations by malicious actors.

Dark Reading · 2026-05-28 · Incidents: Dutch raid on THE.Hosting failed to disrupt its malicious activities due to retained IP space and global server distribution.

The hearing underscores the escalating arms race in AI-driven cybersecurity, where advanced models can both uncover vulnerabilities and be weaponized by adversaries. Attack paths may include AI-enhanced phishing, automated exploit generation, and adversarial machine learning to bypass defenses. Mitigation requires robust AI governance frameworks, continuous monitoring of AI tool usage, and public-private collaboration to standardize defensive AI applications. The scope extends beyond technical vulnerabilities to geopolitical stakes, as nations vie for AI supremacy. Proactive measures like red-teaming AI systems and investing in AI-hardened infrastructure are critical to staying ahead.

CyberScoop · 2026-05-28 · Policy: House subcommittee to scrutinize AI's cybersecurity implications, focusing on national security and vulnerability management.

This incident underscores the critical importance of insider threat programs and access control mechanisms within organizations. Spagnuolo exploited his privileged access to Google’s internal tools, bypassing ethical and confidentiality policies to gain an unfair advantage in a prediction market. The attack path involved accessing nonpublic search trend data, placing bets on Polymarket, and attempting to conceal the origins of his profits through cryptocurrency transactions. Organizations must implement stricter monitoring of privileged access, enforce robust data classification policies, and conduct regular audits of employee activities. Additionally, insider threat detection systems should be enhanced to identify unusual access patterns or data exfiltration attempts. This case also highlights the need for clear policies on the use of internal data and the consequences of policy violations.

CyberScoop · 2026-05-28 · Incidents: Google engineer accused of insider trading using confidential search data to profit $1.2M on Polymarket.

The article underscores the limitations of relying solely on CVSS for vulnerability prioritization, as it only assesses severity without considering the likelihood of exploitation. EPSS complements CVSS by providing a dynamic, probability-based score that predicts exploitation within 30 days. This dual approach allows organizations to allocate resources more effectively, addressing vulnerabilities that pose immediate threats. Additionally, leveraging CISA's KEV catalog helps identify vulnerabilities actively exploited in the wild. Organizations should integrate EPSS into their enrichment pipelines and combine it with CVSS to refine their patch management strategies. This approach not only reduces operational strain but also strengthens overall security posture by focusing on high-impact, high-likelihood vulnerabilities.

Cisco Talos · 2026-05-28 · Vulnerability: Combining CVSS and EPSS enhances vulnerability prioritization, focusing on high-risk exploits to reduce patch backlogs effectively.

The vulnerability exploits the `--exec` flag in `git rebase`, allowing attackers to inject shell commands through crafted branch names. This attack path is particularly dangerous because it requires only basic user privileges and no interaction with other users. The flaw affects all supported platforms (Windows, Linux, macOS) and can lead to full server compromise, credential theft, and cross-tenant data breaches. Mitigations include disabling user registration (`DISABLE_REGISTRATION = true`) and repository creation (`MAX_CREATION_LIMIT = 0`), as well as auditing rebase merge settings. Rapid7's Metasploit module further underscores the urgency, automating exploitation for both Linux and Windows targets.

The Hacker News · 2026-05-28 · Vulnerability: Gogs RCE flaw lets authenticated users execute arbitrary code via malicious branch names during rebase operations.

The article reveals a critical oversight in AI deployment: organizations are neglecting foundational software security principles in their rush to adopt agentic AI. The vulnerabilities exploited in these systems are often legacy issues like insecure authentication or poor access controls, not novel AI-specific flaws. Attack paths typically involve exploiting these traditional weaknesses to manipulate AI outputs or exfiltrate data. The scope is broad, affecting any organization deploying AI without rigorous software security practices. Mitigations include integrating time-tested security measures (e.g., least privilege, input validation) into AI systems and treating AI agents like any other software component requiring robust security hygiene.

Dark Reading · 2026-05-28 · Vulnerability: Agentic AI risks stem from traditional software vulnerabilities, not the AI models themselves.

The exploitation of CVE-2026-35616 highlights a sophisticated attack vector leveraging trusted endpoint management infrastructure. Threat actors bypass API authentication to escalate privileges, modify EMS configurations, and push malicious scripts to endpoints. These scripts masquerade as legitimate updates, executing a Windows information stealer that harvests sensitive browser data. The attack path involves leveraging FortiClient's management pathway to distribute malware, eliminating the need for separate intrusion paths to each device. Mitigation requires immediate patching to FortiClient EMS 7.4.7, monitoring for unusual PowerShell activity, and restricting API access to trusted sources. Organizations should also enforce endpoint security policies to detect and block unauthorized script execution.

The Hacker News · 2026-05-28 · Incidents: Attackers exploit FortiClient EMS flaw to deploy credential-stealing malware via malicious PowerShell scripts.

The Gentlemen ransomware stands out due to its dual-threat approach: per-file encryption using ephemeral Curve25519 keys with XChaCha20 and aggressive lateral movement techniques. This combination ensures rapid network compromise post-initial access. The ransomware's Go-based code, obfuscated with Garble, complicates detection and analysis. Affiliates, including penetration testers and initial access brokers, are recruited via BreachForums, amplifying its reach. Organizations in education, healthcare, and finance are primary targets, with attacks observed across multiple continents. Mitigation requires robust endpoint detection, network segmentation, and regular patching to limit lateral movement. Additionally, monitoring for IOCs like the provided SHA-256 hashes is critical.

Microsoft Security Blog · 2026-05-28 · Incidents: The Gentlemen ransomware leverages strong encryption and rapid lateral movement to maximize impact across global organizations.

The attack path began with the compromise of a single employee account, likely through phishing, enabling ShinyHunters to infiltrate Carnival's IT environment. The group exfiltrated extensive personal data, including highly sensitive identifiers, and attempted extortion before leaking the data. This incident underscores the critical need for robust phishing defenses, multi-factor authentication, and continuous monitoring of privileged accounts. Organizations should also implement data minimization strategies to limit the exposure of sensitive information. Carnival's delayed public disclosure, while understandable for thorough investigation, highlights the tension between transparency and operational security in breach response.

The Record by Recorded Future · 2026-05-28 · Incidents: Carnival confirms a data breach affecting 6 million people, with ShinyHunters stealing sensitive personal information via a compromised employee account.

The Verizon 2026 DBIR underscores a shift in attacker tactics, with exploited vulnerabilities surpassing credential abuse as the leading initial access vector. However, credentials remain central to breach progression, enabling attackers to pivot from initial footholds to broader system compromise. DevSecOps workflows, reliant on non-human access mechanisms like API keys and tokens, are particularly susceptible to credential misuse. Attackers exploit these credentials to escalate privileges, access sensitive data, and deploy ransomware. Mitigation requires a multi-layered approach: implementing secret scanning tools to detect exposed credentials, integrating secrets vaults for centralized management, and establishing rapid credential rotation workflows. Organizations must also map trust paths, identify ownership gaps, and address over-permission issues to reduce attack surfaces. Proactive incident readiness, including comprehensive secrets inventories and governance, is essential to disrupt attacker momentum and minimize breach impact.

GitGuardian Blog · 2026-05-28 · Vulnerability: Exploited vulnerabilities dominate initial access, but credential abuse remains pivotal in breach escalation, underscoring the need for robust secrets governance.

The public disclosure of zero-day vulnerabilities by Chaotic Eclipse highlights a critical tension in the cybersecurity community. Microsoft’s stance on Coordinated Vulnerability Disclosure (CVD) underscores the need for responsible disclosure to minimize risk. The vulnerabilities disclosed—BlueHammer, RedSun, and UnDefend—are already being exploited, indicating a rapid escalation in threat activity. Attack paths likely involve leveraging these vulnerabilities to bypass security mechanisms in Windows components like Defender and BitLocker. Mitigation requires immediate patching and heightened monitoring for exploitation attempts. The removal of the researcher’s GitHub account and subsequent uploads to GitLab suggest a contentious relationship between researchers and vendors, complicating future collaboration. Defenders should prioritize vulnerability management and engage in proactive threat hunting to mitigate risks.

The Hacker News · 2026-05-28 · Vulnerability: Microsoft condemns public zero-day disclosures, citing increased customer risk and active exploitation of vulnerabilities like BlueHammer, RedSun, and UnDefend.

This case underscores the predatory tactics of online sextortion, where perpetrators exploit social media platforms to groom and coerce minors. Pathmanathan's method involved creating fake teenage personas to gain trust, then escalating to blackmail. The attack path reveals vulnerabilities in social media age verification and content moderation. Mitigation strategies include stricter platform policies, parental controls, and education on digital safety for children. The scope—145 victims across the U.S.—demonstrates the widespread impact of such crimes, necessitating cross-border legal cooperation and enhanced law enforcement capabilities to combat online child exploitation.

The Record by Recorded Future · 2026-05-28 · Incidents: Canadian man sentenced to 33 years for sextorting 145+ children via social media.

The Azure Backup for AKS privilege escalation flaw allows users with minimal permissions to gain cluster control, highlighting misconfigurations in role-based access controls. The Google Password Manager PIN exploit via AitM phishing demonstrates how session cookies and PINs can decrypt entire credential vaults, enabling persistent access. The trojanized RVTools installer, signed with a legitimate Sectigo certificate, deploys a modular RAT, bypassing endpoint defenses. These attacks exploit trust in signed software and MFA, emphasizing the need for real-time OCSP/CRL checks and enhanced endpoint monitoring. Organizations should enforce stricter access controls, conduct regular audits, and educate users on phishing tactics.

The Hacker News · 2026-05-28 · Incidents: Attackers exploit privilege escalation, AitM phishing, and trojanized installers, emphasizing the need for faster patching and stricter endpoint controls.

The GHOST STADIUM campaign exemplifies advanced phishing tactics, leveraging a near-perfect replica of FIFA's login system to bypass user suspicion. The attack path involves silent redirects to the real FIFA site post-credential theft, coupled with immediate account lockouts via password reset requests. This dual-layer deception maximizes success rates. The scope is vast, targeting premium ticket buyers with losses projected at $71M-$474M, while downstream fraud could escalate to billions. Mitigation includes strict domain verification, multi-factor authentication, and public awareness campaigns. Facebook's ad ecosystem requires tighter scrutiny to prevent abuse. Group-IB's findings underscore the need for proactive domain takedowns and cross-platform threat intelligence sharing.

The Record by Recorded Future · 2026-05-28 · Incidents: Chinese-speaking fraudsters are using 300+ fake FIFA domains to steal millions from World Cup fans via sophisticated phishing and fake ticket sales.

Russia's hybrid warfare strategy leverages both physical and cyber domains to destabilize the UK and Europe. Attack paths include targeting undersea cables, corporate networks, and public opinion algorithms, often below traditional war thresholds. The scope extends to critical infrastructure, democratic processes, and supply chains, aiming to erode public trust and disrupt societal stability. Mitigation efforts involve defending subsea infrastructure, disrupting Russian smuggling networks, and countering sabotage. The National Cyber Force plays a pivotal role in addressing state-sponsored threats and criminal activities. Additionally, the rise of AI and quantum computing necessitates proactive measures, such as transitioning to quantum-resistant encryption and fostering international alliances to bolster resilience against cyber aggression.

The Record by Recorded Future · 2026-05-28 · Incidents: Russia is executing daily hybrid attacks on the UK, targeting critical infrastructure and public trust, with GCHQ urging heightened cybersecurity and quantum-resistant systems.

Cloudflare’s approach mitigates the risks associated with data sprawl, a common issue in hyper-growth environments. By consolidating access through Town Lake, they reduce the attack surface associated with multiple credentials and systems. Skipper’s AI-driven querying minimizes human error and ensures consistent, auditable responses. The platform’s focus on memory layers and context-aware corrections enhances accuracy over time. However, the reliance on SQL and AI introduces potential vulnerabilities, such as SQL injection or AI model poisoning. Mitigation strategies include rigorous access controls, query auditing, and continuous monitoring of AI outputs. Organizations facing similar challenges should consider adopting unified platforms with robust security measures.

Cloudflare Blog · 2026-05-28 · Tools: Cloudflare’s Town Lake and Skipper simplify data access and querying across disparate systems, enabling rapid, auditable insights.

The attack path began with exploiting user-written automation code, leading to credential recovery and access to internal storage containing private software images. A critical publishing key within one image allowed browser-level code manipulation, enabling attackers to act as legitimate users. This could escalate into supply-chain attacks across Zapier's 8,000+ integrations. Mitigations include reviewing automation logs for unauthorized changes and reauthorizing sensitive connections. The researchers emphasized that similar chained vulnerabilities likely exist in other automation platforms, urging proactive audits.

CyberScoop · 2026-05-28 · Vulnerability: Zapier patched a flaw chain enabling account takeovers via automation manipulation and credential exposure.

The investigation reveals that Visual Studio extensions, particularly those built using the VisualStudio.Extensibility template, can execute arbitrary commands via cmd.exe, posing a significant threat to IDE integrity and system security. The attack path involves extensions parsing commands from external sources, which are then executed without user consent. This functionality, while ostensibly benign, can be exploited for malicious purposes, as demonstrated by the GitHub hack. The scope of this vulnerability extends to all Visual Studio users, particularly developers who rely on third-party extensions. Mitigation strategies include rigorous vetting of extensions, implementing sandboxing techniques, and enhancing Microsoft's marketplace security protocols to detect and remove malicious extensions proactively.

MDSec Research · 2026-05-28 · Vulnerability: Visual Studio extensions continue to pose serious security risks, enabling arbitrary command execution and compromising IDE stability.

The article highlights a paradox in cyber insurance: while it forces organizations to adopt rigorous risk assessments, it also creates a target-rich environment for ransomware actors. Attackers actively probe for insurance policies to calibrate demands, knowing insured firms are more likely to pay. This shifts the attack surface to include policy details as a reconnaissance vector. Mitigation requires layered defenses: (1) strict access controls on insurance documentation, (2) tabletop exercises simulating uninsured scenarios to reduce payout dependency, and (3) mandatory multifactor authentication for all systems handling financial transactions. The AI governance gap further complicates risk models, as unchecked AI deployments introduce unquantified liabilities that insurers now factor into premiums.

Dark Reading · 2026-05-28 · Policy: Cyber insurance drives financial risk quantification but may encourage ransomware payments by revealing coverage limits to attackers.

The attack surface expands as AI connectors gain persistent access to SharePoint, GitHub, and Slack, bypassing manual input controls. Power users compound this by operating across personal and corporate AI accounts, creating shadow data flows. Mitigation requires behavioral analytics to identify outliers, API-level monitoring for AI-to-enterprise integrations, and prompt filtering for sensitive data patterns. Legacy 'blocklist' approaches fail against embedded copilots and browser extensions, necessitating runtime content inspection. Prioritizing governance for the top decile of users could reduce 80% of exposure while allowing controlled innovation.

The Hacker News · 2026-05-28 · Vulnerability: AI risk clusters among 5% of power users who drive 12x more conversations and 9x deeper prompts than average employees.

The 2026 World Cup’s attack surface is vast, encompassing stadium networks, municipal services, and public infrastructure. Threat actors like the Handala Hack Team, linked to Iran’s MOIS, have demonstrated destructive capabilities, targeting industrial control systems and public-facing platforms. Attack paths include exploiting unpatched devices, phishing via QR codes, and leveraging public Wi-Fi for credential theft. Mitigation involves patching mobile devices, using VPNs, and verifying official apps. Incident response must address the full supplier and host-city graph, with exercises simulating realistic scenarios. Coordination across jurisdictions is essential to minimize disruptions.

Palo Alto Unit 42 · 2026-05-28 · Incidents: The 2026 FIFA World Cup faces heightened cyber risks from geopolitical adversaries and interconnected infrastructure, requiring robust mitigation and incident response strategies.

The vulnerability stems from insufficient bounds checking when processing DICOM metadata tags in Pydicom/GDCM libraries. Attackers can craft files with manipulated pixel data attributes that overflow heap buffers during Orthanc's preprocessing phase. Successful exploitation would grant control over the PACS server process, potentially compromising patient data across connected hospital systems. Mitigations include implementing strict file signature validation before parsing and sandboxing DICOM processing routines. Healthcare organizations should prioritize patching Orthanc instances and consider network segmentation for medical imaging systems.

Cisco Talos · 2026-05-28 · Vulnerability: DICOM parsing flaws in Orthanc servers enable heap overflow attacks via crafted medical images.

BTMOB RAT represents a significant escalation in mobile malware threats due to its MaaS delivery model and no-code interface, which democratizes access to sophisticated attack tools. The malware leverages Android Accessibility Services to gain elevated permissions, enabling full device control without user interaction. Its distribution via phishing sites impersonating streaming services, cryptocurrency platforms, and app stores, combined with region-specific lures, amplifies its effectiveness. The $5,000 lifetime license lowers the barrier to entry, attracting a broader range of attackers. Mitigation strategies include downloading apps only from official stores, enhancing phishing awareness, and deploying mobile security solutions. Enterprises should enforce these practices across their workforce and monitor for indicators of compromise to detect potential infections.

Dark Reading · 2026-05-28 · Incidents: BTMOB RAT spreads via MaaS, enabling low-skilled attackers to take full control of Android devices through no-code malware development.

The attack chain begins with social engineering via LinkedIn, where victims are lured into downloading a malicious file masquerading as a teleconference client. This file retrieves AUDIOFIX, a Python-based infostealer, which exfiltrates sensitive data and allows lateral movement. The threat actor also uses MiniRAT, delivered through compromised npm packages, to gain persistent access. The campaign's focus on cryptocurrency firms and developers suggests a financially motivated actor. Mitigations include verifying recruiter identities, scrutinizing unexpected meeting invites, and monitoring for unusual npm package activity. Organizations should also enforce strict access controls and regularly audit CI/CD pipelines.

The Hacker News · 2026-05-28 · Incidents: JINX-0164 targets crypto firms with fake recruiter lures and macOS malware, stealing sensitive data and enabling lateral movement.

The Nordic region's cybersecurity resilience is notable given the global surge in attack volume and sophistication, particularly with AI-driven threats reducing exploitation times to 2.4 days. This stability suggests effective defense mechanisms, likely through layered security controls and proactive threat intelligence. However, the stagnation in CISO authority and budget growth poses risks, as evolving threats demand adaptive resource allocation. Organizations should prioritize integrating security into business processes, enhancing executive communication, and reallocating budgets to address emerging vulnerabilities. The shift from protecting systems to safeguarding business processes reflects a mature, risk-based approach that other regions should emulate.

Dark Reading · 2026-05-28 · Incidents: Nordic CISOs maintain stable cyber incident rates despite global threat escalation, attributed to improved defenses and strategic security investments.

The attack chain begins with users visiting illegal streaming sites, where they are prompted to update a video player plugin. The downloaded ZIP contains a legitimate executable and a malicious DLL, leveraging DLL side-loading to inject the miner into a trusted process. Persistence is achieved through process hollowing in explorer.exe. The campaign's infrastructure includes weekly rotating C&C domains (e.g., 5d14vnfb[.]space) and a static IP (107[.]172[.]212[.]235) for configuration retrieval. Mitigations include blocking known malicious domains, monitoring for DLL side-loading anomalies, and educating users on the risks of pirated content sites.

Kaspersky Securelist · 2026-05-28 · Incidents: Cybercriminals are exploiting pirated content sites to distribute miners via fake video player updates, using DLL side-loading and rotating C&C domains.

This vulnerability underscores the critical importance of robust origin validation mechanisms in security services. The attack path begins with an attacker gaining low-privileged execution rights, leveraging the flaw in the Apex One NT Listener service to escalate privileges to SYSTEM. This grants full control over the affected system, enabling arbitrary code execution. The vulnerability's local attack vector (AV:L) limits its scope to authenticated users, but its high impact (C:H/I:H/A:H) makes it a significant threat. Mitigation requires immediate application of TrendAI's patch and rigorous monitoring of local user activities. Organizations should also enforce least privilege principles and implement endpoint detection and response (EDR) solutions to detect and block privilege escalation attempts.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent contains a local privilege escalation flaw due to insufficient origin validation in the Apex One NT Listener service.

The vulnerability in TrendAI Vision One Security Agent stems from inadequate validation of command origins within the Apex One NT Listener service. Attackers with local access can exploit this flaw to escalate privileges to SYSTEM level, enabling arbitrary code execution. This poses a significant risk to organizations relying on Vision One for endpoint security, as compromised systems could lead to full control over affected devices. The attack path requires initial low-privileged access, making it a secondary exploitation vector. Mitigation involves applying the latest patch from TrendAI, isolating affected systems, and monitoring for suspicious activity. Organizations should also enforce least privilege principles and conduct regular vulnerability assessments to minimize exposure.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent contains a local privilege escalation flaw due to insufficient origin validation in the Apex One NT Listener service.

The vulnerability stems from inadequate validation of command origins in the Apex One NT Listener service, enabling local attackers to escalate privileges to SYSTEM. This attack path requires initial low-privileged code execution, making it a post-exploitation technique. Affected installations of TrendAI Vision One Security Agent are at risk, particularly in environments where attackers gain initial footholds. Mitigation involves applying the vendor-provided patch immediately. Organizations should also enforce strict access controls and monitor for unusual privilege escalation attempts. The high impact (C:H/I:H/A:H) underscores the urgency of remediation, as successful exploitation could lead to complete system compromise.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent has a local privilege escalation flaw (CVE-2026-34929) due to improper origin validation in the Apex One NT Listener service.

The vulnerability in TrendAI Vision One Security Agent stems from inadequate validation of command origins within the Apex One NT Listener service. Attackers with local access can exploit this flaw to escalate privileges to SYSTEM, enabling arbitrary code execution. This poses a significant risk to organizations using the affected product, as attackers could gain full control over compromised systems. The attack path begins with the execution of low-privileged code, followed by exploiting the validation error to escalate privileges. Mitigation involves applying the latest patch provided by TrendAI. Organizations should also enforce strict access controls and monitor for unusual activity on systems running Vision One. This vulnerability underscores the importance of robust input validation mechanisms in security software.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent contains a local privilege escalation flaw due to insufficient origin validation in the Apex One NT Listener service.

The vulnerability stems from inadequate validation of command origins in the Apex One NT Listener service, enabling local attackers to escalate privileges to SYSTEM. This attack path requires initial low-privileged code execution, making it a post-exploitation risk. Affected installations of TrendAI Vision One Security Agent are at high risk if unpatched. Mitigation involves applying the vendor-provided update immediately. Organizations should also enforce strict access controls to limit local code execution opportunities, reducing the attack surface. The flaw's impact is confined to local systems, but SYSTEM-level access can lead to full compromise.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent has a local privilege escalation flaw (CVE-2026-45206) due to improper origin validation in the Apex One NT Listener service.

The vulnerability in TrendAI Vision One Security Agent stems from inadequate validation of command origins within the Apex One NT Listener service, enabling local attackers to escalate privileges to SYSTEM. This flaw is particularly concerning as it allows attackers with initial low-privileged access to execute arbitrary code at the highest privilege level. The attack path involves leveraging this validation gap to bypass security controls, posing significant risks to organizations relying on Vision One for endpoint protection. Immediate application of the provided patch is crucial to prevent exploitation. Additionally, organizations should enforce strict access controls and monitor for unusual activity to detect potential misuse.

ZDI (Zero Day Initiative) · 2026-05-28 · Vulnerability: TrendAI Vision One Security Agent contains a local privilege escalation flaw due to insufficient origin validation in the Apex One NT Listener service.

The contest serves as a lighthearted yet insightful reflection on the evolution of cybersecurity over two decades, highlighting how perceptions, challenges, and solutions have transformed. While not a technical analysis, it underscores the importance of community engagement and creative thinking in the field. The contest format encourages professionals to contextualize historical and current cybersecurity trends, fostering a deeper understanding of the field's progression. Participation can also serve as a team-building or educational exercise within organizations.

Dark Reading · 2026-06-26 · Events: Dark Reading's 20th anniversary 'Name That Toon' contest invites creative cybersecurity captions for a cartoon depicting the evolution of the field from 2006 to 2026.