The threat landscape isn’t taking a break. |
Today’s stories include government secrets spilled onto GitHub, robots getting on a no fly list, and 2M healthcare records compromised.
Help shape our latest TechRepublic research by taking this quick survey. Read past newsletters here. | |
|
|
Here’s what you need to know: |
|
|
|
CISA Contractor Exposes AWS Credentials |
A public GitHub repository tied to a CISA contractor reportedly exposed sensitive AWS GovCloud credentials, plaintext passwords, SSH keys, and internal deployment files linked to CISA and DHS operations.
Researchers said the repository resembled a personal sync workspace rather than a secure enterprise environment, while some exposed credentials remained active for 48 hours. |
CISA has rotated the exposed credentials and the repo has been removed. Strengthen repository security with secret scanning, short-lived credentials, centralized secrets management, and tighter CI/CD controls. |
Ransomware Gang Claims 2M Patient Records |
A DragonForce ransomware attack targeting Tennessee-based AdvancedHEALTH allegedly exposed 390 GB of data, including 2.3 million lines of patient records tied to minors. Researchers said the threat actors threatened to leak patient data daily unless ransom demands were met. Do you think they should pay the ransom demands? Healthcare organizations should segment clinical systems, monitor third-party access, maintain offline backups, and regularly test ransomware playbooks. |
Southwest Bans Robots From Flights |
Southwest Airlines banned humanoid robots from passenger cabins and checked luggage after viral flight incidents raised operational and safety concerns for crews and passengers.
The incidents also highlight how AI-powered robotics are outpacing existing safety policies, compliance standards, and operational procedures in public and commercial environments. What security risks do you think robots could introduce during flights? Could they be a pivot to communication systems?
Organizations using robotics or AI-powered devices should review battery safety, transportation policies, and operational controls before deploying them in public or regulated environments. |
|
|
|
Would you trust a humanoid robot sitting next to you on a flight? |
|
|
|
Yesterday's Pulse Check Results |
Patch Tuesday Reality Check: How fast do you actually patch? |
|
|
|
Security Tools You Can Use |
-
Explore how Cisco is redefining cybersecurity with solutions designed to protect your entire digital ecosystem. Discover solutions
-
Help shape our latest TechRepublic research by taking this quick survey.
-
Simplify compliance — get ready-to-use security policies to help protect your business without the cost or complexity of an enterprise, all for under $100.
|
|
|
|
Device Code Phishing Targets Microsoft 365 |
Threat actors are using device code phishing attacks to compromise Microsoft 365 accounts by abusing legitimate Microsoft OAuth authentication workflows.
Proofpoint researchers said attackers are using phishing kit platforms like EvilTokens and Tycoon 2FA to automate token theft campaigns using QR codes, malicious PDFs, and Microsoft login flows. |
The campaigns remain active in the wild.
Organizations should restrict device code authentication, monitor OAuth activity for suspicious token use, shorten token lifetimes, and train users to recognize Quishing attempts. |
Restricted Nvidia Chips Flow Into China |
U.S. investigators say restricted Nvidia AI chips are still reaching China and Russia through shell companies and third-country routing schemes despite aggressive export crackdowns.
Court filings and BIS enforcement actions allege brokers used encrypted apps, shell companies, and third-country routes to bypass AI chip export restrictions. The cases highlight growing national security concerns and the difficulty of stopping advanced GPUs from reaching China and Russia through global supply chains.
Organizations should strengthen third-party due diligence, monitor for diversion risks, and continuously validate export-control compliance across supply chains. |
|
|
|
Fast API generation without validation leads to technical debt.
In this DZone session with SmartBear on May 21, 2026 at 11:00 AM ET, discover how to enforce testing, consistency, and governance across AI-generated APIs. Save your seat to move from speed to production-ready quality. |
|
|
|
Humanoid Robot Security Risks |
As humanoid robots become more common in healthcare, manufacturing, and other public spaces, they are creating new OT and enterprise IT security risks. Their AI, cloud, sensor, and mobility features can create risks tied to cyberattacks, physical safety incidents, operational disruption, and data exposure. |
How to secure humanoid robots: |
-
Segment humanoid robots from IT and OT systems while restricting vendor and remote access using MFA, VPNs, and least-privilege controls.
- Continuously monitor robot telemetry, API activity, and system commands, while disabling unnecessary cameras, microphones, wireless protocols, and cloud services.
- Require signed firmware and validated software updates, and regularly test OT incident response plans involving robotic failures, hijacking scenarios, and safety disruptions.
|
As humanoid robots become more integrated into physical operations, organizations should treat them like critical OT assets with real cybersecurity and physical safety risks. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
