[{"data":1,"prerenderedAt":198},["ShallowReactive",2],{"publication:en:D202605":3},{"meta":4,"copy":18,"relatedArticles":153,"terms":190,"term":191,"resourceParent":192,"glossaryParent":195},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202605","\u002Fblog\u002Fvulnerability-digest-2026-05","article","Website vulnerability digest for May 2026","Cybersecurity digest for May 2026","May 2026: vulnerabilities, breaches and cyber incidents","May 2026 security digest: software vulnerabilities, incidents involving Instructure \u002F Canvas and Carnival Corporation, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-04","\u002Fblog\u002Fvulnerability-digest-2026-06","2026-06-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":114,"checklist":115,"faq":118,"sources":128,"links":135,"cta":148},"May's review concentrates on web-server configuration: Apache HTTP\u002F2, two NGINX rewrite advisories and Apache Digest authentication. NGINX needed a second set of fixes later in the same month. Compare the exact installed package with every applicable advisory before closing the maintenance task. The issue also covers incidents involving Instructure \u002F Canvas and Carnival Corporation, with the reported impact and checks relevant to a business using similar services.",[21,43,52,64,73,91,100,109],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-05-01 to 2026-05-31. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for May 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-05-04","Apache HTTP Server | CVE-2026-23918","2.4.67",[38,39,40],"2026-05-13","NGINX | CVE-2026-42945 \u002F CVE-2026-9256","1.31.0 \u002F 1.30.1 \u002F 1.31.1 \u002F 1.30.2",[34,42,36],"Apache HTTP Server | CVE-2026-33006",{"title":44,"paragraphs":45,"sources":48},"Apache: HTTP\u002F2 double free in 2.4.66 (CVE-2026-23918)",[46,47],"Apache identifies a double-free weakness with possible code execution in the HTTP\u002F2 implementation of version 2.4.66. Version 2.4.67 contains the fix. The stated affected version is specific, so a version inventory matters before assigning the work.","Identify the httpd package and HTTP\u002F2 module in each hosting environment. Agree the update and reload, then test virtual hosts, certificates and application traffic.",[49],{"label":50,"url":51},"CVE-2026-23918 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-23918",{"title":53,"paragraphs":54,"sources":57},"NGINX: two rewrite fixes during May (CVE-2026-42945 \u002F CVE-2026-9256)",[55,56],"Two separate rewrite-module buffer overflows were disclosed in May. They depend on particular regular-expression captures and directive combinations. Crashes are possible; code execution requires additional conditions involving ASLR. The later advisory on 22 May requires newer fixes than the 13 May issue.","For CVE-2026-42945 the OSS thresholds are 1.31.0 \u002F 1.30.1; for CVE-2026-9256 they are 1.31.1 \u002F 1.30.2. Review both notices, including the Plus package mapping, and test redirects with application owners.",[58,61],{"label":59,"url":60},"CVE-2026-42945 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-42945",{"label":62,"url":63},"CVE-2026-9256 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-9256",{"title":65,"paragraphs":66,"sources":69},"Apache: Digest authentication bypass (CVE-2026-33006)",[67,68],"A timing attack against mod_auth_digest can bypass Digest authentication. Apache lists affected releases through 2.4.66 and recommends 2.4.67. The relevant boundary is an area protected by this Apache module, which is separate from an application's own login implementation.","Map directories and virtual hosts using mod_auth_digest. Apply the supported patched package and check that protected pages reject unauthenticated access after reload.",[70],{"label":71,"url":72},"CVE-2026-33006 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-33006",{"title":74,"paragraphs":75,"table":77},"Breaches and cyber incidents reported this month",[76],"These cases were publicly reported during May 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":78,"headers":79,"rows":83},"Incident notices: May 2026",[80,81,82],"Organization","Public notice","Incident",[84,88],[85,86,87],"Instructure \u002F Canvas","2026-05-08","Information exposure",[89,90,87],"Carnival Corporation","2026-05-27",{"title":92,"paragraphs":93,"sources":96},"Canvas: exposed user data and interrupted learning (2026-05-08)",[94,95],"In its 2026-05-08 statement, Instructure identified exposed usernames, email addresses, course and enrollment information and messages. It reported that core learning data and credentials were not compromised. Its incident timeline records initial detection on April 29 and another attack on May 7.","For a business-critical SaaS platform, agree how incident notices reach the responsible person and how work continues during an outage. Keep an inventory of integrations and administrative access that may need review when a supplier reports a breach.",[97],{"label":98,"url":99},"Instructure: incident notice","https:\u002F\u002Fwww.instructure.com\u002Fincident_update",{"title":101,"paragraphs":102,"sources":105},"Carnival: a compromised employee account and personal information (2026-05-27)",[103,104],"On 2026-05-27, Carnival announced notifications about an April incident. It said social engineering enabled access through an employee account, detected on 2026-04-14, and that certain personal information was accessed unlawfully. The attack date and public notification month were different.","Review verification procedures for employee access recovery and support requests. Restrict access to customer records by job role and prepare a way to identify affected people from logs without relying on an unverified attacker-provided record count.",[106],{"label":107,"url":108},"Carnival Corporation \u002F PR Newswire: incident notice","https:\u002F\u002Fwww.prnewswire.com\u002Fnews-releases\u002Fcarnival-corporation-notice-of-data-breach-302783524.html",{"title":110,"paragraphs":111},"Coverage and editorial record",[112,113],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[47,56,68,116,117],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[119,122,125],{"question":120,"answer":121},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":123,"answer":124},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":126,"answer":127},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[129,130,131,132,133,134],{"label":50,"url":51},{"label":59,"url":60},{"label":62,"url":63},{"label":71,"url":72},{"label":98,"url":99},{"label":107,"url":108},[136,138,140,143,146],{"path":14,"label":137},"Previous issue: April 2026",{"path":15,"label":139},"Next issue: June 2026",{"path":141,"label":142},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":144,"label":145},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":147},"All articles",{"title":149,"description":150,"button":151,"type":152},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[154,166,175,183],{"id":155,"path":14,"title":156,"description":157,"category":158,"artwork":159,"order":160,"publishedOn":161,"period":162,"related":163},"D202604","Cybersecurity digest for April 2026","April 2026 security digest: software vulnerabilities, incidents involving Vercel and Hasbro, sources and practical checks for businesses.","digest","vulnerability-digest",7,"2026-05-03","2026-04",[164,6,141,165],"\u002Fblog\u002Fvulnerability-digest-2026-03","\u002Fblog\u002Fwhy-website-updates-matter",{"id":167,"path":15,"title":168,"description":169,"category":158,"artwork":159,"order":170,"publishedOn":171,"period":172,"related":173},"D202606","Cybersecurity digest for June 2026","June 2026 security digest: software vulnerabilities, incidents involving Novo Nordisk and LastPass \u002F Klue, sources and practical checks for businesses.",5,"2026-07-03","2026-06",[6,174,141,165],"\u002Fblog\u002Fvulnerability-digest-2026-07",{"id":176,"path":141,"title":177,"description":178,"category":179,"artwork":180,"order":181,"publishedOn":182},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":184,"path":165,"title":185,"description":186,"category":187,"artwork":187,"order":188,"publishedOn":189},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":193,"label":194},"\u002Fresources","Website security resources and templates",{"path":196,"label":197},"\u002Fglossary","Cybersecurity glossary for small businesses",1794138524212]