Looking ahead — 2026-W20

Items already in motion at the close of 2026-W20. Not predictions — each links to the in-motion reporting underneath.

• Microsoft Exchange CVE-2026-42897 — Microsoft permanent patch and out-of-band advisory on DEVCORE Pwn2Own three-bug chain pending. Active OWA-XSS exploitation continues; the federal-civilian KEV deadline is 2026-05-29 (US-FCEB compliance date, not operational signal for CH/EU); the operationally critical milestone is Microsoft shipping a permanent patch and clarifying whether the DEVCORE chain is being weaponised against the same OWA initial-access vector. (Microsoft Security Blog; daily 2026-05-16)
• PAN-OS CVE-2026-0300 wave-2 patches landing 2026-05-28. Eight build streams (12.1.7, 11.2.4-h17, 11.2.12, 11.1.7-h6, 11.1.15, 10.2.7-h34, 10.2.13-h21, 10.2.16-h7) finish the staged patch arc; verify deployment readiness in advance and audit for svc-health-check-NNNNNN rogue-admin accounts before patching wipes implant artefacts. (Palo Alto PSIRT CVE-2026-0300; daily 2026-05-14 UPDATE)
• US House Homeland Security Committee CEO briefing deadline 2026-05-21 (Canvas / Instructure). Chairman Garbarino's letter requested an Instructure CEO briefing by 2026-05-21 addressing both intrusion circumstances, scope and nature of accessed data, IR adequacy, and CISA coordination. Outcome will inform the regulatory template for cantonal-Bildungsdirektion oversight of EdTech-SaaS vendors. (House Homeland Security Committee; daily 2026-05-13 UPDATE)
• Verizon DBIR 2026 full PDF release — webinar 2026-05-19 11:00 ET. The page-level summary already in this weekly's § 6 will gain the full statistical breakdown after the webinar; the supply-chain doubling finding (15% → 30%) deserves a re-read against the full data to confirm methodology. (Verizon DBIR page)
• TeamPCP / Mini Shai-Hulud wave 5 risk on PyPI / Cargo / Maven Central. The leaked framework source elevates the risk of secondary operators applying the same techniques against other registries. Detection-engineering teams should pre-stage hunts for IDE-hook entries (.claude/settings.json, .vscode/tasks.json) and Sigstore-provenance anomaly detection. (Datadog Security Labs)
• CRA milestone 11 June 2026 — CAB notification provisions become applicable. Member-state notifying-authority designations must be in place by then. Swiss product manufacturers selling into EU markets should track which CABs are designated in their target member states. (EC CRA implementation factpage)
• KRITIS-DachG German registration deadline 2026-07-17 (61 days). German public-administration operators of critical facilities must register with BBK / BSI; failures up to EUR 500,000 fine. Cross-border CH-DE operators should verify subsidiary obligations. (Luther Lawfirm)
• Dirty Frag CVE-2026-43500 (RxRPC) — remaining distro patch propagation. AlmaLinux 8 not affected; RHEL 9 errata rolling; lagging configurations are systems with kernel-modules-partner installed (AFS-using estates). Track distro-vendor security-advisory updates through 2026-W21. (AlmaLinux blog)
• "The Gentlemen" RaaS — comms overhaul means continued activity expected; affiliate response to decryptor publication. Administrator zeta88's announced communications-infrastructure overhaul rather than shutdown means operations continue; affiliate response to Bedrock Safeguard's decryptor and any binary-side patches the operator deploys are the open watch items. (Check Point Research)
• MOVEit Automation CVE-2026-4670 — still no ITW confirmed at week-end. Patches available 2025.1.5 / 2025.0.9 / 2024.1.8; 1,400+ internet-exposed instances catalogued. The W19 horizon item remains open; watch for KEV addition or first-victim disclosure. (Help Net Security; daily 2026-05-06)
• GTIG UNC6671 "BlackFile" DLS-shutdown signal — probable rebrand. GTIG's documentation of the DLS shutdown points to a probable operator rebrand; watch for a new leak-site / new operator-handle reusing the vishing → AiTM → rogue-MFA → programmatic SharePoint exfiltration TTP set. (daily 2026-05-16)
• Windows BitLocker YellowKey and CTFMON GreenPlasma — Microsoft permanent patch and / or out-of-band advisory pending. Public PoC continues; the May 2026 Patch Tuesday did not address either; out-of-band release is the operationally expected path. Until a patch lands the BitLocker-PIN GPO enforcement and privileged-account-segregation discipline remain the only available controls. (daily 2026-05-15)
• SEPPmail CVE-2026-44128 — independent third-party PoC or root-cause write-up. Two national CERTs (NCSC-CH + CIRCL) now corroborate; the open item is whether a research-lab write-up surfaces that would lift the verification status from SINGLE-SOURCE-NATIONAL-CERT to MULTI-SOURCE. (CIRCL vulnerability.circl.lu)