Afternoon Review in IT Security — May 5, 2026

The cybersecurity landscape continues to face significant threats on May 5, 2026, with critical vulnerabilities being actively exploited, large-scale phishing campaigns targeting tens of thousands of users, and supply chain attacks compromising legitimate software. Additionally, regulatory developments in data protection demonstrate the evolving interpretation of privacy obligations across jurisdictions.

Weaver E-cology RCE Vulnerability Under Active Exploitation

A critical remote code execution vulnerability in Weaver E-cology, an enterprise office automation and collaboration platform, is currently being exploited in the wild. The vulnerability, identified as CVE-2026-22679 with a CVSS score of 9.8, affects Weaver E-cology 10.0 versions prior to the March 12, 2026 patch. The flaw resides in the debug API endpoint and allows unauthenticated attackers to execute arbitrary code on affected systems. Security researchers have observed active exploitation attempts leveraging the malware payload fanwei0324.msi in the wild. Source: Weaver E-cology RCE Flaw CVE-2026-22679 Actively Exploited via Debug API

Organizations running Weaver E-cology should prioritize immediate patching to versions released after March 12, 2026, to mitigate the risk of compromise. The active exploitation of this vulnerability underscores the importance of maintaining current patch levels for enterprise collaboration platforms.

Microsoft Discloses Massive Phishing Campaign Targeting 35,000 Users

Microsoft has revealed details of a large-scale credential theft campaign that targeted more than 35,000 users across over 13,000 organizations in 26 countries between April 14 and 16, 2026. The multi-stage campaign employed code of conduct-themed lures and leveraged legitimate email services to direct victims to attacker-controlled domains designed to steal authentication tokens. The attack infrastructure utilized the malware tool Tycoon 2FA to facilitate credential harvesting. Source: Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries

The campaign's broad geographic reach and targeting of numerous organizations across multiple sectors highlights the persistent threat posed by credential theft operations. Organizations should reinforce user awareness training regarding phishing tactics and implement additional authentication protections to defend against token theft attacks.

DAEMON Tools Supply Chain Attack Ongoing Since April

Kaspersky has published findings regarding an ongoing supply chain attack affecting DAEMON Tools software that has been active since April 8, 2026. The attack represents a significant supply chain compromise, with malicious code being distributed through the legitimate software distribution channel. Source: Kaspersky just published an article titled "DAEMON Tools software infected – supply chain attack..."

Users of DAEMON Tools should immediately verify the integrity of their installations and consider updating to patched versions once available. Supply chain attacks of this nature pose substantial risk due to the inherent trust users place in legitimate software vendors, making rapid detection and remediation critical.

Spanish Supreme Court Affirms Broad GDPR Processing Definition

Spain's Supreme Court has upheld a data protection authority decision against the Secretaría General de Instituciones Penitenciarias, establishing important precedent regarding the definition of personal data processing under the GDPR. The case centered on a penitentiary center's demand that an employee provide medical diagnosis information beyond a standard medical note to justify three days of sick leave. Source: TS - 1590/2026

The court clarified that the definition of processing under Article 4 of the GDPR is broad and includes the act of requesting personal data from a data subject, even if the data is not ultimately received or collected. The decision reinforces that controllers must comply with GDPR principles, including the principle of data minimisation, at the moment of requesting data rather than only upon collection. The court determined that the penitentiary center violated Article 5(1)(c) GDPR by requesting sensitive medical information without adequate legal basis, despite legitimate aims of preventing fraud and managing absences. This ruling establishes significant case law regarding the scope of GDPR obligations and the protection of sensitive health information in employment contexts.

The convergence of active cyber threats and evolving regulatory frameworks underscores the multifaceted challenges facing organizations in maintaining both security and compliance postures on May 5, 2026.