Afternoon Review in IT Security — May 27, 2026

The cybersecurity landscape continues to evolve with threats ranging from physical data theft operations to sophisticated supply-chain vulnerabilities and emerging AI-based attack vectors. Today's briefing covers critical warnings from federal agencies, newly disclosed flaws in widely-used platforms, and novel techniques leveraging artificial intelligence for malware distribution.

FBI Warns of In-Person Data Theft Attacks from Extortion Gang

The Federal Bureau of Investigation has issued a warning regarding the Silent Ransom Group (SRG), an extortion gang actively targeting U.S.-based law firms through in-person data theft attacks. This represents a notable shift in extortion tactics, moving beyond purely digital intrusions to physical theft operations. The threat actors associated with this campaign are known to operate under multiple identities including Chatty Spider, Luna Moth, and UNC3753. Source: FBI warns of in-person data theft attacks from extortion gang

Gitea Vulnerability Exposes Private Container Images without Authentication

Cybersecurity researchers have disclosed a critical security vulnerability in Gitea, an open-source self-hosted version control platform, that permits unauthenticated remote attackers to pull private container images without requiring credentials. Tracked as CVE-2026-27771, this flaw affects all versions of Gitea prior to 1.26.2 and poses significant risks to organizations relying on the platform for sensitive code repositories and container management. The vulnerability eliminates authentication requirements entirely, allowing unauthorized access to proprietary container images. Source: Gitea Vulnerability Exposes Private Container Images without Authentication

CISA Issues Four-Day Patch Deadline for Actively Exploited cPanel Plugin Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that federal agencies patch a critical vulnerability in the LiteSpeed cPanel user-end plugin within four days due to active exploitation in the wild. Identified as CVE-2026-48172, this zero-day flaw presents an immediate threat to federal infrastructure and other organizations operating affected cPanel deployments. The urgency of this directive underscores the severity and active weaponization of this particular vulnerability. Source: CISA gives feds 4 days to patch actively exploited cPanel plugin flaw

AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites

Microsoft has identified an active cryptojacking campaign that exploits artificial intelligence chatbot interactions to deliver malicious software recommendations. This emerging technique leverages AI systems to surface malicious download sites, extending social engineering tactics beyond conventional search results and significantly increasing the visibility of cryptojacking malware. The campaign distributes malware including autorun.dll, SimpleRunPE.exe, and vcredist_x64.dll, with infrastructure linked to the domain gleeze.com and IP address 193.42.11.108. Source: AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites

Today's threat landscape demonstrates the convergence of physical and digital attack vectors, the persistence of supply-chain vulnerabilities in critical infrastructure tools, and the emerging exploitation of AI systems as attack delivery mechanisms. Organizations must prioritize patching known vulnerabilities, implementing strict authentication controls, and exercising caution when interacting with AI-powered services.