Week of May 18, 2026: TeamPCP breaches GitHub's internal repos, and the DBIR puts exploitation first

What mattered to security leaders in the week of May 18, 2026? GitHub confirmed on Wednesday, May 20 that the TeamPCP group had exfiltrated roughly 3,800 of its internal repositories after an employee installed a poisoned VS Code extension, and a day later the trail led back to a compromise at TanStack. The same Wednesday, Verizon's 2026 Data Breach Investigations Report found that vulnerability exploitation had overtaken stolen credentials as the most common initial access vector.

GitHub confirms TeamPCP took internal repositories via a VS Code extension

After TeamPCP claimed to have breached GitHub's private code, the company investigated and said the activity involved exfiltration of GitHub-internal repositories only, with the attacker's claim of about 3,800 repositories directionally consistent with its findings. An employee had installed a malicious version of a VS Code extension; GitHub removed it, isolated the endpoint and rotated critical secrets, highest-impact credentials first. It said it had no evidence that customer information outside those repositories was affected, while noting that could change. Developer workstations with extension marketplaces open are a privileged access path. (Help Net Security)

The GitHub and Grafana Labs breaches trace back to TanStack

GitHub CISO Alexis Wales named the extension as Nx Console, a developer tool with 2.2 million installs, whose malicious version stole secrets and credentials that were then used to move through CI/CD pipelines. Nx Console's maintainers said one of their developers had been hit by an earlier supply chain compromise at TanStack that leaked GitHub credentials through the GitHub CLI, letting the attacker run workflows on their repository and publish the bad version to both the Visual Studio Marketplace and Open VSX. Grafana Labs' breach was traced to the same chain. One leaked credential rippled across several organizations. (Help Net Security)

Verizon DBIR: exploitation overtakes stolen credentials for the first time

The 2026 Verizon Data Breach Investigations Report, covering incidents from November 2024 to October 2025, ranked vulnerability exploitation as the leading initial access vector, the first time credential theft lost the top spot in the report's 19-year history. Patching is slipping: only 26% of CISA known-exploited vulnerabilities had been fully remediated across the organizations studied, down from 38 the year before, and the median time to full patching grew to 43 days. Those two numbers are a ready-made metric for any vulnerability management program. (Help Net Security)

Two Microsoft Defender flaws are exploited in the wild

Microsoft acknowledged exploitation of CVE-2026-41091, a Malware Protection Engine link-resolution bug that can give an attacker SYSTEM privileges, and CVE-2026-45498, which can knock Microsoft Defender into a denial-of-service state; CISA added both to the KEV catalog. Fixes are in engine version 1.1.26040.8 and antimalware platform version 4.18.26040.7, which normally arrive automatically. Security teams should confirm those versions across the fleet, since a disabled Defender is exactly what an intruder wants. (Help Net Security)

West Pharmaceutical says it is fully operational after data theft and encryption

In an amended 8-K filed May 20, West Pharmaceutical Services updated its Item 1.05 disclosure of an attack first detected on May 4, in which data was exfiltrated and systems were encrypted. Core enterprise systems had been restored and manufacturing, receiving and shipping had restarted at all sites, and no unauthorized activity had been seen since May 5. The company said it did not expect a material impact on its 2026 second-quarter or full-year guidance, while its review of the affected data continued. (SEC EDGAR)

The Oncology Institute learns a vendor breach reached patient data

The Oncology Institute filed an 8-K under Item 1.05 on May 22, following up a November 2025 voluntary disclosure about an incident at a software vendor. On May 20 Kroll, the vendor's third-party administrator, told the company that the vendor had detected unauthorized access to company information systems, including systems holding patient data. The company believes other healthcare providers were also affected and plans to offer credit monitoring to impacted patients. Six months between a vendor's first notice and confirmation of patient data exposure is a long gap for any third-party risk program. (SEC EDGAR)

Operation Saffron dismantles the First VPN service used by criminals

French and Dutch authorities, supported by Europol and Eurojust, took the First VPN service offline on May 19 and 20, dismantling 33 servers, seizing its domains and interviewing the operator in Ukraine. Investigators said the service, marketed to cybercriminals with promises of anonymity and ransomware actors among its users, had run since 2014 with more than 5,000 accounts, and Dutch police said they had visibility into user traffic before the shutdown. Intelligence from takedowns like this often feeds later victim notifications. (Help Net Security)