SHORT INFO

One client can knock major web servers offline. HTTP/2 Bomb, disclosed June 3, pins 32 GB of server memory in about 20 seconds against Apache and Envoy. NGINX and Apache have patches; Microsoft $MSFT IIS, Envoy, and Cloudflare $NET Pingora had none at disclosure.

University of Utah researchers confirmed nine earthquakes beneath northern Utah and southwestern Wyoming that began far below the crust, in mantle rock long thought too hot to break. A 1979 quake started about 90 kilometers down; the newest, in September 2025, was about 68 kilometers deep.

An oral drug doubled median survival in previously treated metastatic pancreatic cancer. In the Phase 3 RASolute 302 trial, daraxonrasib reached 13.2 months median overall survival versus 6.7 with chemotherapy, cutting risk of death 60 percent. Presented at ASCO 2026, published in NEJM.

Federal agencies have until June 3 to patch two Windows Defender vulnerabilities being exploited in real attacks. The flaws came from an anonymous researcher who has leaked six Windows zero-days since early April. Microsoft got the researcher banned from GitHub and GitLab.

Five-year update of the KEYNOTE-942 trial shows intismeran plus Keytruda kept nearly seventy percent of patients cancer free, versus forty nine percent on Keytruda alone. Results published in the Journal of Clinical Oncology.

Iran shot down a U.S. MQ-1 Predator drone over the Persian Gulf on Sunday. The U.S. responded with strikes on Iranian radar and drone command sites near the Strait of Hormuz. Iran retaliated; Kuwait says it intercepted incoming drones and missiles early Monday.

Carnival Corp $CCL confirms a cyberattack exposed personal data of nearly 6 million customers. ShinyHunters used social engineering on April 14 to access an employee account. Stolen data: names, addresses, DOBs, phones, driver's licenses, passport numbers. Notifications began May 27.

Israel just seized the Crusader-era Beaufort Castle in southern Lebanon, the deepest incursion in over a quarter century. Prime Minister Netanyahu ordered troops past the ceasefire line, and France has called for an emergency UN Security Council meeting.

U.S. Central Command says a Navy aircraft fired a Hellfire missile into the engine room of the Gambia-flagged M/V Lian Star in the Gulf of Oman on May 29 after the ship ignored more than twenty warnings. The vessel was trying to reach an Iranian port and is now adrift.

If you have Spectrum internet from Charter Communications , your contact data may be in a new ShinyHunters breach. The U.S. telecom giant confirmed 4.9 million accounts were exposed via a vishing attack that began in April.

Overnight on May 29-30, 2026 Ukraine's Unmanned Systems Forces destroyed two Tupolev Tu-142 long-range maritime patrol aircraft, including a rare Tu-142MR strategic radio-relay variant, and an Iskander missile launcher near Taganrog. Ukraine says it struck 23 Russian military targets in a co...

The WHO has declared a global public health emergency over an Ebola outbreak caused by the Bundibugyo strain in the Democratic Republic of the Congo and Uganda. Unlike the more common Zaire strain, there are no approved vaccines or treatments for Bundibugyo.

Boeing $BA has completed the preliminary design review of the Load Adaptable Modular (LAM) pylon for the B-1B Lancer. The pylon uses six external hard points originally built for the AGM-86 nuclear cruise missile, opening the bomber to large hypersonic weapons like the ARRW.

A Russian Geran-2 drone struck a 10-story apartment building in Galati, Romania overnight, injuring a mother and her teenage son. Seventy residents were evacuated. President Nicusor Dan called it the worst incident on Romanian territory since Russia invaded Ukraine.

A University of Rochester team built a solar panel that turns seawater into drinking water without dumping brine. The black metal is laser-etched - sunlight does the rest. Published this week in Light: Science and Applications.

Google's Threat Intelligence Group disclosed the first known AI-built zero-day exploit caught in the wild. A cybercrime group used a language model to write a Python script that bypassed two-factor authentication in a popular open-source server administration tool.

Microsoft has confirmed attackers are actively exploiting CVE-2026-42897, a XSS flaw in on-premises Exchange Server's Outlook Web Access. A crafted email can run arbitrary JavaScript when opened in OWA. No permanent patch; CISA added the bug to KEV with a May 29 deadline for federal agencies.

Russia's Su-34 fighter bombers had their home base hit today. Ukraine struck four Russian targets at once: Baltimor air base, the 325th Aviation Repair Plant in Taganrog, the Black Sea Fleet aviation HQ in Sevastopol, and the Tuapse oil terminal. Storm Shadow cruise missiles were used at Sev...

Anyone running a Palo Alto firewall with the User-ID portal exposed online should patch right now. CVE-2026-0300 lets attackers gain root with no login. A state-linked group is already exploiting it.

A new study finds a liver protein called HELZ2 acts as a master switch for cholesterol release. Researchers at UT Southwestern Medical Center say boosting it could lead to a treatment that works upstream of every existing statin.

The REBOOT trial enrolled 8,505 patients across 109 hospitals in Spain and Italy and found beta blockers did not reduce death, repeat heart attack, or heart failure hospitalization in patients with preserved heart function. A European Heart Journal substudy showed women on beta blockers...

Server admins running NGINX should patch now. CVE-2026-42945 (NGINX Rift) is an 18-year-old heap buffer overflow in the rewrite module. Unauthenticated RCE possible where ASLR is weak. F5 patched May 13 (K000161019). Active exploitation in the wild.

Scientists at the Charles Darwin Foundation have named a new species of tiny blue octopus, Microeledone galapagensis, found nearly 1,800 meters beneath the Galapagos near Darwin Island. First filmed in 2015 by the Nautilus, described this week in Zootaxa.

Two MV-22B Ospreys from Marine squadron VMM-263, deployed aboard the USS Iwo Jima in the Caribbean, landed inside the recently reopened US Embassy compound in Caracas on Saturday. US Southern Command chief Marine General Francis Donovan also met with senior Venezuelan officials that same day...

Drupal released a highly critical patch on May 20 for an unauthenticated SQL injection in its core database abstraction API affecting PostgreSQL backends. Imperva reports over 15,000 attack attempts on nearly 6,000 sites across 65 countries within 48 hours, with nearly half targeting gaming and

Anyone using Wegovy for weight loss carries roughly five times the risk of ischemic optic neuropathy compared with Ozempic users, per a new BMJ Ophthalmology analysis. Wegovy had the strongest signal among semaglutide drugs; men had about 3x the risk women did. Both drugs: Novo Nordisk $NVO.

Scientists just identified Tylosaurus rex, a new mosasaur species, from 80-million-year-old Texas fossils. The 43-foot ocean predator had finely serrated teeth rarely seen in its family. The holotype fossil sat in museum drawers near Dallas since 1979 before being recognised.

Northwestern Medicine researchers reported in Nature Cancer that the generic asthma pill montelukast blocks a tumor escape pathway called CysLTR1, restoring sensitivity to anti-PD-1 immunotherapy in preclinical models. Triple-negative breast cancer and other hard-to-treat tumors regained imm...

If you take a vitamin D2 supplement, you may be quietly lowering your own vitamin D3. A new meta-analysis in Nutrition Reviews pooled 11 RCTs covering 655 adults and found D2 cuts blood D3 by about 18 nmol per liter, sometimes below the level seen in people taking nothing at all.

Indiana University researchers identified a brain enzyme called IDOL whose removal sharply cuts amyloid plaques and lowers APOE, whose APOE4 variant is the strongest genetic risk for late-onset Alzheimer's. Unlike lecanemab, this approach boosts brain resilience too.

Anyone running Cisco Secure Workload on-premise should patch immediately. Cisco $CSCO disclosed CVE-2026-20223 on May 21, rated CVSS 10. An unauthenticated REST API call grants Site Admin across tenants. No workarounds. Fixed in 3.10.8.3 and 4.0.3.17.

Astronomers using NASA's James Webb Space Telescope detected methane on TOI-199b, a Saturn-sized planet 330 light-years away with a surface temperature near 175 degrees Fahrenheit. It is the first temperate gas giant whose atmosphere has been measured in detail.

A magnitude 4.4 earthquake hit the Campi Flegrei caldera west of Naples before dawn on May 21 2026, starting a 12-quake swarm in the Gulf of Pozzuoli. Italy's INGV measured the shock at 3 km depth, the strongest event in the current 2026 sequence. Schools shut across Bacoli, Pozzuoli, Q...

Microsoft pushed emergency patches on May 21 for two actively exploited Defender zero-days. RedSun escalates to SYSTEM via symbolic-link tricks. UnDefend silently disables signature updates. CISA added both to the Known Exploited Vulnerabilities list.

JWST observations of planet L 98-59 d, a super-Earth 35 light-years away, broke every existing classification according to an Oxford-led team in Nature Astronomy. Surface is a permanent magma ocean, atmosphere thick with hydrogen sulfide. Researchers call it a brand new sulfur-rich planet ...

Geochemists at the Universities of Toronto and Ottawa measured natural hydrogen flowing on its own from billion-year-old Canadian Shield rocks at a mine near Timmins, Ontario. A single borehole releases roughly eight kilograms per year, and across 15,000 boreholes the site discharges 14...

Microsoft assigned CVE-2026-45585 on May 19 to a publicly disclosed BitLocker bypass called YellowKey. An attacker with physical access can boot a Windows 11 or Server 2025 device into the recovery environment, hold CTRL, and drop into an unrestricted shell that reads the encrypted drive. ...

Researchers at IBEC Barcelona and West China Hospital in Chengdu reversed Alzheimer's pathology in mice with three injections of supramolecular nanoparticles. Brain amyloid beta dropped fifty to sixty percent within an hour. Human trials remain years away.

New research in GSA Bulletin shows hidden faults running directly beneath Seattle rupture roughly every 350 years, far more often than the main Seattle Fault Zone. Magnetic surveys and lidar exposed scarps buried under forest. Four million people live above this network.

NASA's 2028 return to the Moon hinges on SpaceX's Starship Version 3, set to debut Thursday evening from Starbase, Texas. V3 is the most powerful Starship ever built and can lift over 100 metric tons to orbit, three times the previous version.

A bacterium from kimchi grabs nanoplastics in the gut and helps carry them out, per a World Institute of Kimchi study. Lab tests showed 87 percent binding efficiency; mice fed the probiotic excreted twice as many particles. Human trials are still ahead.

A newly discovered, basketball-court-sized asteroid skims past Earth tonight at just 90,000 km, inside the orbit of a few distant satellites. Arizona's Mount Lemmon Survey spotted 2026 JH2 only on May 10, eight days before its closest pass at 21:23 UTC. Up to 115 ft wide, zero impact risk.

Microsoft's May Patch Tuesday fixed two wormable Windows flaws an unauthenticated attacker can ride straight through enterprise networks. The Netlogon bug (CVE-2026-41089) compromises domain controllers without any user interaction. A DNS Client bug is rated equally critical.

What Europe's EV transition just learned about its supply chain. Germany, the EU and China after Brussels' rejection of the Merz trade deal.

Mayo Clinic researchers screened a hundred trillion DNA sequences to find aptamers that lock onto senescent zombie cells in mice, the cells driving inflammation, cancer, and dementia. Past senolytic drug trials kept failing for lack of a reliable target. Human studies are next.

A maximum-severity Cisco SD-WAN flaw, CVE-2026-20182, is under active attack right now. CISA ordered every US federal agency to patch by today, May 17. The threat actor UAT-8616 is targeting telecom, finance, government and healthcare networks worldwide.

Ukrainian drones struck the Rosneft refinery in Ryazan overnight, killing three and producing 'oil rain' across the city. Russia says it intercepted 355 drones, the largest Ukrainian air attack on Russia this year. The strike came a day after Russia hit a Kyiv apartment block.

Microsoft revealed MDASH, an agentic AI system that orchestrates over 100 specialized AI agents to discover and prove exploitable code. It found 16 Windows vulnerabilities patched in May 2026, including four critical remote-code execution flaws in the kernel networking stack.

NASA's Psyche spacecraft passed within 2,800 miles of Mars at 12,000 mph today, using the planet's gravity to bend its trajectory toward the metal-rich asteroid Psyche. Launched October 2023, the probe arrives at its target in August 2029. Source: NASA / JPL

An 18-year-old heap overflow in NGINX's rewrite module, named NGINX Rift (CVE-2026-42945, CVSS 9.2), lets an unauthenticated attacker crash workers or, with ASLR off, gain RCE via a single crafted HTTP request. Affects 0.6.27 to 1.30.0 and Plus R32-R36. Patch: 1.30.1 or 1.31.0.

Russia successfully test-launched the RS-28 Sarmat intercontinental ballistic missile from Plesetsk on May 12. President Putin monitored the launch and said the first regiment will enter combat duty at the Uzhur missile division by end of 2026.

SpaceX launched the classified NROL-172 mission for the NRO from Vandenberg on Monday. It's the 13th flight building a proliferated architecture of smaller spy satellites designed to cut Earth revisit times from hours to minutes.

Google's threat team disrupted a criminal group using a large language model to build a working zero-day exploit, the first confirmed case of its kind. The bug bypassed 2FA in an open source admin platform. Gemini was not the model involved.

A critical zero-day in Palo Alto Networks PAN-OS firewalls is under active exploitation. CVE-2026-0300 lets unauthenticated attackers gain root on PA-Series and VM-Series devices via the User-ID portal. CISA added it to the KEV catalog. First patches expected May 13.

Europe and China launch the joint SMILE satellite on May 19 from French Guiana. The mission carries the first X-ray camera built to image Earth's magnetic shield, plus a UV camera that watches the aurora nonstop for 45 hours to improve forecasts of solar storms.

Allen Control Systems, the maker of the Bullfrog autonomous anti-drone weapon, is reportedly in talks at a two billion dollar valuation. The four-year-old US startup uses computer vision to detect and destroy drones autonomously. It raised 30 million in Series A funding in March 2025.

A cruise ship that toured Antarctica has docked off Tenerife after three passengers died from the Andes hantavirus, the only hantavirus known to spread person to person. WHO confirms eight cases. American passengers are being repatriated to a Nebraska biocontainment unit. (WHO, CDC, ABC)

Two newly disclosed Linux kernel flaws named Dirty Frag (CVE-2026-43284 and CVE-2026-43500) can be chained into a single command that grants any user root. Microsoft confirmed active exploitation. One patch is out, the other is pending. Ubuntu, Red Hat and Fedora are affected.

OpenAI's o1 reasoning model diagnosed 76 emergency room cases in Boston with 67% accuracy in a Harvard-led Science study, outperforming two expert physicians who scored 55% and 50%. Reviewers could not reliably distinguish AI notes from doctor notes.

China publicly confirmed for the first time that AVIC engineers from the Chengdu Aircraft Design Institute gave on-site technical support to the Pakistan Air Force during the four-day war with India in May 2025. The admission aired on state broadcaster CCTV exactly one year on.

Iranian Foreign Minister Araghchi met Wang Yi in Beijing this week, his first trip to China since the war with Israel and the US began in February. Beijing pressed Tehran to halt hostilities and reopen the Strait of Hormuz days before Trump's May 14 visit to meet Xi.

Russia's Victory Day parade on May 9 will roll through Red Square with no tanks, missiles, or armored vehicles for the first time since 2008. The Kremlin gave no official reason. Ukrainian strikes deep inside Russia have intensified ahead of the parade. Sources: Moscow Times, Al Jazeera.

8 tech companies cleared for classified U.S. military AI networks: Microsoft, Amazon, Google, SpaceX, OpenAI, NVIDIA, Oracle, and Reflection. The Pentagon says this accelerates AI-first military capabilities. Anthropic was excluded over safety guardrails disputes.

8 major tech companies cleared for classified U.S. military AI networks - Microsoft, Amazon, Google, SpaceX, OpenAI, NVIDIA, Oracle, and Reflection. Anthropic excluded over safety guardrails disputes.

Russia announced a Victory Day ceasefire, then launched drone and missile strikes that killed at least 22 people across Ukraine - hours before Kyiv's own truce began. Both sides have now declared competing ceasefires while Russia threatens a massive missile strike on Kyiv if the Victory Da

The U.S. has paused 'Project Freedom,' its naval escort operation through the Strait of Hormuz, as Trump cites progress toward an Iran deal. Meanwhile, Iran struck UAE oil facilities for a second consecutive day with drones and missiles. A fragile ceasefire is holding, but one of the world

The Pentagon cleared 8 AI firms for access to its highest-classified networks - including Microsoft, Google, and OpenAI. Anthropic was blocked over weapons safety concerns.

Ukraine drone strikes hit Russia's Primorsk oil terminal on the Baltic, three shadow-fleet tankers, and a missile ship. Primorsk handles roughly 40% of Russia's Baltic oil exports. The Kremlin warned oil prices - already above $120/barrel - could rise further.

Global military spending just hit a record 2.89 trillion dollars. Europe's defense budgets jumped 14% in one year - fastest since 1953. Germany increased spending by 24%. Russia now puts 7.5% of GDP into the military.