NinjaVPN
Intel Brief · Security Intelligence for Infrastructure Professionals
Issue #004 — May 28, 2026 ninjavpn.co · Noosphere LLC
The Week in Security

CMMC Phase 1 is now in effect, and the numbers are not reassuring. Only 1% of Defense Industrial Base contractors are fully prepared for self-assessment requirements under NIST SP 800-171. Phase 1 runs through November 2026, at which point Phase 2 introduces mandatory third-party C3PAO assessments. Organizations that have not documented compliance across their VPN, encryption, and remote access controls are operating with less than six months to close those gaps — and gaps discovered during Phase 2 assessments carry contract eligibility consequences, not just remediation timelines.

ExpressVPN’s deployment of ML-KEM in its Lightway protocol this month is the most significant VPN provider PQC development since NordVPN’s NordLynx integration. Lightway is ExpressVPN’s proprietary protocol, meaning ML-KEM protection is not automatic across all connection types — users must verify their client is running Lightway and that the update has been applied. For federal contractors evaluating commercial VPN services against CNSA 2.0 requirements, ExpressVPN now joins NordVPN and Mullvad as confirmed ML-KEM implementations. The PQC scorecard is moving.

Two critical infrastructure vulnerabilities dominated this week’s patching cycle. Ubiquiti’s UniFi OS received patches for three maximum-severity unauthenticated remote code execution flaws (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) affecting Dream Machine and Cloud Key devices. These are network management appliances — compromise grants access to the management plane of everything they control. The attack surface here is not the device itself but every asset it manages.

Microsoft Exchange Server’s on-premises deployment has a new actively exploited zero-day. CVE-2026-42897 enables arbitrary JavaScript execution in Outlook Web Access via crafted email, without authentication from the target. Federal contractors running on-premises Exchange — still common in air-gapped and sensitive compartmented environments — should apply available patches and implement temporary mitigations immediately. Cloud-hosted Exchange is not affected.

The IETF ML-KEM Security Considerations draft expiration on May 21 is a process milestone worth tracking. Guidance on implementation security — side-channel resistance, key handling, hybrid construction — will inform how vendors approach FIPS 203 compliance. Organizations evaluating vendor implementations should verify that products reference this guidance in their security documentation.

Law enforcement dismantled First VPN in Operation Saffron on May 19–20, removing infrastructure that served more than 25 ransomware groups since 2014. The operational significance for federal contractors is not the takedown itself but the audit implication: organizations that have seen unexplained connection attempts from First VPN IP ranges should treat those as confirmed ransomware infrastructure contact and initiate incident review procedures.

The week’s pattern is increasing specificity in both threats and compliance requirements. CMMC Phase 1 is no longer approaching — it is here. ML-KEM deployment is no longer theoretical — it is shipping. Threat actors who relied on First VPN will re-establish elsewhere within weeks.

Editor’s Note

The CMMC Phase 1 activation and the ExpressVPN ML-KEM deployment are this week’s items that require action, not just awareness. If your organization has not started CMMC self-assessment documentation, six months is not as much time as it sounds.

Post-Quantum
ExpressVPN Deploys ML-KEM Post-Quantum Encryption in Lightway Protocol ML-KEM
Lightway is now the third confirmed commercial VPN protocol with ML-KEM in production — federal contractors must verify their client is running Lightway specifically, as other ExpressVPN protocols do not carry this protection.
expressvpn.com/blog/ml-kem-lightway-upgrade/
IETF ML-KEM Security Considerations Draft Expires May 21 — Implementation Guidance Finalizing
Side-channel resistance, key handling, and hybrid construction requirements are being locked in — organizations evaluating vendor FIPS 203 implementations should confirm products reference this guidance in their security documentation.
ietf.org/archive/id/draft-sfluhrer-cfrg-ml-kem-security-considerations-04.html
Breach & Threat
Ubiquiti UniFi OS Patches Three Maximum-Severity Unauthenticated RCE Vulnerabilities CVE-2026-34908, CVE-2026-34909, CVE-2026-34910 Max Severity
Compromise of Dream Machine or Cloud Key devices grants management-plane access to all network infrastructure they control — treat this as perimeter exposure, not a single-device patch event.
bleepingcomputer.com/news/security/ubiquiti-patches-three-max-severity-unifi-os-vulnerabilities/
Microsoft Exchange Server OWA Zero-Day CVE-2026-42897 Under Active Exploitation Zero-Day
Unauthenticated arbitrary JavaScript execution via crafted email in on-premises OWA deployments; federal contractors in air-gapped or SCIF environments running on-premises Exchange should treat this as an emergency patch, not a scheduled cycle item.
thehackernews.com/2026/05/on-prem-microsoft-exchange-server-cve.html
Federal & Compliance
CMMC Phase 1 Self-Assessment Requirements Now In Effect — Only 1% of DIB Contractors Fully Prepared
Phase 2 C3PAO assessments begin November 2026; contractors without documented NIST SP 800-171 compliance across VPN, encryption, and remote access controls now have less than six months before contract eligibility is at risk.
morganlewis.com/blogs/governmentcontractorguidebook/2026/04/cmmc-in-effect-cybersecurity-compliance-measures
Industry
Operation Saffron Dismantles First VPN Criminal Service Used by 25+ Ransomware Groups Since 2014
Organizations with unexplained connection attempts from First VPN IP ranges in their logs should treat those as confirmed ransomware infrastructure contact and initiate incident review procedures immediately.
techcrunch.com/2026/05/21/law-enforcement-shuts-down-vpn-service-used-by-two-dozen-ransomware-gangs/