MSP cybersecurity news digest, May 20, 2025

This briefing covers May Patch Tuesday fixes including five actively exploited Microsoft zero-days added to CISA’s KEV, ENISA’s launch of the EU Vulnerability Database, a Google Chrome high-severity flaw with a public exploit, chained Ivanti zero-days, the Noodlophile Python-based stealer spread via fake AI tools on Facebook, a Horabot phishing campaign targeting six Latin American countries, and separate data-security incidents at Nucor and Dior; the report highlights active exploitation, recommended patching/mitigations, and the broad operational impact across enterprise and consumer environments.