MAGNET S2 WEEKLY SNAPSHOT – 260531-2015z

Anti-ICE protests at the Delaney Hall immigration detention center in Newark, New Jersey have continued for nine consecutive days as of 31 May, generating the most significant sustained civil unrest event in the reporting period. The protests began approximately 22 May after detainees alleged inhumane conditions inside the facility — reports included worm-infested food, inadequate medical care, extended detention of individuals who had offered to voluntarily self-deport, and unsanitary bathrooms. Detainees launched a hunger and labor strike on 22 May. Letters with hundreds of signatures were smuggled out of the facility and circulated publicly.

The protest environment escalated significantly through the week. ICE agents used chemical irritants and pepper spray on protesters on May 26 and 28. On 29 May, NJ Governor Mikie Sherrill announced NJ State Police would assume perimeter security from ICE — ICE agreed to withdraw from the immediate area — and a ‘peaceful, protected protest zone’ was established. The most violent night occurred on 30 May: demonstrators tore down barricades, set tires on fire in the street, threw projectiles at officers, and smashed the windscreen of an ICE vehicle. Police on horseback were deployed to disperse crowds. Multiple individuals were arrested, some found in possession of weapons. Dueling pro-ICE and anti-ICE counter-demonstrations also occurred on 30 May.

Newark Mayor Ras Baraka declared a mandatory curfew in the early hours of 31 May — 9PM to 6AM within a half-mile radius of Delaney Hall, until further notice. On 31 May, House Minority Leader Hakeem Jeffries and NJ House members conducted an oversight visit, publicly calling for Delaney Hall’s closure and describing ‘unsanitary living conditions, lack of adequate medical care and unhealthy food.’ DHS separately announced limited family visitation would resume Sunday. Assessment: watch for protest spread to other ICE facilities in NJ and adjacent states.

The week of 24–30 May marked the closest the US and Iran have come to a signed agreement since hostilities began February 28. By approximately May 28, US and Iranian negotiators had reached tentative agreement on a 60-day MOU: the Strait of Hormuz would reopen with unrestricted shipping, Iran would clear mines within 30 days, the US would lift its port blockade of Iran and issue limited sanctions waivers, and both sides would enter nuclear negotiations during the 60-day window. Iran committed verbally to never seeking nuclear weapons and to enrichment negotiations.

Trump was briefed on the final terms but did not immediately sign off, telling mediators he wants ‘a couple of days to think about it’ (reported 29 May). VP Vance confirmed: ‘very close, not there yet.’ Iran has not formally confirmed acceptance. Contradictions persist — Tehran claimed the draft stipulates US force withdrawal and lifting of all port blockades, which Washington has pushed back on.

Military incidents continued throughout the week. US CENTCOM conducted ‘self-defense strikes’ on Iranian missile launch sites and boats on May 25 and again on May 28, shooting down four Iranian drones targeting a commercial vessel and hitting a launch unit near Hormuz. Iran retaliated by firing on a US base in Kuwait. The US Treasury simultaneously sanctioned Iran’s Persian Gulf Strait Authority for an alleged IRGC toll scheme. Assessment: MOU signing probability is the highest since the conflict began, but remains unsigned and fragile. Even if signed, mine clearance and infrastructure repair will delay supply normalization by weeks.

CISA added three supply-chain compromise vulnerabilities to the KEV catalog on May 27, marking a significant escalation in attacker targeting of legitimate software distribution channels. CVE-2026-8398 (CVSS 9.3): Official DAEMON Tools Lite installers distributed from the vendor’s website were compromised between April and May 2026 with embedded malicious code bearing valid code-signing certificates. Update to version 12.6.0.2445 or uninstall. Federal deadline: June 17.

CVE-2026-45321 (CVSS 9.5): Attackers hijacked GitHub Actions to publish 84 malicious TanStack npm package versions containing credential-stealing malware under the trusted TanStack identity. Audit package lock files and rotate credentials. Federal deadline: June 10. CVE-2026-48027 (CVSS 9.3): A malicious version of the Nx Console developer extension was briefly available on both Visual Studio Marketplace and OpenVSX. Update immediately. Federal deadline: June 17.

The supply-chain vector bypasses most perimeter and endpoint defenses by arriving through installation, update, or package management pipelines. Organizations should treat any software installed or updated during April–May 2026 with additional scrutiny and implement software composition analysis (SCA).

OCFA formally closed the life-safety phase of the GKN Aerospace MMA chemical incident in Garden Grove, CA on the evening of May 26. All evacuation orders were lifted at approximately 1930L; approximately 50,000 displaced residents were cleared to return. Garden Grove USD reopened all schools May 27. No civilian or first responder injuries were reported. MAGNET S2 published original report 260526-1200Z and delta update 260527-1306Z, both available at magnethf.com/reports.

Three parallel long-tail tracks are now active: (1) Criminal investigation — Orange County DA Todd Spitzer served GKN with formal document preservation notices, stating publicly ‘Don’t get the shredder started.’ Anonymous tip hotline 714-347-8714 active. (2) Environmental remediation — millions of gallons of cooling water runoff under testing; groundwater contamination results expected in coming days to weeks. (3) Civil litigation — multiple law firms have filed or are investigating class-action claims. Additional GKN regulatory history confirmed: $909,935 AQMD settlement (2025) for violations from a 2020 inspection; OSHA penalties (2018).