Cybersecurity briefing, 2026-05-02

A nearly 12-year-old flaw in a Linux daemon you almost certainly have running can hand any local user root without a password, and the patch is out today.

• Exchange N-day abuse expands espionage reach across governments
• SAP build packages turn install time into theft time
• French citizen data sale creates long-term fraud pool
• Patch wave will expose weak supply chains
• Patched Windows Shell systems may still be vulnerable
• Deep#Door turns Windows hosts into stealthy spyware nodes
• Cargo theft moves into broker email and load boards
• Signed adware turns update channels into AV killers
• Black Shrantac turns perimeter flaws into quiet extortion
• Millions expose remote access, hundreds reach OT panels
• COS kernel flaws let containers reach the host
• PackageKit auth bypass turns local users root
• Soft PLC backdoors survive restarts in CODESYS runtime
• Nginx UI’s MCP endpoint opens full server takeover
• SaaS extortion groups hide inside IdP access
• Sleeper packages turn CI hosts into credential farms
• Russian aviation targets lose GIS data to spyware
• Immediate remote code execution risk in Ninja Forms File Uploads

Recent editions

• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories
• Wednesday, April 29, 2026: Supply-chain victims become VECT’s ransomware pool · 12 stories
• Tuesday, April 28, 2026: Trusted data tool poisoned, then its container image too · 11 stories
• Monday, April 27, 2026: Cisco firewall backdoors survive patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper turns collaboration tools into espionage channels · 9 stories
• Saturday, April 25, 2026: Cisco firewall backdoors survive patching · 19 stories