Cybersecurity briefing, 2026-05-02

A nearly 12-year-old flaw in a Linux daemon you almost certainly have running can hand any local user root without a password, and the patch is out today.

• Exchange N-day Abuse Expands Espionage Reach Across Governments
• SAP Build Packages Turn Install Time Into Theft Time
• French Citizen Data Sale Creates Long-Term Fraud Pool
• Patch Wave Will Expose Weak Supply Chains
• Patched Windows Shell Systems May Still Be Vulnerable
• Deep#Door Turns Windows Hosts Into Stealthy Spyware Nodes
• Cargo Theft Moves Into Broker Email and Load Boards
• Signed Adware Turns Update Channels Into AV Killers
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Millions Expose Remote Access, Hundreds Reach OT Panels
• COS Kernel Flaws Let Containers Reach the Host
• PackageKit Auth Bypass Turns Local Users Root
• Soft PLC Backdoors Survive Restarts in CODESYS Runtime
• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• SaaS Extortion Groups Hide Inside IdP Access
• Sleeper Packages Turn CI Hosts Into Credential Farms
• Russian Aviation Targets Lose GIS Data to Spyware
• Immediate Remote Code Execution Risk in Ninja Forms File Uploads

Recent editions

• Friday, May 1, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi Exposes Keys Behind AI Gateways · 7 stories
• Wednesday, April 29, 2026: LiteLLM SQLi Exposes Keys Behind AI Gateways · 12 stories
• Tuesday, April 28, 2026: Trusted Data Tool Poisoned, Then Its Container Image Too · 11 stories
• Monday, April 27, 2026: Cisco Firewall Backdoors Survive Patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper Turns Collaboration Tools Into Espionage Channels · 9 stories
• Saturday, April 25, 2026: Cisco Firewall Backdoors Survive Patching · 19 stories