Cybersecurity briefing, 2026-05-03

Two critical zero-days are being exploited right now, one in FortiClient EMS and one in nginx-ui, and both let attackers take over enterprise systems without credentials.

• Exchange N-day abuse expands espionage reach across governments
• Black Shrantac turns perimeter flaws into quiet extortion
• PackageKit auth bypass turns local users root
• Patch wave will expose weak supply chains

Recent editions

• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories
• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories
• Wednesday, April 29, 2026: Supply-chain victims become VECT’s ransomware pool · 12 stories
• Tuesday, April 28, 2026: Trusted data tool poisoned, then its container image too · 11 stories
• Monday, April 27, 2026: Cisco firewall backdoors survive patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper turns collaboration tools into espionage channels · 9 stories