Cybersecurity briefing, 2026-05-05

A critical Weaver E-cology flaw is being actively exploited as a remote command shell on exposed servers, and Linux just got handed a twelve-year-old privilege escalation bug that grants instant root on every major distro.

• Weaver E-cology flaw turned servers into command shells
• MOVEit Automation auth bypass forces full-installer upgrades
• ShadowPad espionage campaign targets Exchange and IIS servers
• Apache protocol parsers expose servers to RCE and DoS
• Polished phishing bypasses trust controls at scale
• China-nexus APT reuses malware across government targets
• Canvas breach exposes shared student identity data
• Karakurt negotiator sentenced after extortion campaign
• French citizen data sale creates long-term fraud pool
• Phishing turns RMM tools into redundant backdoors
• macOS users become the weak link in fake updates
• Certificate trust breaks when DigiCert is breached
• PackageKit auth bypass turns local users root
• Cargo theft moves into broker email and load boards
• Google pays more for harder device exploits
• Tax phishing delivers swappable malware in India and Russia
• ScarCruft moves BirdCall from Windows to Android
• Windows malware turns Phone Link into 2FA bypass
• AI workflow Builder flaw enables full server takeover

Recent editions

• Monday, May 4, 2026: ShadowPad espionage campaign targets Exchange and IIS servers · 11 stories
• Sunday, May 3, 2026: Exchange N-day abuse expands espionage reach across governments · 4 stories
• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories
• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories
• Wednesday, April 29, 2026: Supply-chain victims become VECT’s ransomware pool · 12 stories
• Tuesday, April 28, 2026: Trusted data tool poisoned, then its container image too · 11 stories