Cybersecurity briefing — 2026-05-05

Palo Alto is racing to patch a firewall flaw that attackers are already using to take over devices with internet-exposed login portals.

• Weaver E-cology flaw turned servers into command shells
• MOVEit Automation Auth Bypass Forces Full-Installer Upgrades
• ShadowPad Espionage Campaign Targets Exchange and IIS Servers
• Apache Protocol Parsers Expose Servers to RCE and DoS
• Polished Phishing Bypasses Trust Controls at Scale
• China-Nexus APT Reuses Malware Across Government Targets
• Canvas Breach Exposes IDs and Private Messages
• Karakurt Negotiator Sentenced After Extortion Campaign
• French Citizen Data Sale Creates Long-Term Fraud Pool
• Phishing Turns RMM Tools Into Redundant Backdoors
• macOS Users Become the Weak Link in Fake Updates
• Certificate Trust Breaks When DigiCert Is Breached
• PackageKit Auth Bypass Turns Local Users Root
• Cargo Theft Moves Into Broker Email and Load Boards
• Google Pays More for Harder Device Exploits
• Tax Phishing Delivers Swappable Malware in India and Russia
• ScarCruft Turns a Gaming Site Into Cross-Platform Spyware
• Desktop Phone Link Becomes an OTP Theft Bridge
• AI Workflow Builder Flaw Enables Full Server Takeover