Cybersecurity briefing, 2026-05-06

A maxed-out severity flaw in the Flowise AI workflow builder is being actively exploited right now, and over twelve thousand exposed instances are sitting on the public internet.

• DAEMON Tools build pipeline became the attack vector
• Weaver E-cology flaw turned servers into command shells
• ScarCruft moves BirdCall from Windows to Android
• Cisco broadens patch scope across voice, switches, IoT
• Senior staff normalize credential selling, deepening insider risk
• Karakurt used state ties to raise ransom pressure
• Polished phishing bypasses trust controls at scale
• Developer credentials turn Linux malware into supply-chain access
• Apache patch hides module-specific exposure across hosts
• ADB on 5555 turns consumer devices into DDoS fleet
• NuGet typosquats turn trusted builds into stealer delivery
• vm2’s sandbox breakouts multiply beyond one fix
• Oracle moves critical fixes to monthly cadence
• China-nexus APT reuses malware across government targets
• Cisco ISE needs release-by-release patch verification
• Google pays more for harder device exploits
• Ollama security issue includes CVE-2026-7482
• Phishing turns RMM tools into redundant backdoors
• macOS help content now delivers stealers via Terminal

Recent editions

• Tuesday, May 5, 2026: MOVEit Automation auth bypass forces full-installer upgrades · 19 stories
• Monday, May 4, 2026: ShadowPad espionage campaign targets Exchange and IIS servers · 11 stories
• Sunday, May 3, 2026: Exchange N-day abuse expands espionage reach across governments · 4 stories
• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories
• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories
• Wednesday, April 29, 2026: Supply-chain victims become VECT’s ransomware pool · 12 stories