Cybersecurity briefing — 2026-05-06

A maxed-out severity flaw in the Flowise AI workflow builder is being actively exploited right now, and over twelve thousand exposed instances are sitting on the public internet.

• DAEMON Tools Build Pipeline Became the Attack Vector
• Weaver E-cology flaw turned servers into command shells
• ScarCruft Moves BirdCall From Windows to Android
• Cisco Broadens Patch Scope Across Voice, Switches, IoT
• Senior Staff Normalize Credential Selling, Deepening Insider Risk
• Karakurt Used State Ties to Raise Ransom Pressure
• Polished Phishing Bypasses Trust Controls at Scale
• Developer Credentials Turn Linux Malware Into Supply-Chain Access
• Apache Patch Hides Module-Specific Exposure Across Hosts
• ADB on 5555 Turns Consumer Devices Into DDoS Fleet
• NuGet Typosquats Turn Trusted Builds Into Stealer Delivery
• vm2’s Sandbox Breakouts Multiply Beyond One Fix
• Oracle Moves Critical Fixes to Monthly Cadence
• China-Nexus APT Reuses Malware Across Government Targets
• Cisco ISE Needs Release-by-Release Patch Verification
• Google Pays More for Harder Device Exploits
• Ollama security issue includes CVE-2026-7482
• Phishing Turns RMM Tools Into Redundant Backdoors
• macOS Help Content Now Delivers Stealers via Terminal