Cybersecurity briefing, 2026-05-07

An active worm called PCPJack is taking over cloud systems already compromised by TeamPCP malware, chaining five vulnerabilities to spread and steal credentials.

• DAEMON Tools build pipeline became the attack vector
• vm2’s sandbox breakouts multiply beyond one fix
• PyPI malware hides C2 inside Zulip traffic
• ScarCruft moves BirdCall from Windows to Android
• G DATA antivirus updater security update
• Senior staff normalize credential selling, deepening insider risk
• Apache patch hides module-specific exposure across hosts
• Developer credentials turn Linux malware into supply-chain access
• Anthropic Claude Code security update
• Commercial LLMs become OT intrusion infrastructure
• Oracle moves critical fixes to monthly cadence
• Cisco research demonstrates VLMs can be manipulated by imperceptible pixel perturbations embedding instructions in images (e.g., banners/previews), creating a covert channel that humans and simple filters miss.
• ADB on 5555 turns consumer devices into DDoS fleet
• NuGet typosquats turn trusted builds into stealer delivery
• Google Gemini CLI security update
• Google Chrome (Chrome 148, 148.0.7778.96/97) security issue includes CVE-2026-7896
• Karakurt used state ties to raise ransom pressure
• Cisco ISE needs release-by-release patch verification

Recent editions

• Wednesday, May 6, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Tuesday, May 5, 2026: MOVEit Automation auth bypass forces full-installer upgrades · 19 stories
• Monday, May 4, 2026: ShadowPad espionage campaign targets Exchange and IIS servers · 11 stories
• Sunday, May 3, 2026: Exchange N-day abuse expands espionage reach across governments · 4 stories
• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories
• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories