Cybersecurity briefing — 2026-05-07

An active worm called PCPJack is taking over cloud systems already compromised by TeamPCP malware, chaining five vulnerabilities to spread and steal credentials.

• DAEMON Tools Build Pipeline Became the Attack Vector
• vm2’s Sandbox Breakouts Multiply Beyond One Fix
• PyPI Malware Hides C2 Inside Zulip Traffic
• ScarCruft Moves BirdCall From Windows to Android
• Fake Claude Site Delivers Beagle Backdoor via Signed G DATA Updater
• Senior Staff Normalize Credential Selling, Deepening Insider Risk
• Apache Patch Hides Module-Specific Exposure Across Hosts
• Developer Credentials Turn Linux Malware Into Supply-Chain Access
• Multiple AI coding agents vulnerable to one‑keypress RCE and local WebSocket flaw
• Commercial LLMs Become OT Intrusion Infrastructure
• Oracle Moves Critical Fixes to Monthly Cadence
• Cisco research demonstrates VLMs can be manipulated by imperceptible pixel perturbations embedding instructions in images (e.g., banners/previews), creating a covert channel that humans and simple filters miss.
• ADB on 5555 Turns Consumer Devices Into DDoS Fleet
• NuGet Typosquats Turn Trusted Builds Into Stealer Delivery
• Google Gemini CLI security update
• Google Chrome (Chrome 148, 148.0.7778.96/97) security issue includes CVE-2026-7896
• Karakurt Used State Ties to Raise Ransom Pressure
• Cisco ISE Needs Release-by-Release Patch Verification