Cybersecurity briefing, 2026-05-07

An active worm called PCPJack is taking over cloud systems already compromised by TeamPCP malware, chaining five vulnerabilities to spread and steal credentials.

• DAEMON Tools Build Pipeline Became the Attack Vector
• vm2’s Sandbox Breakouts Multiply Beyond One Fix
• PyPI Malware Hides C2 Inside Zulip Traffic
• ScarCruft Moves BirdCall From Windows to Android
• G DATA antivirus updater security update
• Senior Staff Normalize Credential Selling, Deepening Insider Risk
• Apache Patch Hides Module-Specific Exposure Across Hosts
• Developer Credentials Turn Linux Malware Into Supply-Chain Access
• Anthropic Claude Code security update
• Commercial LLMs Become OT Intrusion Infrastructure
• Oracle Moves Critical Fixes to Monthly Cadence
• Cisco research demonstrates VLMs can be manipulated by imperceptible pixel perturbations embedding instructions in images (e.g., banners/previews), creating a covert channel that humans and simple filters miss.
• ADB on 5555 Turns Consumer Devices Into DDoS Fleet
• NuGet Typosquats Turn Trusted Builds Into Stealer Delivery
• Google Gemini CLI security update
• Google Chrome (Chrome 148, 148.0.7778.96/97) security issue includes CVE-2026-7896
• Karakurt Used State Ties to Raise Ransom Pressure
• Cisco ISE Needs Release-by-Release Patch Verification

Recent editions

• Wednesday, May 6, 2026: DAEMON Tools Build Pipeline Became the Attack Vector · 19 stories
• Tuesday, May 5, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Monday, May 4, 2026: MOVEit Automation Auth Bypass Forces Full-Installer Upgrades · 11 stories
• Sunday, May 3, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 4 stories
• Saturday, May 2, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 18 stories
• Friday, May 1, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi Exposes Keys Behind AI Gateways · 7 stories