Cybersecurity briefing — 2026-05-08

A dozen sandbox escapes just landed in vm2, the Node library many teams use to run untrusted JavaScript, and a partial upgrade is not enough this time.

• vm2’s Sandbox Breakouts Multiply Beyond One Fix
• Anthropic Claude used in AI-assisted intrusion targeting Mexican water utility
• Stolen Contractor Tools Became Reusable Foreign Capability
• Senior Staff Normalize Credential Selling, Deepening Insider Risk
• Developer Credentials Turn Linux Malware Into Supply-Chain Access
• PyPI Malware Hides C2 Inside Zulip Traffic
• NVIDIA confirms GeForce NOW data breach affecting Armenia users
• BO Team and Head Mare Coordinate Attacks Against Russian Organizations