Cybersecurity briefing, 2026-05-08

A dozen sandbox escapes just landed in vm2, the Node library many teams use to run untrusted JavaScript, and a partial upgrade is not enough this time.

• vm2’s Sandbox Breakouts Multiply Beyond One Fix
• Commercial LLMs Become OT Intrusion Infrastructure
• Stolen Contractor Tools Became Reusable Foreign Capability
• Senior Staff Normalize Credential Selling, Deepening Insider Risk
• Developer Credentials Turn Linux Malware Into Supply-Chain Access
• PyPI Malware Hides C2 Inside Zulip Traffic
• Partner Breach, Not NVIDIA Core, Exposed GeForce NOW Users
• Shared Infrastructure Blurs Hacktivist Boundaries in Russia Campaign

Recent editions

• Thursday, May 7, 2026: DAEMON Tools Build Pipeline Became the Attack Vector · 18 stories
• Wednesday, May 6, 2026: DAEMON Tools Build Pipeline Became the Attack Vector · 19 stories
• Tuesday, May 5, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Monday, May 4, 2026: MOVEit Automation Auth Bypass Forces Full-Installer Upgrades · 11 stories
• Sunday, May 3, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 4 stories
• Saturday, May 2, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 18 stories
• Friday, May 1, 2026: Exchange N-day Abuse Expands Espionage Reach Across Governments · 19 stories