Cybersecurity briefing, 2026-05-09

• cPanel control-plane flaws expose hosted sites
• vm2’s sandbox breakouts multiply beyond one fix
• Commercial LLMs become OT intrusion infrastructure
• Stolen contractor tools became reusable foreign capability
• Senior staff normalize credential selling, deepening insider risk
• Developer credentials turn Linux malware into supply-chain access

Recent editions

• Friday, May 8, 2026: Commercial LLMs become OT intrusion infrastructure · 8 stories
• Thursday, May 7, 2026: DAEMON Tools build pipeline became the attack vector · 18 stories
• Wednesday, May 6, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Tuesday, May 5, 2026: MOVEit Automation auth bypass forces full-installer upgrades · 19 stories
• Monday, May 4, 2026: ShadowPad espionage campaign targets Exchange and IIS servers · 11 stories
• Sunday, May 3, 2026: Exchange N-day abuse expands espionage reach across governments · 4 stories
• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories