Cybersecurity briefing, 2026-05-11

A malicious version of the Checkmarx Jenkins plugin slipped onto the official Jenkins Marketplace, sitting right inside the build pipelines that companies trust to scan their own code for vulnerabilities.

• cPanel control plane breach threatens entire hosting fleets
• Backdoored Jenkins plugin hits CI trust boundary
• FCC lets banned routers receive security updates
• Crimenetwork’s reboot fails under rapid cross-border pressure
• TrickMo moves C2 into TON blockchain
• Geospatial data theft reframes espionage risk
• Years-long phishing crew keeps scaling its reach
• Two-year hidden intrusion exposed water sector detection gaps
• Unsupported ATutor exposed to reflected XSS
• Fake Claude Code pages turn install text into theft

Recent editions

• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story
• Saturday, May 9, 2026: vm2’s sandbox breakouts multiply beyond one fix · 6 stories
• Friday, May 8, 2026: Commercial LLMs become OT intrusion infrastructure · 8 stories
• Thursday, May 7, 2026: DAEMON Tools build pipeline became the attack vector · 18 stories
• Wednesday, May 6, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Tuesday, May 5, 2026: MOVEit Automation auth bypass forces full-installer upgrades · 19 stories
• Monday, May 4, 2026: ShadowPad espionage campaign targets Exchange and IIS servers · 11 stories