Cybersecurity briefing, 2026-05-12

A cPanel auth-bypass flaw is under active exploitation right now, with more than two thousand attacker IPs hammering hosting panels and dropping a Filemanager backdoor that survives patching.

• cPanel control plane breach threatens entire hosting fleets
• Backdoored Jenkins plugin hits CI trust boundary
• dnsmasq flaws span DNS poisoning and local root
• Crimenetwork’s reboot fails under rapid cross-border pressure
• Skoda shop breach exposes hashes and order history
• Trending Hugging Face repo turned into malware delivery
• AD CS becomes an identity escalation layer
• TrickMo moves C2 into TON blockchain
• Two-year hidden intrusion exposed water sector detection gaps
• Geospatial data theft reframes espionage risk
• Years-long phishing crew keeps scaling its reach
• HTTP mode turns Code Runner into remote code surface
• Patched Tesla charger still rolls back firmware
• Fake Claude Code pages turn install text into theft

Recent editions

• Monday, May 11, 2026: FCC lets banned routers receive security updates · 10 stories
• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story
• Saturday, May 9, 2026: vm2’s sandbox breakouts multiply beyond one fix · 6 stories
• Friday, May 8, 2026: Commercial LLMs become OT intrusion infrastructure · 8 stories
• Thursday, May 7, 2026: DAEMON Tools build pipeline became the attack vector · 18 stories
• Wednesday, May 6, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories
• Tuesday, May 5, 2026: MOVEit Automation auth bypass forces full-installer upgrades · 19 stories