Cybersecurity briefing, 2026-05-13

Active exploitation is hitting cPanel right now, with more than two thousand attacker IPs racing to drop persistent backdoors on hosting control panels.

• cPanel control plane breach threatens entire hosting fleets
• WinRAR archive exploit becomes a persistent spy foothold
• Foxconn attack threatens customer IP, not just downtime
• Exchange foothold reused across three intrusion waves
• SAP Commerce flaw opens unauthenticated server-side code execution
• Shai-Hulud code release fuels copycat worms
• Trending Hugging Face repo turned into malware delivery
• Skoda shop breach exposes hashes and order history
• Avada Builder flaws can expose WordPress secrets
• Ransomware shutdown hits pharma supply chain operations
• Off-grid networks reduce shutdown risk, but create new targets
• dnsmasq flaws span DNS poisoning and local root
• TrickMo moves C2 into TON blockchain
• The Gentlemen scales to hundreds of victims fast
• Signed security binaries became Seedworm’s stealth path
• Pixel 10 hardening changes the exploit, not the root path
• Exim BDAT edge case opens potential code execution
• Signal’s weak point is device linking, not encryption
• RubyGems abuse exposes registry, not just packages

Recent editions

• Tuesday, May 12, 2026: Backdoored Jenkins plugin hits CI trust boundary · 14 stories
• Monday, May 11, 2026: FCC lets banned routers receive security updates · 10 stories
• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story
• Saturday, May 9, 2026: vm2’s sandbox breakouts multiply beyond one fix · 6 stories
• Friday, May 8, 2026: Commercial LLMs become OT intrusion infrastructure · 8 stories
• Thursday, May 7, 2026: DAEMON Tools build pipeline became the attack vector · 18 stories
• Wednesday, May 6, 2026: Weaver E-cology flaw turned servers into command shells · 19 stories