Cybersecurity briefing — 2026-05-13

Active exploitation is hitting cPanel right now, with more than two thousand attacker IPs racing to drop persistent backdoors on hosting control panels.

• cPanel Control Plane Breach Threatens Entire Hosting Fleets
• Gamaredon exploits CVE-2025-8088 to deliver GammaLoad downloaders
• Foxconn North American Factories Hit in Nitrogen Cyberattack; 8TB Alleged Stolen
• China-linked FamousSparrow exploits Microsoft Exchange at Azerbaijani energy firm
• SAP Commerce flaw opens unauthenticated server-side code execution
• Shai-Hulud Escapes Package Installs and Spreads Wider
• Trending Hugging Face Repo Turned Into Malware Delivery
• Skoda Shop Breach Exposes Hashes and Order History
• Avada Builder flaws (CVE-2026-4782, CVE-2026-4798) affect ~1M sites
• West Pharmaceutical discloses data theft and system encryption
• Off-Grid Networks Reduce Shutdown Risk, but Create New Targets
• dnsmasq Flaws Span DNS Poisoning and Local Root
• TrickMo Moves C2 Into TON Blockchain
• Internal database leak exposes The Gentlemen RaaS affiliates and victims
• Iran-linked Seedworm targets South Korean electronics firm using DLL sideloading
• Pixel 10 Hardening Changes the Exploit, Not the Root Path
• CVE-2026-45185: Exim UAF Allows Unauthenticated RCE
• Signal adds in-app warnings to counter linked-device phishing
• RubyGems Abuse Exposes Registry, Not Just Packages