Cybersecurity briefing, 2026-05-14

An AI agent platform called PraisonAI got probed by scanners less than four hours after disclosure, and that should reshape how teams think about disclosure timing.

• PraisonAI flaw turns exposed agent APIs into targets
• Exchange foothold reused across three intrusion waves
• Same payload hit npm, PyPI, and Cemu release
• npm package update becomes a secret theft vector
• Dream Market admin faces cross-border money laundering cases
• SIMATIC HMI panels expose browser access via help link
• Ransomware shutdown hits pharma supply chain operations
• Public PoC turns NGINX into active attack surface
• ROX firmware hides a long CVE backlog
• Exim BDAT edge case opens potential code execution
• WinRAR archive exploit becomes a persistent spy foothold
• The Gentlemen scales to hundreds of victims fast
• ROS# file server can rewrite its own files
• Robot controller flaw can alter physical process behavior
• Manufacturing message flows can be hijacked via Artemis
• Request smuggling lets attackers take over Siemens Data managers
• Some Siemens PLC Web UIs still lack fixes
• Malicious packages hit developer laptops, not production
• FrostyNeighbor quietly filters targets before delivery
• Signed security binaries became Seedworm’s stealth path

Recent editions

• Wednesday, May 13, 2026: cPanel control plane breach threatens entire hosting fleets · 19 stories
• Tuesday, May 12, 2026: Backdoored Jenkins plugin hits CI trust boundary · 14 stories
• Monday, May 11, 2026: FCC lets banned routers receive security updates · 10 stories
• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story
• Saturday, May 9, 2026: vm2’s sandbox breakouts multiply beyond one fix · 6 stories
• Friday, May 8, 2026: Commercial LLMs become OT intrusion infrastructure · 8 stories
• Thursday, May 7, 2026: DAEMON Tools build pipeline became the attack vector · 18 stories