Cybersecurity briefing — 2026-05-15

A cPanel authentication bypass is being actively exploited right now, and attackers are using it to drop backdoors across entire hosting fleets.

• Stray PHPUnit Test Files Keep Exposing Production Servers
• Burst Statistics Bug Turns WordPress Admins into Backdoors
• Checkout Plugin Settings Turn WordPress Stores Into Skimmers
• Kazuar Evolved Into a Resilient P2P Botnet
• Shai-Hulud Escapes Package Installs and Spreads Wider
• Metasploit Modules Turn Old CVEs Into Routine Targets
• Exchange Foothold Reused Across Three Intrusion Waves
• Gremlin Stealer Hides Payloads Beyond Static Detection
• PraisonAI Flaw Turns Exposed Agent APIs Into Targets
• Chrome 148 Cuts Across Chromium’s Memory-Safety Surface
• Avada Builder Flaws Can Expose WordPress Secrets
• Ransomware Shutdown Hits Pharma Supply Chain Operations
• SIMATIC HMI Panels Expose Browser Access via Help Link
• NGINX Rewrite Rules Expose Workers to Crafted Requests
• OpenShell Sandbox Break Lets Agents Hide Malicious Actions
• ROX Firmware Hides a Long CVE Backlog
• Belarus APT Filters Targets Before Spearphishing Govs
• Session Theft Turns Stealers Into Durable Account Access
• Dream Market Admin Faces Cross-Border Money Laundering Cases
• ROS# File Server Can Rewrite Its Own Files