Cybersecurity briefing — 2026-05-16

• Stray PHPUnit Test Files Keep Exposing Production Servers
• Checkout Plugin Settings Turn WordPress Stores Into Skimmers
• Metasploit Modules Turn Old CVEs Into Routine Targets
• Kazuar Evolved Into a Resilient P2P Botnet
• Shai-Hulud Escapes Package Installs and Spreads Wider
• Gremlin Stealer Hides Payloads Beyond Static Detection
• Chrome 148 Cuts Across Chromium’s Memory-Safety Surface
• NGINX Rewrite Rules Expose Workers to Crafted Requests
• OpenShell Sandbox Break Lets Agents Hide Malicious Actions
• Avada Builder Flaws Can Expose WordPress Secrets
• SSO Compromise Now Fuels Bulk SharePoint Exfiltration
• Session Theft Turns Stealers Into Durable Account Access
• Burst Statistics Bug Turns WordPress Admins into Backdoors
• Trusted Windows Paths Carry Twill Typhoon Payloads
• Same Payload Hit npm, PyPI, and Cemu Release
• DAEMON Tools Build Pipeline Became the Attack Vector
• WinRAR Archive Exploit Becomes a Persistent Spy Foothold
• cPanel Control Plane Breach Threatens Entire Hosting Fleets
• PraisonAI Flaw Turns Exposed Agent APIs Into Targets