Cybersecurity briefing, 2026-05-16

• Stray PHPUnit test files keep exposing production servers
• Checkout plugin settings turn WordPress stores into skimmers
• Metasploit modules turn old CVEs into routine targets
• Kazuar evolved into a resilient P2P botnet
• Shai-Hulud code release fuels copycat worms
• Gremlin Stealer hides payloads beyond static detection
• Chrome 148 cuts across Chromium’s memory-safety surface
• Public PoC turns NGINX into active attack surface
• OpenShell sandbox break lets agents hide malicious actions
• Avada Builder flaws can expose WordPress secrets
• SSO compromise now fuels bulk SharePoint exfiltration
• Session theft turns stealers into durable account access
• Burst Statistics bug turns WordPress admins into backdoors
• Trusted Windows paths carry Twill Typhoon payloads
• Same payload hit npm, PyPI, and Cemu release
• DAEMON Tools build pipeline became the attack vector
• WinRAR archive exploit becomes a persistent spy foothold
• cPanel control plane breach threatens entire hosting fleets
• PraisonAI flaw turns exposed agent APIs into targets

Recent editions

• Friday, May 15, 2026: Burst Statistics bug turns WordPress admins into backdoors · 20 stories
• Thursday, May 14, 2026: PraisonAI flaw turns exposed agent APIs into targets · 20 stories
• Wednesday, May 13, 2026: cPanel control plane breach threatens entire hosting fleets · 19 stories
• Tuesday, May 12, 2026: Backdoored Jenkins plugin hits CI trust boundary · 14 stories
• Monday, May 11, 2026: FCC lets banned routers receive security updates · 10 stories
• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story
• Saturday, May 9, 2026: vm2’s sandbox breakouts multiply beyond one fix · 6 stories