Cybersecurity briefing, 2026-05-17

A nine-year-old PHP vulnerability is one of the most actively scanned exploits on the internet today, and the reason isn't what you'd think.

• Checkout plugin settings turn WordPress stores into skimmers
• Kazuar evolved into a resilient P2P botnet
• Tycoon2FA rebuilds into Microsoft 365 device-code phishing
• Stray PHPUnit test files keep exposing production servers
• Burst Statistics bug turns WordPress admins into backdoors
• Same payload hit npm, PyPI, and Cemu release
• WinRAR archive exploit becomes a persistent spy foothold
• cPanel control plane breach threatens entire hosting fleets

Recent editions

• Saturday, May 16, 2026: Stray PHPUnit test files keep exposing production servers · 19 stories
• Friday, May 15, 2026: Burst Statistics bug turns WordPress admins into backdoors · 20 stories
• Thursday, May 14, 2026: PraisonAI flaw turns exposed agent APIs into targets · 20 stories
• Wednesday, May 13, 2026: cPanel control plane breach threatens entire hosting fleets · 19 stories
• Tuesday, May 12, 2026: Backdoored Jenkins plugin hits CI trust boundary · 14 stories
• Monday, May 11, 2026: FCC lets banned routers receive security updates · 10 stories
• Sunday, May 10, 2026: cPanel control-plane flaws expose hosted sites · 1 story