Cybersecurity briefing, 2026-05-18

A stolen Microsoft 365 identity is not a single-account problem.

• React Server Components Face Hour-Scale Ransomware Risk
• Malicious npm Publisher Mixes Theft and Botnet Payloads
• OpenShell Sandbox Break Lets Agents Hide Malicious Actions
• Valid SLSA Provenance No Longer Guarantees Package Safety
• Healthcare Breach Totals Keep Rising After Disclosure
• Reaper Splits Trust Across Microsoft, Apple, and Google
• Structured Outputs Can Smuggle Malicious Payloads
• Default Linux Installs Exposed to Public Root Exploits
• Debian 13.5 Refreshes Install Media, Not Your Live Fleet
• Tycoon2FA Rebuilds Into Microsoft 365 Device-Code Phishing
• Stray PHPUnit Test Files Keep Exposing Production Servers
• Burst Statistics Bug Turns WordPress Admins into Backdoors
• DAEMON Tools Build Pipeline Became the Attack Vector