Cybersecurity briefing, 2026-05-20

The CVE showed up nine days after the credentials were already gone.

• Malicious npm release exposed secrets before CVE appeared
• Critical manufacturing gear exposed by PAN-OS flaw
• Industrial routers become reusable botnet infrastructure
• Crypto kiosks become a consumer-fraud flashpoint
• Webworm leaves Asia, targets Europe through legacy webmail
• Android fraud operation targets carrier billing systems
• Drupal patch window could close before testing does
• Reaper splits trust across Microsoft, Apple, and Google
• FrostyNeighbor quietly filters targets before delivery
• Robot controller flaw can alter physical process behavior
• One ODM exposes million-camera surveillance corpus
• Mail Gateway flaws expose traffic and internal access
• Patched SonicWall VPNs can still bypass MFA
• ChromaDB model trust bug opens pre-auth server takeover
• Full card dumps now feed fraud and identity abuse
• Malicious images can trigger commands in ExifTool on macOS
• ABB CoreSense flaw can fully compromise devices
• Claude Code sandbox bypass breaks outbound trust
• Hidden browser scareware evades scanners at scale

Recent editions

• Tuesday, May 19, 2026: React Server Components face hour-scale ransomware risk · 20 stories
• Monday, May 18, 2026: Malicious npm publisher mixes theft and botnet payloads · 13 stories
• Sunday, May 17, 2026: Checkout plugin settings turn WordPress stores into skimmers · 8 stories
• Saturday, May 16, 2026: Stray PHPUnit test files keep exposing production servers · 19 stories
• Friday, May 15, 2026: Burst Statistics bug turns WordPress admins into backdoors · 20 stories
• Thursday, May 14, 2026: PraisonAI flaw turns exposed agent APIs into targets · 20 stories
• Wednesday, May 13, 2026: cPanel control plane breach threatens entire hosting fleets · 19 stories