Cybersecurity briefing, 2026-05-20

The CVE showed up nine days after the credentials were already gone.

• Malicious npm Release Exposed Secrets Before CVE Appeared
• Critical Manufacturing Gear Exposed by PAN-OS Flaw
• Industrial Routers Become Reusable Botnet Infrastructure
• Crypto Kiosks Become a Consumer-Fraud Flashpoint
• Webworm Leaves Asia, Targets Europe Through Legacy Webmail
• Android Fraud Operation Targets Carrier Billing Systems
• Drupal Patch Window Could Close Before Testing Does
• Reaper Splits Trust Across Microsoft, Apple, and Google
• FrostyNeighbor Quietly Filters Targets Before Delivery
• Robot Controller Flaw Can Alter Physical Process Behavior
• One ODM Exposes Million-Camera Surveillance Corpus
• Mail Gateway Flaws Expose Traffic and Internal Access
• Patched SonicWall VPNs Can Still Bypass MFA
• ChromaDB Model Trust Bug Opens Pre-Auth Server Takeover
• Full Card Dumps Now Feed Fraud and Identity Abuse
• Malicious Images Can Trigger Commands in ExifTool on macOS
• ABB CoreSense Flaw Can Fully Compromise Devices
• Claude Code Sandbox Bypass Breaks Outbound Trust
• Hidden Browser Scareware Evades Scanners at Scale

Recent editions

• Tuesday, May 19, 2026: Critical Manufacturing Gear Exposed by PAN-OS Flaw · 20 stories
• Monday, May 18, 2026: React Server Components Face Hour-Scale Ransomware Risk · 13 stories
• Sunday, May 17, 2026: Checkout Plugin Settings Turn WordPress Stores Into Skimmers · 8 stories
• Saturday, May 16, 2026: Stray PHPUnit Test Files Keep Exposing Production Servers · 19 stories
• Friday, May 15, 2026: Stray PHPUnit Test Files Keep Exposing Production Servers · 20 stories
• Thursday, May 14, 2026: PraisonAI Flaw Turns Exposed Agent APIs Into Targets · 20 stories
• Wednesday, May 13, 2026: cPanel Control Plane Breach Threatens Entire Hosting Fleets · 19 stories