Cybersecurity briefing, 2026-05-22

• Apex One Server Can Push Malicious Code Fleet-Wide
• Cloud Atlas Builds Redundant Paths Into Government Networks
• Ghostwriter Adds Registry Persistence to Prometheus Lures
• Shared Spyware Kit Reaches Telecom Networks
• Public Exploits Turn Old Linux Bug Into Root Path
• Kali365 Expands Beyond Microsoft 365 Tokens
• Deleted GCP API Keys Stay Alive for Minutes
• Server Seizures Miss THE.Hosting's Core Network
• Hiring Lures Now Deliver Stealthier Spyware
• YAML Anchors Exposed Blind Spots in GitHub Workflow Scanning
• Plaintext Payloads Expose Cross-Platform Node Stealer
• ABB Charger Firmware Flaw Reaches Beyond App Crashes
• Exchange and Fortinet Footholds Reach Industrial Control Networks
• ABB B&R PCs Need Coordinated Fleet Patching
• ChromaDB Model Trust Bug Opens Pre-Auth Server Takeover
• LLM-Guided Fuzzing Shifts the Bottleneck Upstream
• Hardware-Gated Driver Bugs Are Reachable From Userland
• GitHub Actions Became a Secret-Stealing Conveyor Belt

Recent editions

• Thursday, May 21, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 18 stories
• Wednesday, May 20, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 19 stories
• Tuesday, May 19, 2026: Critical Manufacturing Gear Exposed by PAN-OS Flaw · 20 stories
• Monday, May 18, 2026: React Server Components Face Hour-Scale Ransomware Risk · 13 stories
• Sunday, May 17, 2026: Checkout Plugin Settings Turn WordPress Stores Into Skimmers · 8 stories
• Saturday, May 16, 2026: Stray PHPUnit Test Files Keep Exposing Production Servers · 19 stories
• Friday, May 15, 2026: Stray PHPUnit Test Files Keep Exposing Production Servers · 20 stories