Cybersecurity briefing, 2026-05-23

• Apex One server can push malicious code fleet-wide
• Historical Packagist tags became a provenance trap
• Shared cPanel hosts face root compromise risk
• Cloud Atlas builds redundant paths into government networks
• Kali365 expands beyond Microsoft 365 tokens
• Ghostwriter adds registry persistence to Prometheus lures
• Server seizures miss THE.Hosting's core network
• Hiring lures now deliver stealthier spyware
• Deleted GCP API keys stay alive for minutes
• AI finds more flaws than teams can triage
• Exchange and Fortinet footholds reach industrial control networks
• PHP dependency reviews miss cross-ecosystem install-time payloads
• GitHub Actions became a secret-stealing conveyor belt
• Hardware-gated driver bugs are reachable from userland

Recent editions

• Friday, May 22, 2026: Cloud Atlas builds redundant paths into government networks · 18 stories
• Thursday, May 21, 2026: Malicious npm release exposed secrets before CVE appeared · 18 stories
• Wednesday, May 20, 2026: Critical manufacturing gear exposed by PAN-OS flaw · 19 stories
• Tuesday, May 19, 2026: React Server Components face hour-scale ransomware risk · 20 stories
• Monday, May 18, 2026: Malicious npm publisher mixes theft and botnet payloads · 13 stories
• Sunday, May 17, 2026: Checkout plugin settings turn WordPress stores into skimmers · 8 stories
• Saturday, May 16, 2026: Stray PHPUnit test files keep exposing production servers · 19 stories