Cybersecurity briefing, 2026-05-23

• Apex One Server Can Push Malicious Code Fleet-Wide
• Historical Packagist Tags Became a Provenance Trap
• Shared cPanel Hosts Face Root Compromise Risk
• Cloud Atlas Builds Redundant Paths Into Government Networks
• Kali365 Expands Beyond Microsoft 365 Tokens
• Ghostwriter Adds Registry Persistence to Prometheus Lures
• Server Seizures Miss THE.Hosting's Core Network
• Hiring Lures Now Deliver Stealthier Spyware
• Deleted GCP API Keys Stay Alive for Minutes
• AI Finds More Flaws Than Teams Can Triage
• Exchange and Fortinet Footholds Reach Industrial Control Networks
• PHP Dependency Reviews Miss Cross-Ecosystem Install-Time Payloads
• GitHub Actions Became a Secret-Stealing Conveyor Belt
• Hardware-Gated Driver Bugs Are Reachable From Userland

Recent editions

• Friday, May 22, 2026: Apex One Server Can Push Malicious Code Fleet-Wide · 18 stories
• Thursday, May 21, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 18 stories
• Wednesday, May 20, 2026: Malicious npm Release Exposed Secrets Before CVE Appeared · 19 stories
• Tuesday, May 19, 2026: Critical Manufacturing Gear Exposed by PAN-OS Flaw · 20 stories
• Monday, May 18, 2026: React Server Components Face Hour-Scale Ransomware Risk · 13 stories
• Sunday, May 17, 2026: Checkout Plugin Settings Turn WordPress Stores Into Skimmers · 8 stories
• Saturday, May 16, 2026: Stray PHPUnit Test Files Keep Exposing Production Servers · 19 stories