Cybersecurity briefing, 2026-05-24

Here's the trap with the Ghost CMS bug everyone's about to patch today: closing the SQL injection shuts the door, but the attacker already copied the keys to the building.

• Ghost SQLi turns sites into trusted malware launchpads
• Shared cPanel hosts face root compromise risk
• Historical Packagist tags became a provenance trap
• Cross-registry package attack turns ecosystems into trapdoors
• Wireshark 4.6.6 also updates the capture driver

Recent editions

• Saturday, May 23, 2026: Apex One server can push malicious code fleet-wide · 14 stories
• Friday, May 22, 2026: Cloud Atlas builds redundant paths into government networks · 18 stories
• Thursday, May 21, 2026: Malicious npm release exposed secrets before CVE appeared · 18 stories
• Wednesday, May 20, 2026: Critical manufacturing gear exposed by PAN-OS flaw · 19 stories
• Tuesday, May 19, 2026: React Server Components face hour-scale ransomware risk · 20 stories
• Monday, May 18, 2026: Malicious npm publisher mixes theft and botnet payloads · 13 stories
• Sunday, May 17, 2026: Checkout plugin settings turn WordPress stores into skimmers · 8 stories