Category: Cyber Security News

A critical authentication-bypass vulnerability (CVE-2026-41940) in cPanel/WHM is being actively exploited in the wild, allowing unauthenticated attackers to gain administrator-level control of hosting systems. The flaw lets attackers manipulate the whostmgrsession cookie and inject raw rn into session files to escalate privileges, prompting WebPros to publish an advisory and patches on April 28. #CVE-2026-41940 #cPanel

The April 2026 KB5083769 update causes VSS snapshot timeouts that break third-party backup applications on Windows 11 24H2 and 25H2, leading to failed backups and cloud console disconnects for some vendors. Affected products include Acronis, Macrium, NinjaOne, and UrBackup, and Microsoft has not yet issued a public fix; users can temporarily uninstall KB5083769 and pause updates to restore backup functionality. #KB5083769 #VSS

The FBI warned the transportation and logistics industry of a sharp rise in cyber-enabled cargo theft, with estimated losses in the United States and Canada reaching nearly $725 million in 2025. Threat actors are using phishing, spoofed emails, fake web links, and fraudulent load board listings to compromise broker and carrier systems, hijack high-value shipments, and reroute loads under stolen identities. #DieselVortex #FBI

A Romanian national, Thomasz Szabo, was sentenced to four years in federal prison for leading an online swatting ring that targeted more than 75 public officials, multiple journalists, and four religious institutions. Extradited from Romania after pleading guilty to conspiracy and threats involving explosives, Szabo personally made false bomb and mass-shooting threats — including against New York City synagogues and the U.S. Capitol — and urged followers to carry out widespread swatting attacks. #ThomaszSzabo #USCapitol

Cybersecurity firm CrowdStrike warns that Cordial Spider and Snarky Spider, affiliates of The Com and linked to Scattered Spider, are using voice‑phishing and social engineering to compromise identity platforms and rapidly exfiltrate data across victims’ SaaS environments. The financially motivated groups target U.S. organizations in multiple critical sectors, hijack MFA, use residential proxies to evade detection, and pursue data‑for‑extortion campaigns with follow‑on harassment like DDoS and swatting. #CordialSpider #SnarkySpider

Researchers at Novee Security discovered a critical remote code execution vulnerability in Gemini CLI that allowed malicious configurations in a workspace to execute arbitrary commands on the host before sandbox initialization. Google patched Gemini CLI and the run-gemini-cli GitHub Action after researchers warned the flaw could enable token theft, lateral movement,…

Four SAP-related NPM packages used in the CAP and Cloud MTA build workflows were injected with a malicious preinstall script that fetched and executed a Bun binary, delivering an information-stealing payload targeting local and cloud credentials. The compromised packages were unpublished within hours, but the campaign exfiltrated secrets to public GitHub…

SonicWall released patches for three SonicOS vulnerabilities affecting Gen 6, Gen 7, and Gen 8 firewalls, including one high-severity access control bypass and two medium-severity flaws. Customers are advised to apply the updated firmware immediately or restrict management access to SSH until patches are deployed to prevent configuration tampering or crashes….

An exploit for a local privilege escalation vulnerability nicknamed “Copy Fail” (CVE-2026-31431) was published, allowing an unprivileged local attacker to gain root on Linux kernels released since 2017 by performing a controlled 4-byte write into the page cache. Theori discovered the flaw using its Xint Code platform and released a 732-byte Python PoC that roots major distributions while upstream patches and interim mitigations like disabling the algif_aead module are being deployed. #CopyFail #CVE-2026-31431

When a new public asset appears, automated scanners and attacker tooling typically discover and begin probing it within minutes, often leading to compromise of vulnerable systems within 24 hours. Continuous external attack surface management combined with human-led validation, as demonstrated by Sprocket Security’s ASM Community Edition, can find hidden APIs and exposures before attackers do. #SprocketSecurity #ASMCommunityEdition

Anthropic chose not to release Mythos after it found thousands of previously unknown vulnerabilities in major operating systems and web browsers, concluding the model’s capabilities could enable attackers to discover and exploit flaws at machine speed. The episode highlights how AI agents can impersonate humans at scale and forces organizations to adopt continuous, behavior-based identity and permission controls. #Mythos #Anthropic

A joint international operation led by Dubai Police with U.S., Chinese and other partners arrested at least 276 suspects and shut down nine cryptocurrency investment fraud centers that ran pig-butchering romance-baiting schemes. U.S. agencies linked millions in losses to these networks, charging figures such as Thet Min Nyi and affiliates of Sanduo Group and Giant Company, while follow-up efforts include the U.S. Scam Center Strike Force and major seizures like the DOJ’s $15 billion recovery from Prince Group #DubaiPolice #PrinceGroup

A critical authentication-bypass vulnerability, CVE-2026-41940, in cPanel, WHM, and WP Squared is being actively exploited in the wild and was observed in attempts as early as February 23, 2026. Patches were released on April 28 and vendors recommend restarting cpsrvd, blocking management ports, and using published detection scripts to verify and remediate instances. #CVE-2026-41940 #cPanel

Google fixed a maximum-severity remote code execution flaw in Gemini CLI (the @google/gemini-cli npm package and google-github-actions/run-gemini-cli workflow) that allowed unprivileged attackers to load malicious configuration and execute arbitrary commands on host systems. Related disclosures also detail high-severity Cursor vulnerabilities — including CVE-2026-26268 and an unpatched “CursorJacking” access-control issue — that…