Category: Cyber Security News

A critical authentication bypass vulnerability affecting nearly all supported versions of cPanel and WHM could allow unauthenticated attackers to access control panels and take over hosting accounts or entire servers. WebPros released emergency patches and advises administrators to run /scripts/upcp –force to apply fixes while providers like Namecheap temporarily blocked ports 2083 and 2087 to protect customers. #cPanel #WHM

Checkmarx confirmed its KICS open source project was compromised after a March 23 Trivy supply chain attack that let attackers hijack GitHub Action tags and poison packages to reference malware. The intrusion, attributed to TeamPCP and apparently leveraged with Lapsus for monetization, led to the exfiltration of source code, employee databases,…

Millions of RDP and VNC servers are exposed to the internet—Forescout found roughly 1.8 million RDP and 1.6 million VNC instances, with tens of thousands tied to specific industries and hundreds providing unauthenticated access to ICS/OT panels. Many systems run unsupported Windows versions (over 19,000 RDP servers vulnerable to BlueKeep), and…

A critical SQL injection vulnerability (CVE-2026-42208) in the LiteLLM open-source AI gateway was exploited days after public disclosure to access database tables containing API keys, provider credentials, and environment configuration, Sysdig reports. Maintainers released LiteLLM 1.83.7 to fix the issue by parameterizing the key verification query, and users are advised to…

CISA has ordered federal agencies to patch Windows endpoints and servers for a zero-click vulnerability tracked as CVE-2026-32202 that Akamai said remained after an incomplete Microsoft fix for CVE-2026-21510. The flaw is linked to prior APT28 activity and was added to CISA’s KEV catalog with a May 12 deadline under BOD 22-01, with CISA urging all organizations to prioritize remediation. #CVE-2026-32202 #APT28

Google and Mozilla released security updates for Chrome and Firefox to fix multiple memory-safety vulnerabilities, with Chrome 147 addressing 30 issues including four critical use-after-free flaws and Firefox 150.0.1 resolving several critical and high-severity memory bugs. Both vendors patched CVEs affecting components like Canvas, GPU, Accessibility, Views, and Audio/Video, and Google…

Aisle’s analysis of OpenEMR uncovered 39 vulnerabilities (38 assigned CVEs), including critical SQL injection and authorization bypass flaws that could allow authenticated attackers to exfiltrate PHI and achieve remote code execution. OpenEMR developers partnered with Aisle to patch all issues; notable tracked bugs include CVE-2026-24908, CVE-2026-23627, and CVE-2026-24487, and a full…

Handala, an Iran-linked threat actor, has targeted US troops in Bahrain via WhatsApp influence messages claiming the service members are under surveillance and threatening attacks with Shahed drones and Kheibar and Ghadeer missiles. The group—linked to Iran’s Ministry of Intelligence and Security and tied to incidents like the disruptive Stryker attack…

Kaseya announced an agentic IT management platform powered by Kaseya Intelligence that unifies data across IT operations, security, and backup while autonomously triaging tickets, containing threats, verifying backups, and optimizing workflows. The platform pairs a purpose-built AI trained on real-world data with an execution layer that closes the loop—automating actions, validating outcomes, and delivering features like Agentic Digital Specialists, Unified Cyber Resilience, and Kaseya SIEM. #Kaseya #KaseyaIntelligence

Microchip Technology expanded its Trust Shield lineup with the TS1800 Platform Root of Trust controller and the TS50x secure boot controller, both offering hardware-accelerated post‑quantum cryptography for secure boot, firmware updates, attestation, and certificate handling. The devices support emerging mandates like the European Cyber Resilience Act and CNSA 2.0 and are available via the TrustFLEX platform to simplify PQC-ready deployments. #TS1800 #TS50x

Attackers are exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that causes victims’ systems to authenticate with the attacker’s server and expose Net-NTLMv2 hashes. The flaw arose from an incomplete patch for earlier LNK-based exploits used by APT28, and Microsoft and CISA confirmed active exploitation after an initial patch was issued without an exploitation warning. #CVE-2026-32202 #APT28

Microsoft is working to resolve a known issue that is preventing some Microsoft Teams Free users from chatting and calling others after a recently deployed backend change skipped onboarding and privacy consent screens. The company labeled the problem a service degradation, first reported on April 8, and says affected profiles appear as “Unknown users” and are not searchable while it continues investigating and prepares another update. #MicrosoftTeamsFree #MicrosoftEdge

A feud between RaaS operators 0APT and KryBit erupted into mutual breaches and public data leaks that exposed fabricated victim claims and operational details. Halcyon researchers say the conflict yielded actionable intelligence — including indicators of compromise and proof that 0APT’s initial 190+ victim list was fake — and recommend defenders monitor for data staging, validate backups, and deploy anti-ransomware protections. #0APT #KryBit

North Korea’s BlueNoroff has run a financially motivated campaign targeting cryptocurrency executives by luring them into fake Zoom meetings populated with AI-generated avatars and stolen webcam footage to deliver malware. Arctic Wolf found attackers exfiltrating victims’ webcam video to create increasingly convincing deepfake meetings and using typo‑squatted links and a fake Zoom SDK update prompt to achieve rapid compromise and credential and wallet theft. #BlueNoroff #ArcticWolf