Critical Privilege-Escalation Flaw in cPanel & WHM Exposes Servers to Root-Level Compromise A severe vulnerability in cPanel & WHM (CVE-2026-58048) has been disclosed, allowing authenticated users to execute arbitrary SQL commands with full database administrative privileges. The flaw, which affects the platform’s database management functionality, could lead to root-level server compromise in certain configurations, particularly in shared hosting environments. ### Key Details - Who: The vulnerability impacts all supported versions of cPanel & WHM prior to patched releases. - What: An authenticated attacker with access to the MySQL or MariaDB feature can escalate privileges, bypassing assigned permissions to execute administrative SQL commands. - Impact: Successful exploitation could enable attackers to: - Access or exfiltrate sensitive customer databases. - Modify database users and permissions. - Extract credentials or deploy malicious triggers. - Gain filesystem access, potentially leading to full server compromise. - Where: The risk is highest in shared hosting environments, where multiple users share the same server. - When: The flaw was disclosed by WebPros, with credit to security researcher Vincent55 Yang. No technical exploitation details have been publicly released. ### Mitigation & Patching cPanel has released patched versions to address the issue: - 11.110.0.137 - 11.118.0.71 - 11.126.0.78 - 11.134.0.48 - 11.136.0.32 - 138.1.6 (for WP2 deployments) For administrators unable to patch immediately, a temporary mitigation involves revoking the MySQL feature from affected cPanel users via feature list management. Security teams are advised to review database audit logs for suspicious activity, such as unauthorized privilege assignments or unusual file-related operations. Hosting providers should prioritize patching, as the severity of the flaw makes rapid remediation critical.

Large-Scale Cyber Campaign Hijacks GitHub Actions to Target Web Hosting Servers A sophisticated cyber campaign is exploiting GitHub Actions to weaponize trusted open-source projects, turning them into tools for scanning and compromising web hosting servers. The attack, uncovered by analysts at Socket.dev, abuses free GitHub compute resources to target cPanel and WHM servers critical infrastructure for managing websites, email accounts, and databases. Between July 12 and 13, 2026, attackers compromised a legitimate PHP developer’s Packagist account, injecting malicious GitHub Actions workflow files into ten development versions of their packages. These workflows, containing 55–62 malicious files each, launch temporary Ubuntu runners that download Linux payloads and scan the internet for vulnerable hosts. The campaign extends beyond the initial compromise, with thousands of matching workflow files discovered across unrelated repositories, indicating a broad effort to hijack automation pipelines. The attack chain begins when a compromised repository triggers a workflow, spinning up an ephemeral GitHub runner. The runner fetches a processor-specific payload from a threat actor-controlled server (43.228.157.68) and exploits CVE-2026-41940, an authentication bypass flaw in cPanel and WHM. Successful breaches expose cloud credentials, payment data, and source control tokens including AWS keys, GitHub/GitLab tokens, OpenAI/Google API keys, Stripe credentials, and SSH material. The malware exfiltrates stolen data in small chunks via HTTP POST requests, with heartbeats sent every 30 seconds. While installing the affected PHP packages does not directly execute the malware, root-level GitHub Actions in compromised repositories serve as the attack engine. A single WHM compromise can jeopardize multiple customer accounts, databases, and application secrets. The campaign remains active despite the suspension of one GitHub account, underscoring its persistence. Indicators of compromise include the C2 server IP (43.228.157.68), payload delivery URLs, and the compromised maintainer account (dinushchathurya). Affected Packagist packages span multiple repositories, all tied to the same developer. Defensive measures include disabling suspicious workflows, rotating credentials, and patching cPanel/WHM systems. The incident highlights the risks of untrusted automation in CI/CD pipelines, echoing past supply chain attacks where stolen credentials enabled further breaches.

cPanel Patches Critical Authentication Vulnerability Affecting Control Panel Access cPanel has released urgent security updates to fix a critical vulnerability in its control panel software that could allow attackers to gain unauthorized access through authentication flaws. The issue impacts all currently supported versions, with patches now available in the following releases: - 11.110.0.97 - 11.118.0.63 - 11.126.0.54 - 11.132.0.29 - 11.136.0.5 - 11.134.0.20 cPanel warned that unsupported versions may also be vulnerable, urging users to update immediately. While the company did not disclose technical details, web hosting provider Namecheap revealed the flaw involves an authentication exploit targeting login mechanisms. As a precaution, Namecheap temporarily blocked access to TCP ports 2083 and 2087, disrupting customer access to cPanel and WHM interfaces until the patch was deployed. The company confirmed that fixes were applied to Reseller and Stellar Business servers by April 29, 2026, at 02:42 a.m. UTC, with remaining systems updated shortly after. No active exploitation has been reported.

Cybersecurity Roundup: Key Incidents and Developments from April 2026 Last week saw a surge in cybersecurity threats, regulatory actions, and technological advancements highlighting both emerging risks and evolving defenses. Here’s a breakdown of the most critical developments: ### AI and Automation: New Frontiers for Cybercrime and Defense - AI-Powered Cybercrime: Threat actors are leveraging gig platforms like RentAHuman to hire AI agents for tasks such as physical surveillance, item delivery, and in-person meetings, blurring the line between digital and real-world attacks. - AI Supply Chain Risks: Cisco released an open-source toolkit to verify AI model lineage, addressing concerns that enterprises lack visibility into modifications made to downloaded models from repositories like Hugging Face. - AI-Driven Attacks: OpenAI warned that attackers are scaling operations using AI, while Anthropic adopted a more restrictive approach to advanced AI access. Meanwhile, automated LLM red teaming tools are evolving, with Capital One proposing Adaptive Instruction Composition to prioritize high-impact attack vectors. - AI Traffic Surge: AI workflows are generating larger, less predictable data flows, with Backblaze reporting a shift toward high-bandwidth traffic between fewer endpoints. ### Data Breaches and Privacy Violations - Massive Fines: U.S. state privacy regulators imposed $3.425 billion in fines in 2025 nearly double the 2024 total reflecting stricter enforcement trends. - High-Profile Breaches: - ADT confirmed a breach on April 20, exposing customer data after hackers accessed its systems. - Udemy suffered a breach claimed by ShinyHunters, leaking 1.4 million records with sensitive user details. - UK Biobank: Medical data from 500,000 British volunteers was listed for sale on Alibaba, raising concerns about genetic and clinical data misuse. - Academic Data Leaks: A study of 2.7 million arXiv submissions found that 88% of LaTeX source files contained unintended public disclosures, including drafts, comments, and project data. ### Critical Vulnerabilities and Exploits - Windows Zero-Day (CVE-2026-32202): Actively exploited in the wild, this Windows Shell spoofing flaw allows attackers to force authentication to malicious servers. It stems from an incomplete patch for a prior vulnerability (CVE-2026-21510) linked to APT28 (Fancy Bear). - Linux Kernel Flaw (CVE-2026-31431): A nine-year-old privilege escalation bug ("Copy Fail") affects nearly all major Linux distributions since 2017, with a public proof-of-concept exploit available. - GitHub Enterprise Server RCE (CVE-2026-3854): While patched on GitHub.com, 88% of self-hosted instances remain vulnerable to remote code execution. - cPanel Zero-Day (CVE-2026-41940): Exploited since February 2026, this authentication bypass flaw in the web hosting control panel highlights delayed patching risks. - Vect Ransomware Bug: A flaw in the Vect ransomware-as-a-service (RaaS) effectively turns it into a data wiper, with affiliates encrypting files irreversibly. ### Threat Actor Activity - UNC6692: A new threat group impersonated IT helpdesk staff via Microsoft Teams, tricking employees into downloading malware disguised as a "Mailbox Repair Utility" in a campaign active since December 2025. - Robinhood Phishing: Cybercriminals hijacked Robinhood’s email systems to send phishing emails to users, with reports surfacing on April 26. - Black Axe Arrests: Swiss police arrested 10 suspected members of the Black Axe cybercrime gang, including its Southern Europe "Regional Head," in a coordinated raid on April 28. - Roblox Account Theft: Ukrainian police detained three suspects accused of stealing and reselling 600,000 Roblox accounts via malware disguised as game tools. - SMS Blaster Operation: Canadian authorities arrested three men for operating a mobile cell tower spoofing device, used to send fraudulent SMS messages across the Greater Toronto Area. ### Regulatory and Law Enforcement Actions - Chinese Hacker Extradited: Xu Zewei, a Chinese national, was extradited from Italy to the U.S. for allegedly breaching thousands of systems, including those tied to COVID-19 research. - Albanian Call Center Bust: A joint operation dismantled a €50 million fraud ring operating from Albania, with 10 arrests and €900,000 seized. ### Tooling and Infrastructure Updates - IPFire DNS Firewall: The open-source firewall now includes built-in domain blocking, replacing third-party tools like Pi-hole for malware and phishing protection. - Open-Source Privacy Tools: - BleachBit 6.0.0 enhanced secure deletion and browser cleaning for Windows/Linux. - Kiji Privacy Proxy (by Dataiku) masks PII before prompts reach external AI services. - SimpleX Chat released a user-identifier-free encrypted messenger. - Linux Storage: Stratis 3.9.0 added online encryption and cache-less pool startup for improved security. - Proxmox Backup Server 4.2 introduced S3 storage support and parallel sync jobs. ### SOC and Identity Challenges - SOC Metrics Under Scrutiny: The UK’s NCSC warned that ticket-based metrics (e.g., IT service desk KPIs) can undermine security operations by failing to measure real attack detection. - AI and IAM Gaps: Identity and access management (IAM) systems, designed for human users, struggle with AI agents that bypass traditional authentication. The FIDO Alliance is exploring new frameworks for AI-driven payments. - Shadow AI Risks: 31% of employees using AI tools receive no employer training, widening the gap between adoption and governance. ### Industrial and Infrastructure Threats - ICS Blind Spots: Researchers identified three critical gaps in industrial control system (ICS) intrusion detection, complicating plant security. - GPS Spoofing Detection: Oak Ridge National Laboratory developed a portable tool to expose GPS signal manipulation in transit networks. ### Open-Source and Developer Tools - Visual Studio Updates: GitHub Copilot now integrates cloud agents for scalable task execution, while VS Code 1.118 added auto-model selection for Copilot CLI. - Warp Terminal: The AI-centric terminal open-sourced its client under the AGPL license, with OpenAI as a founding sponsor. - LuLu Firewall: A free macOS tool now monitors outbound connections to block unauthorized data exfiltration. ### Emerging Trends - Bad Bots: AI agents now account for 40% of internet traffic, alongside traditional "good" and "bad" bots, per Thales’ 2026 report. - AI Prompt Confidentiality: Researchers raised concerns about unpublished research and proprietary data being leaked via commercial AI tools like Research Rabbit and Elicit AI. - Met Police AI Scrutiny: London’s Metropolitan Police faced backlash for using Palantir’s AI to monitor officers’ movements for misconduct investigations. This wave of incidents underscores the accelerating convergence of AI, automation, and cyber threats while also highlighting the urgent need for adaptive defenses, stricter data governance, and proactive vulnerability management.

Reborn Gaming Suffers Data Breach Exposing 126 Email Addresses Last week, gaming platform Reborn Gaming experienced a data breach affecting 126 unique email addresses, along with associated IP addresses and Steam IDs. The incident stemmed from a vulnerability in cPanel/WHM, a widely used web hosting control panel. According to breach notification platform Have I Been Pwned, 68% of the exposed email addresses were already linked to LinkedIn profiles, increasing the risk of targeted phishing or credential-stuffing attacks. The breach highlights ongoing security risks tied to misconfigured or unpatched hosting infrastructure, particularly in gaming and online communities where user data is frequently targeted. No further details on the timeline of the attack or remediation efforts have been disclosed. The incident serves as a reminder of the persistent threats posed by unsecured third-party services in digital ecosystems.

Critical cPanel Flaw Exploited in Widespread "Sorry" Ransomware Attacks A critical authentication bypass vulnerability in cPanel and WHM (CVE-2026-41940) is being actively exploited to deploy the "Sorry" ransomware, targeting Linux-based web hosting servers. The flaw, patched in an emergency update this week, allows attackers to gain unauthorized access to control panels managing websites, databases, and webmail. Exploitation attempts date back to late February, with attacks escalating rapidly after the vulnerability was disclosed. Security firm Shadowserver reports that at least 44,000 IP addresses running cPanel have been compromised. Threat actors began mass-exploiting the flaw on Thursday, deploying a Go-based Linux encryptor that appends the ".sorry" extension to encrypted files. The ransomware uses ChaCha20 encryption, with keys secured via an embedded RSA-2048 public key, making decryption impossible without the attacker’s private key. Victims receive a ransom note (README.md) directing them to contact the threat actor via Tox (ID: 3D7889AEC00F2325E1A3FBC0ACA4E521670497F11E47FDE13EADE8FED3144B5EB56D6B198724). Hundreds of compromised sites have already been indexed by Google, indicating widespread impact. This campaign is unrelated to a 2018 ransomware operation that also used the ".sorry" extension. Security experts warn that exploitation is expected to intensify in the coming days.