VulnHub

A serious vulnerability in cPanel, tracked as CVE-2026-58048, has been discovered, allowing authenticated users to execute SQL commands with root privileges. This flaw, which has a CVSS score of 9.4, poses a significant risk to shared hosting environments where multiple users have access. Essentially, if you're running a shared hosting box, this bug could enable an ordinary user to gain full database administrator access, potentially compromising sensitive data. cPanel has issued patches to address this issue, and users are strongly advised to update their systems immediately to prevent exploitation. Given the nature of shared hosting, the implications of this vulnerability could be far-reaching, affecting not just individual sites but the entire server.

A recent analysis highlights how attackers are exploiting cloud services to bypass multi-factor authentication (MFA) using a technique called Account in the Middle (AitM). This involves leveraging service workers and platforms like Ultraviolet to host phishing sites on legitimate cloud infrastructure, making them harder to detect. Major platforms identified include Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS, which are being misused to create convincing phishing pages. This tactic poses a significant risk to users who might unknowingly provide their credentials, as it undermines the security measures intended to protect them. Companies utilizing these services should be aware of this vulnerability and take steps to secure their users against such phishing schemes.

A serious vulnerability has been identified in several Thermo Fisher Applied Biosystems Genetic Analyzers, which could allow attackers to tamper with DNA data by modifying output files. This flaw affects multiple versions of their software, including the 3500 Series, 3730 Series, SeqStudio, and GeneMapper ID-X, among others. The risk is significant because altered DNA test results could lead to incorrect diagnoses and treatments in healthcare settings. To mitigate the issue, Thermo Fisher has released security updates that implement digital signatures to ensure data integrity. Users are advised to update their software to the latest versions as soon as possible and to follow interim measures to secure their data until the updates can be applied.

Acrisure's KARR BT and DR-100 vehicle security systems have a serious vulnerability that could allow attackers to control vehicles remotely. The issue stems from a hard-coded Bluetooth authentication key shared among affected devices, which could let someone within range unlock doors or disable the engine. This affects all KARR BT firmware versions before July 20, 2026, and DR-100 firmware versions before the same date. While no public exploitation of this vulnerability has been reported yet, users are urged to update their devices to mitigate the risk. A firmware update has been released on July 20, 2026, to address this flaw, and users can find detailed instructions for the update on the KARR Security website.

The Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, signaling active exploitation. The vulnerabilities include a code injection issue in IBM Langflow (CVE-2026-9198), an authentication bypass in N-able N-central (CVE-2026-18556), and a lack of encryption for sensitive data in Apache Tomcat (CVE-2026-34486). These vulnerabilities are significant threats to federal agencies and other organizations, as they can allow attackers to gain control over affected systems. CISA's Binding Operational Directive 26-04 emphasizes the need for rapid remediation of these high-risk vulnerabilities, urging federal agencies to act promptly. While the directive specifically targets federal agencies, CISA encourages all organizations to prioritize addressing these vulnerabilities to enhance their security posture.

Recent research indicates that cloud and Software as a Service (SaaS) platforms have become prime targets for cyber attackers. As more companies shift their operations to these environments, threat actors are increasingly exploiting vulnerabilities related to identity management. This trend raises significant concerns for businesses and users, as it exposes sensitive data to breaches and unauthorized access. Companies need to enhance their security protocols and remain vigilant against identity-based attacks, which are on the rise. Failing to do so could lead to severe financial and reputational damage.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a significant vulnerability, tracked as CVE-2026-18577, to its Known Exploited Vulnerabilities catalog. This flaw affects N-able N-central, a platform used for IT management and monitoring. With a CVSS score of 8.2, the vulnerability allows attackers to bypass authentication, potentially granting them unauthorized access to sensitive systems. Organizations using N-able N-central should be particularly vigilant as this vulnerability poses a serious risk to their operations and data security. It's crucial for affected users to take immediate action to mitigate any potential exploitation.

cPanel has addressed a serious vulnerability that allowed authenticated users to execute SQL commands with root database privileges. This flaw, tracked as CVE-2026-58048 and rated 9.4 on the CVSS scale, breaks the security boundary between individual cPanel accounts and the server's administrative database identity. The issue was fixed in a recent security update, which also addressed two other privilege escalation paths. Hosting customers who use cPanel should be aware of this vulnerability, as it could have allowed unauthorized access to sensitive data or manipulation of critical database functions. It's crucial for users to ensure they are using the latest version of cPanel to mitigate any potential risks associated with this flaw.

A long-standing vulnerability in Baseboard Management Controllers (BMC) has been discovered, exposing over 24,000 server-management interfaces to potential attacks. This flaw allows unauthorized users to access sensitive authentication hashes before login, significantly increasing the risk of a breach. Data centers that utilize these interfaces, which are common in many server setups, are particularly vulnerable. This situation raises serious concerns about the security of critical infrastructure, as attackers could exploit these weaknesses to gain control over systems. Organizations need to assess their BMC configurations and take immediate action to protect their data centers from possible exploitation.