A recently discovered vulnerability in cPanel allows attackers to bypass authentication, raising significant concerns for millions of users. Following the disclosure of this flaw, multiple proof-of-concept exploits have surfaced, indicating that the vulnerability could be actively exploited in the wild. One researcher has noted that there has been zero-day activity linked to this issue for at least a month, suggesting that attackers may already be taking advantage of the situation. This flaw affects various versions of cPanel, which is widely used for managing web hosting services. Users and companies relying on cPanel should prioritize patching their systems to mitigate potential risks.
A phishing campaign named VENOMOUS#HELPER has been targeting over 80 organizations since at least April 2025. The attackers exploit legitimate Remote Monitoring and Management (RMM) tools, specifically SimpleHelp and ScreenConnect, to gain ongoing remote access to compromised systems. Most of the affected organizations are based in the United States. This type of attack is concerning because it allows attackers to maintain control over their targets, potentially leading to data breaches or further exploitation. Organizations need to be vigilant about phishing attempts and ensure that their RMM tools are secured against unauthorized access.
Trellix, a cybersecurity firm, recently reported a breach of its source code repository. Although the company is conducting a thorough investigation, they have not found any evidence that this incident has affected their source code release or distribution processes. This means that, at least for now, their products and services remain secure from any potential vulnerabilities that could arise from the breach. The implications of such a breach can be significant, as access to source code can provide attackers with insights that could be used to exploit systems or develop malicious software. Trellix is reassuring its clients that their security measures are intact, but the situation serves as a reminder of the ongoing risks associated with software development and source code management.
Hackread – Cybersecurity News, Data Breaches, AI and More
At the Wiz ZeroDay.Cloud event, researchers disclosed significant vulnerabilities in PostgreSQL that have existed for 20 years. These flaws, particularly in the pgcrypto module, could allow attackers to exploit the database's security, raising serious concerns for organizations relying on PostgreSQL for data management. The researchers emphasized the urgency of applying patches to mitigate these risks and protect sensitive information. With many systems still using outdated versions, companies should prioritize updating their PostgreSQL installations to safeguard against potential attacks. This incident serves as a stark reminder of the importance of regular security audits and timely updates in maintaining database integrity.
CISA has issued a warning that the 'Copy Fail' vulnerability in Linux systems is being actively exploited by attackers. This flaw was disclosed just one day prior by researchers from Theori, who also released a proof-of-concept exploit. The vulnerability allows attackers to gain root access to compromised Linux systems, putting a wide range of users and organizations at risk. System administrators and users of affected Linux distributions need to take immediate action to secure their systems against potential exploits. The rapid exploitation following the disclosure highlights the urgency for organizations to patch their systems as soon as possible.
SonicWall has issued firmware updates to address three vulnerabilities that could be exploited by attackers, particularly ransomware groups. These flaws affect certain models of SonicWall firewalls, and experts are warning that unpatched devices may quickly become targets for exploitation. Users of SonicWall products are urged to apply the updates as soon as possible to protect their systems. The swift response from SonicWall indicates the seriousness of these vulnerabilities and the potential risks associated with leaving them unaddressed. Organizations relying on SonicWall firewalls should prioritize these updates to avoid falling victim to cyberattacks.
A recent supply chain attack has targeted four SAP npm packages, embedding malware designed to steal user credentials. This incident is part of a broader campaign known as mini Shai-Hulud, which researchers have linked to a group of attackers aiming to exploit vulnerable software components. Organizations that rely on these SAP packages for their applications could be at risk, as the compromised packages can put sensitive information in jeopardy. Users are advised to review their systems for these packages and take appropriate measures to secure their credentials. The incident highlights ongoing vulnerabilities in software supply chains and the importance of vigilance in software management.
Ryan Goldberg from Georgia and Kevin Martin from Texas have both been sentenced to four years in prison for their involvement with a ransomware gang. These two security experts were found to have assisted the group in their criminal activities, which included targeting various organizations and demanding ransom payments. The case sheds light on the growing issue of insider threats in the cybersecurity field, where individuals with technical knowledge exploit their skills for malicious purposes. Their sentencing serves as a warning to others in the industry about the consequences of engaging with cybercriminals. This incident also raises concerns about trust in security professionals and the ongoing battle against ransomware attacks.
A researcher from Theori, a security firm, has discovered a nine-year-old vulnerability in the Linux kernel using artificial intelligence tools. This flaw could potentially allow attackers to exploit systems running affected versions of the Linux kernel, putting many users and organizations at risk. The vulnerability's age raises concerns about how long it has gone unnoticed and the implications for systems that rely on Linux for their operations. As Linux is widely used across various platforms, including servers and embedded systems, this discovery highlights the need for ongoing vigilance in software security. Users and administrators are encouraged to review their systems and apply any available patches to mitigate the risk associated with this vulnerability.
Ryan Goldberg and Kevin Martin, both former incident responders, have been sentenced to four years in prison for their involvement in a series of ransomware attacks against five companies in 2023. The duo extorted nearly $1.3 million from one of their victims, showcasing a troubling trend where individuals with cybersecurity expertise turn to criminal activities. This case raises concerns about trust within the cybersecurity community and highlights the ongoing risks of ransomware, which continues to threaten businesses across various sectors. The sentencing serves as a reminder that those who exploit their knowledge for malicious purposes will face serious consequences.
A new phishing kit called Bluekit has emerged, featuring over 40 templates designed to target well-known online services. This kit stands out because it also includes basic AI capabilities that help users create phishing campaign drafts more efficiently. This means that even those with limited technical skills can launch sophisticated phishing attacks, increasing the risk for individuals and organizations. The availability of such tools makes it easier for cybercriminals to exploit unsuspecting users, potentially leading to data breaches and financial losses. As these tools become more accessible, companies and users need to be more vigilant about phishing attempts and enhance their security measures to protect sensitive information.
A new vulnerability known as 'Copy Fail' has been identified in Linux kernels released since 2017. This flaw allows local, unprivileged attackers to escalate their privileges and gain root access to affected systems. Researchers have published an exploit for this vulnerability, raising concerns about its potential for misuse. Major Linux distributions are at risk, which could allow attackers to take control of sensitive systems. Users of these systems should be aware of the threat and take steps to secure their environments.
A serious vulnerability (CVE-2026-41940) affecting cPanel, a widely used web hosting control panel, has been exploited by attackers for several months before a patch was released. This authentication bypass flaw has been in active use since at least February 23, 2026, with indications that it may have been abused even earlier. The vulnerability primarily impacts users of cPanel, which is often provided by shared hosting services. The delay in addressing this issue raises concerns about the security of web hosting environments and the potential for unauthorized access to sensitive data. Companies using cPanel are urged to apply the latest security updates as soon as possible to mitigate risks associated with this exploit.
The UK’s public education sector has seen a significant rise in cyber breaches over the past year, even as the overall national threat levels remain stable. This surge in attacks is particularly concerning because it affects schools, colleges, and universities, which often hold sensitive personal data of students and staff. Researchers indicate that these incidents can disrupt educational operations and compromise the privacy of those involved. The increase in cyber incidents poses serious risks not only to the institutions themselves but also to the broader community as attackers may exploit stolen data for malicious purposes. Addressing these vulnerabilities is crucial to protect both educational resources and personal information.
Hackers are taking advantage of two vulnerabilities in the Qinglong task scheduler, which is an open-source tool used by developers. These vulnerabilities allow attackers to bypass authentication, leading to unauthorized access. Once inside, the hackers deploy cryptominers on the affected servers, which can significantly drain resources and potentially compromise sensitive data. This situation poses a severe risk to developers and organizations using Qinglong, as it not only affects system performance but also raises concerns about data security. Users of this tool should take immediate action to secure their systems to prevent exploitation.