VulnHub

At the Wiz ZeroDay.Cloud event, researchers disclosed significant vulnerabilities in PostgreSQL that have existed for 20 years. These flaws, particularly in the pgcrypto module, could allow attackers to exploit the database's security, raising serious concerns for organizations relying on PostgreSQL for data management. The researchers emphasized the urgency of applying patches to mitigate these risks and protect sensitive information. With many systems still using outdated versions, companies should prioritize updating their PostgreSQL installations to safeguard against potential attacks. This incident serves as a stark reminder of the importance of regular security audits and timely updates in maintaining database integrity.

CISA has issued a warning that the 'Copy Fail' vulnerability in Linux systems is being actively exploited by attackers. This flaw was disclosed just one day prior by researchers from Theori, who also released a proof-of-concept exploit. The vulnerability allows attackers to gain root access to compromised Linux systems, putting a wide range of users and organizations at risk. System administrators and users of affected Linux distributions need to take immediate action to secure their systems against potential exploits. The rapid exploitation following the disclosure highlights the urgency for organizations to patch their systems as soon as possible.

In April 2026, Sistemi Informativi, an IBM Italy subsidiary responsible for IT infrastructure management for various public and private institutions, suffered a significant breach. This incident is believed to be linked to the Chinese cyber operation known as Salt Typhoon. The breach raises alarms about the vulnerability of European digital defenses, especially as it targets a company managing critical infrastructure. The attack underscores the ongoing risks posed by state-sponsored cyber activities and highlights the need for enhanced cybersecurity measures across Europe. Organizations that rely on Sistemi Informativi for IT services may face increased risks as a result of this incident, prompting a review of their security protocols and defenses.

Recent reports have identified vulnerabilities in the EnOcean SmartServer IoT platform that could allow attackers to remotely compromise smart buildings, data centers, and factories. The issues are tied to a security bypass flaw (CVE-2026-22885) and a remote code execution vulnerability (CVE-2026-20761). These vulnerabilities affect instances of the EnOcean SmartServer that are exposed to the internet, making them susceptible to remote exploitation. This situation raises significant concerns for organizations relying on this technology, as it could lead to unauthorized access and control over critical infrastructure. Companies using EnOcean SmartServer should take immediate action to secure their systems against potential attacks.

SonicWall has issued firmware updates to address three vulnerabilities that could be exploited by attackers, particularly ransomware groups. These flaws affect certain models of SonicWall firewalls, and experts are warning that unpatched devices may quickly become targets for exploitation. Users of SonicWall products are urged to apply the updates as soon as possible to protect their systems. The swift response from SonicWall indicates the seriousness of these vulnerabilities and the potential risks associated with leaving them unaddressed. Organizations relying on SonicWall firewalls should prioritize these updates to avoid falling victim to cyberattacks.

A serious vulnerability has been discovered in cPanel, a popular web hosting control panel, allowing attackers to bypass login credentials and gain root access to servers. This flaw has been actively exploited before any patches were released, putting many web hosting providers and their clients at risk. The vulnerability affects users of cPanel, particularly those running outdated versions of the software. With root access, attackers could manipulate server settings, steal sensitive data, or take the server offline, which could lead to significant operational and financial consequences for affected companies. It is crucial for users to update their systems as soon as patches become available to mitigate these risks.

Three individuals have been arrested in connection with a significant hacking incident involving over 610,000 stolen Roblox accounts. The suspects are accused of distributing malware that allowed them to gain unauthorized access to users' accounts and then selling that access on Russian online marketplaces. This breach not only puts the affected users at risk of losing their personal information and in-game assets but also raises broader concerns about online security and the vulnerability of gaming platforms. The incident highlights the necessity for stronger cybersecurity measures to protect user accounts, especially in popular online environments like Roblox, where many young users are active.

A serious vulnerability (CVE-2026-41940) affecting cPanel, a widely used web hosting control panel, has been exploited by attackers for several months before a patch was released. This authentication bypass flaw has been in active use since at least February 23, 2026, with indications that it may have been abused even earlier. The vulnerability primarily impacts users of cPanel, which is often provided by shared hosting services. The delay in addressing this issue raises concerns about the security of web hosting environments and the potential for unauthorized access to sensitive data. Companies using cPanel are urged to apply the latest security updates as soon as possible to mitigate risks associated with this exploit.

A recently discovered flaw in the Gemini command-line interface (CLI) has raised significant security concerns. This vulnerability allows attackers to create malicious configurations that could execute commands outside of the intended sandbox environment. This means that attackers could potentially gain control of host systems, leading to serious risks such as supply chain attacks. Companies using Gemini CLI should be particularly vigilant, as this flaw could affect various applications and services relying on this tool. The implications are severe, as unauthorized command execution could compromise sensitive data and system integrity.

Researchers at Claroty have identified two serious vulnerabilities in the EnOcean SmartServer, a device commonly used in building automation systems. These flaws allow attackers to bypass security measures and execute code remotely, potentially giving them control over various building functions. This is particularly concerning as such systems manage critical infrastructure like lighting, heating, and security. The vulnerabilities could affect a wide range of buildings that rely on SmartServer technology, making it imperative for affected organizations to take immediate action. Without proper remediation, these weaknesses could lead to unauthorized access and significant operational disruptions.

A serious authentication bypass vulnerability identified as CVE-2026-41940 has been discovered in cPanel, WHM, and WP Squared. This flaw has been actively exploited by attackers since late February, allowing unauthorized access to systems using these platforms. cPanel and WHM are widely used web hosting control panels, making this issue particularly concerning for hosting providers and website owners. Users of affected systems should take immediate action to secure their environments, as the vulnerability poses a significant risk to sensitive data and system integrity. As proof-of-concept (PoC) code is now available, the potential for widespread exploitation increases, underscoring the urgency for users to address this vulnerability promptly.