🚨 ACTIVE EXPLOITATION
- Hackers exploit cPanel CVE-2026-41940 auth bypass to deploy Mirai malware on servers
CVE-2026-41940
Attackers are exploiting the cPanel/WHM authentication-bypass flaw CVE-2026-41940 to deploy Mirai malware on exposed hosting servers.- Affects cPanel and WHM deployments; CVE-2026-41940 lets unauthenticated attackers bypass login and gain administrative access.
- With admin access, attackers can alter settings, add malicious files, and turn servers into Mirai botnet footholds for probing, spreading, and DDoS traffic.
- JPCERT/CC observed a surge in Mirai-like packets targeting TCP port 23 (Telnet) starting April 30, with Japan traffic rising to roughly 15x prior levels.
- Many source addresses belonged to hosting providers running cPanel interfaces; the US had the largest traffic share, with spikes also in Germany, France, and Canada around May 1.
- JPCERT/CC notes monitoring alone cannot prove the infection path, but separate reporting ties the exploitation to Mirai or Mirai-variant activity.
🕵️ RESEARCH & DEEP DIVES
North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
North Korean-linked WaterPlum hackers posed as recruiters to infect 30,000 PCs and steal $10.7M in cryptocurrency.- Targets software developers contacted via social networks, job boards, gig sites and freelance marketplaces; campaign hit 30,000 computers in 100+ countries between December 2025 and July 2026.
- Attackers drained funds or credentials from over 7,000 cryptocurrency wallets, moving at least $10.7 million to North Korea.
- Fake recruiter interviews ask candidates to run malicious coding tasks or 'fix' interview software, delivering BeaverTail, InvisibleFerret, OtterCookie, OtterCandy or StoatWaffle.
- StoatWaffle hides in blockchain-themed projects and executes via a .vscode/tasks.json file when a victim trusts the folder in Visual Studio Code; operators also used AI face-swapping in video calls.
- Activity overlaps with North Korean IT-worker 'laptop farms' — Japan dismantled one, and shared IP addresses linked WaterPlum actors to laptop farms and a Japanese crypto exchange application.
EtherHiding malware hides C2 servers on Polygon blockchain to steal bank logins and 2FA codes
A ClickFix-style malware campaign uses Polygon smart contracts (EtherHiding) to host its command-and-control and a fake browser extension to steal bank and crypto credentials.- Targets visitors of at least 31 compromised legitimate websites across multiple industries and countries; active since at least November 2025.
- Steals bank logins and 2FA codes from roughly 479 financial and cryptocurrency sites via a fake browser extension acting as a banking trojan.
- Fake CAPTCHA overlay on Google/Bing search traffic tells victims to press Windows+R and paste a PowerShell command, creating a scheduled task named 'Enter' and registry persistence (PersonalizedUpdates).
- EtherHiding technique: the backdoor queries Polygon smart contracts (15 observed) for an encrypted C2 address, letting operators swap servers with a low-cost blockchain transaction and evade domain blocklists.
- Extension also supports keylogging, screen capture, video capture, and theft from password managers and crypto wallets; IOCs include C2 domains hivinest[.]online and 3262d48df5d75e34[.]shop, contract 0xde2d34339c279a7a79bc4fc1c4f37d3c055211b7, and wallet 0xd802C9427ce416B9DAb2db5aDD76EfAA6d9d826a.
Cache Key Injection Technique Enables Web Cache Poisoning and Restricted Data Access
Researchers demonstrated a cache key injection technique that lets attackers poison Nginx web caches, access restricted pages, and cause denial of service.- Affects websites using Nginx proxy caching, including setups fronted by Cloudflare CDNs.
- Attackers abuse cache keys built by concatenating request components (scheme, host, URI, Accept header) without separators, causing key collisions between legitimate and attacker-controlled requests.
- Key collisions can bypass access controls (e.g., serving cached /admin responses to external users), enable cache-poisoned denial of service (CPDoS) with cached 404s, and cause stored XSS via HTTP/HTTPS scheme confusion with a malicious Host header.
- With Cloudflare in front of Nginx, attackers can use an Authorization header to bypass the edge cache and poison the origin cache directly.
Three memory-safety bugs found in Godot's untrusted-file parsers; maintainers deny security impact
A researcher using an LLM agent found three memory-safety bugs in Godot 4.7's file parsers, which Godot maintainers declined to treat as security issues.- Affects Godot 4.7 and exported games that load community-authored files such as mods, downloads, or user uploads (.hdr images, binary .res resources, translation files).
- The bugs — two dating to Godot's 2014 open-sourcing and one to 2017 — allow maliciously crafted files to trigger out-of-bounds reads or writes inside the game process.
- The .hdr loader writes past the image buffer when file metadata exceeds reserved space; the .res loader mishandles a negative string length; the translation loader reads past buffers via a crafted index.
- Bugs were found by directing a Claude Code agent (Opus 4.8) to audit the Godot source; working PoCs crashed official release binaries.
- Godot maintainers say the bugs require attacker-controlled files and are ordinary memory-safety issues, not security issues; the researcher disputes this, citing 2021 TGA decoder CVEs (CVE-2021-26825/26826, CVSS 7.8).
MSNightmare Releases BigDiskBuster PoC That Blocks Microsoft Defender Updates via Disk Exhaustion
Security researcher MSNightmare has released BigDiskBuster, a proof-of-concept denial-of-service tool that stops Microsoft Defender Antivirus from completing its updates.- Applies to Microsoft Defender Antivirus on all supported Windows versions; the researcher claims broad compatibility, though the experimental code is buggy and unverified.
- Targets Defender's platform and security-intelligence update channels, causing update failures (observed error 0x80070643) while protection appears active but detection capability decays.
- Works by monitoring the C: volume for Defender update directories, then creating hidden delete-on-close temp files that claim all remaining free disk space, starving the installer of storage.
- Also opens MRT.exe with restrictive sharing permissions to lock the Malicious Software Removal Tool binary against write or delete access.
- Presented as a successor to the UnDefend project; the PoC is published on GitHub and has not been independently confirmed.
Sources 📄 Source: github.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- CISA Adds Three Exploited Linux Kernel Vulnerabilities to KEV Catalog
CISA added three actively exploited Linux kernel vulnerabilities to its KEV catalog, giving federal agencies three days to patch.- Applies to Linux kernel users; CISA requires federal agencies to patch all three flaws within three days.
- CVE-2025-39682 (CVSS 9.8): flaw in TLS receive path handling of zero-length records allows local attackers to cause DoS or memory disclosure.
- CVE-2025-39964 (CVSS 7.8): race condition in AF_ALG sockets lets concurrent writes corrupt socket state, causing crashes or corrupted crypto results.
- CVE-2026-53266 (CVSS 8.8): out-of-bounds write in ebtables SNAT target triggered by crafted ARP packets leads to memory corruption.
- CISA has not shared details on how the vulnerabilities are being exploited.
📋 ADVISORIES
📄 Source for RatHat Android banking Trojan uses AI to steal bank logins and reconstruct PINs — malwarebytes.com
📄 Source for OpenAI Codex sandbox flaws (Overpatch, Heapjack) let malicious repos run host commands — accomplish.ai
🔓 CVEs & KEV
- CVE-2026-15801 — Red Hat OpenShift Container Platform 4 — CVSS 8.0 — Cri-o: cri-o: insufficient validation during container checkpoint restoreA vu...