A nine-year-old Linux kernel flaw (CVE-2026-31431, “Copy Fail”) allows any local user to corrupt page cache data and quickly escalate to root. Researchers published a tiny proof-of-concept, making the risk acute for multi-tenant servers, CI/CD runners, and Kubernetes nodes. Patch immediately or apply vendor mitigations (e.g., disabling affected algif modules) and restrict untrusted local access.
Source: Ars Technica
Critical cPanel & WHM auth bypass exploited as a zero-day for months
A high-severity authentication bypass in cPanel & WHM (CVE-2026-41940) has been under active exploitation, granting attackers administrative control over servers managing millions of domains. Emergency patches are available; prioritize updates, rotate credentials and API tokens, and review access logs for anomalous logins and privilege changes.
Source: SecurityWeek
Supply-chain attack ‘Mini Shai-Hulud’ hits SAP, Lightning, Intercom npm ecosystems
Malicious npm releases slipped a preinstall hook to fetch and run a Bun binary, enabling credential theft and evasion of monitoring. At least 1,800 downloads were impacted across packages with nearly 10 million monthly pulls, underscoring how quickly poisoned builds propagate. Audit recent builds for suspicious lifecycle scripts, rotate developer tokens, and pin trusted package versions with integrity checks.
Source: SecurityWeek
Gemini CLI CVSS 10 flaw enabled host code execution; patch may break CI/CD
Google fixed a maximum-severity vulnerability in Gemini CLI and its GitHub Action that allowed attackers to execute commands on build hosts via malicious configuration. The remediation can disrupt headless and pipeline workflows—teams should update pinned actions, review trust boundaries for config files, and add sandboxing and allowlists around AI tooling in CI.
Source: The Register
Hugging Face and ClawHub abused to push malware via social engineering
Threat actors are seeding projects and lures that trick users into downloading files containing malicious instructions, turning popular AI repos and hubs into delivery channels. Only run code from verified publishers, inspect model and dataset artifacts, disable auto-execution, and enforce network egress controls to catch covert exfiltration from data science machines.
Source: SecurityWeek
FBI: Hackers are hijacking cargo by breaching brokers and carriers
Criminals are breaking into logistics platforms and email accounts to impersonate legitimate firms, post fraudulent load listings, and divert freight—netting millions. Logistics and supply-chain orgs should enforce MFA on TMS/portal access, monitor for credential stuffing and account changes, verify dispatches via out-of-band callbacks, and harden broker-carrier onboarding workflows.
Source: SecurityWeek
Krebs: Anti-DDoS company linked to botnet blasting Brazilian ISPs
A Brazilian anti-DDoS provider allegedly enabled a botnet behind massive attacks on local network operators; the CEO claims their infrastructure was abused following a breach. The case highlights due-diligence gaps in third-party security providers—ISPs should continuously validate scrubbing-center traffic, require provider telemetry and attestations, and maintain independent DDoS visibility.
Source: KrebsOnSecurity
You May Also Be Interested In...
CISA adds ConnectWise, Microsoft flaws to KEV catalog
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft