WEEKLY INTELLIGENCE BRIEFING

Critical cPanel authentication bypass under mass exploitation. CVE-2026-41940 affects all cPanel/WHM versions and is being actively exploited to deploy Sorry ransomware, with at least 44,000 instances compromised since February.

Linux kernel privilege escalation vulnerability weaponized. CVE-2026-31431 ("CopyFail") enables unprivileged users to gain root access across all major Linux distributions and has been added to CISA's Known Exploited Vulnerabilities catalog.

SonicWall firewall vulnerabilities require immediate patching. Three flaws including CVE-2026-0204 (high-severity access control bypass) affect Gen 6, 7, and 8 firewalls.

Key Takeaway

Patch cPanel/WHM and Linux systems immediately, as both vulnerabilities have public exploits and confirmed active exploitation.

SAP npm packages compromised in Mini Shai-Hulud attack. Four official SAP packages with 500,000+ weekly downloads were injected with credential-stealing malware that harvests GitHub tokens and cloud secrets.

PyTorch Lightning and Intercom packages poisoned. TeamPCP threat actors compromised PyTorch Lightning versions 2.6.2 and 2.6.3 on PyPI, plus Intercom packages on npm and Packagist, to steal developer credentials automatically on import.

Hugging Face and ClawHub abused for malware distribution. Threat actors uploaded nearly 600 malicious AI skills to ClawHub and poisoned files to Hugging Face, distributing trojans and infostealers via trusted AI platforms.

Key Takeaway

Implement package integrity verification and monitor for unexpected network activity during development builds and AI model deployments.

Two US cybersecurity experts sentenced for BlackCat ransomware. Ryan Goldberg and Kevin Martin received 4-year prison sentences for conducting ALPHV/BlackCat ransomware attacks while working at incident response firms, extorting $1.2 million from victims.

30,000 Facebook accounts compromised via Google AppSheet. Vietnamese-linked AccountDumpling operation abused Google AppSheet and Drive to bypass email filters and steal Facebook Business credentials through sophisticated phishing campaigns.

French government agency breached by 15-year-old. A minor allegedly stole 11.7 million records from France Titres (ANTS), the national documents agency, and sold the data on cybercrime forums.

Liberty Mutual Insurance targeted by Everest ransomware. The major US insurer with $50 billion revenue was claimed as a victim by the Everest ransomware group.

Key Takeaway

Implement insider threat monitoring and OAuth/SSO security controls, as attacks increasingly exploit trusted relationships and legitimate services.

Silk Typhoon-linked hacker extradited to US. A suspected member of the Chinese state-sponsored threat group was extradited from Europe to face cyberespionage charges.

Deep#Door backdoor enables persistent espionage. Python-based framework deploys Windows implants with advanced evasion, surveillance capabilities, and destructive MBR overwriting functions.

Key Takeaway

Monitor for Python-based persistence mechanisms and unusual AMSI/ETW patching activity in enterprise environments.

FBI warns of cyber-enabled cargo theft surge. Losses reached $725 million in 2025, a 60% increase, as threat actors compromise freight brokers and carriers to steal high-value shipments.

Canonical and Ubuntu under DDoS attack. The 313 Team claimed responsibility for distributed denial-of-service attacks against Ubuntu's infrastructure.

AI agent deleted production database in 9 seconds. PocketOS incident highlights risks of over-permissioned autonomous AI systems with insider-level access.

Key Takeaway

Implement least-privilege access controls for AI agents and secondary verification for destructive operations.

Bluekit phishing kit includes AI assistant. Advanced phishing-as-a-service platform offers 40+ templates, automated domain registration, AI-powered campaign drafting, and anti-analysis evasion.

ConsentFix v3 automates OAuth abuse against Azure. Evolved attack technique uses Pipedream serverless platform to automatically exchange stolen OAuth authorization codes for refresh tokens.

Key Takeaway

Monitor OAuth consent flows and implement conditional access policies to detect automated phishing attempts.

• https://www.bleepingcomputer.com/news/security/critrical-cpanel-flaw-mass-exploited-in-sorry-ransomware-attacks/
• https://www.wired.com/story/dangerous-new-linux-exploit-gives-attackers-root-access-to-countless-computers/
• https://www.securityweek.com/sap-npm-packages-targeted-in-supply-chain-attack/
• https://www.bleepingcomputer.com/news/security/us-ransomware-negotiators-get-4-years-in-prison-over-blackcat-attacks/
• https://hackread.com/google-appsheet-facebook-accountdumpling-scam/
• https://www.securityweek.com/fbi-warns-of-surge-in-hacker-enabled-cargo-theft/
• https://www.bleepingcomputer.com/news/security/new-bluekit-phishing-service-includes-an-ai-assistant-40-templates/
• https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog