Daily · 2026-04-29
cPanel auth bypass 🔴, GitHub RCE vulnerability 🔧, LiteLLM exploitation in 36 hours ⚡, VECT wiper-not-ransomware 💀, Lazarus macOS malware 🍎, SAP supply-chain attack 📦
A critical cPanel/WHM authentication bypass (CVE-2026-41940, CVSS 9.8) requires emergency manual patching while a GitHub RCE (CVE-2026-3854) put millions of private repositories at risk. LiteLLM's pre-auth SQL injection was exploited within 36 hours of disclosure. VECT 2.0 ransomware permanently destroys files due to a cryptographic flaw, making payment futile. Lazarus Group targets macOS users with a new ClickFix-driven malware kit, and over 1,000 SAP npm packages are compromised in an active self-propagating supply-chain attack. Defense teams should audit OAuth grants to AI applications following the Vercel breach and verify ICS/OT remote access isn't internet-exposed.
The cPanel/WHM authentication bypass is the day's defining story. CVE-2026-41940 carries a CVSS 9.8 rating and lets an unauthenticated attacker reach the hosting control panel on every supported version except the latest, and the fix is not delivered through normal update channels: administrators must run the upcp script manually. Namecheap blocked cPanel ports at the network level to protect customers. A hosting control panel is the key to every site and mailbox on the box, making this the highest-value mass target of the week.
The GitHub RCE in the git push pipeline is the other critical disclosure. A single crafted push could have granted read and write access to private repositories on GitHub.com and Enterprise Server, and the fix shipped within two hours of Wiz's report. Separately, the LiteLLM SQL injection was exploited within 36 hours of disclosure, with attackers extracting API keys through the proxy's error-handling path. VECT 2.0 ransomware carries a nonce-handling flaw that corrupts files instead of encrypting them, so paying achieves nothing.
Two supply-chain threads deserve attention. The SAP npm campaign has passed 1,000 compromised repositories with a self-propagating strain that steals GitHub tokens from CI, and the Vercel breach shows the shadow OAuth risk of AI apps bridged to Google Workspace. Forescout counted 670 VNC servers exposing ICS and OT systems without authentication.
Watchlist: run the cPanel upcp fix, rotate CI tokens and audit SAP packages, inventory OAuth grants to AI apps, and take any internet-facing VNC or RDP off the edge.