Daily · 2026-05-01
🚨 cPanel Zero-Day Active Exploitation, 🪵 Copy Fail Linux Root, 🔗 Mini Shai-Hulud Supply Chain
CISA has added the cPanel authentication bypass (CVE-2026-41940) to its KEV list as active exploitation and a public PoC accelerate the threat to ~1.5M exposed instances. A new Linux kernel flaw (Copy Fail, CVE-2026-31431) grants reliable root access on every distro since 2017. The TeamPCP supply chain campaign has expanded to SAP npm packages with 1,800 confirmed victims.
The SHADOW-EARTH-053 campaign is the day's defining story. Trend Micro tracked this China-aligned intrusion set hitting government and critical-infrastructure networks across Asia since December 2024, with a NATO member also in scope. Initial access comes from older Microsoft Exchange and IIS flaws including the ProxyLogon chain, followed by GODZILLA web shells for persistence and ShadowPad staged through DLL sideloading of signed executables. It is a reminder that unpatched Exchange servers remain a working espionage on-ramp years after disclosure.
Cordial Spider and Snarky Spider, two groups tied to The Com, are running Scattered Spider-style voice phishing against US organizations across academia, aviation, retail, hospitality, financial services, legal, and technology since at least October 2025. They harvest credentials and session tokens from identity platforms, move through SaaS environments, and extort seven-figure ransoms. Separately, Securonix detailed Deep#Door, a Python backdoor that disables Defender, AMSI, and ETW before establishing persistence through every mechanism available.
AI ecosystems are now a distribution channel. Unit 42 found 18 malicious Chrome extensions masquerading as AI productivity tools, including an MCP-themed RAT and an extension that exfiltrates Gmail content including OTPs. Acronis found roughly 600 malicious skills on ClawHub and malware hosted on Hugging Face, and a campaign tied to BufferZoneCorp is poisoning GitHub Actions through malicious Ruby gems and Go modules.
Watchlist: remove unapproved browser extensions, vet dependencies introduced in CI pipelines, rotate exposed credentials, and confirm Exchange servers are patched or disconnected.