🚨 cPanel 40K Servers Compromised, 🎓 Instructure 275M Records Breached, 💻 FreeBSD DHCP Root RCE, 🛡️ Microsoft Defender DigiCert False Positive, 📧 Teams Phishing 72% Success, 📦 MOVEit Auth Bypass

The cPanel compromise is the day's defining story. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog with a four-day federal patch deadline as confirmed victims passed 40,000 servers, and threat actors weaponized the public proof of concept within days to target government and military organizations across Southeast Asia, including the Philippine Coast Guard and the Lao Ministry of Defense. A commodity control-panel bug has become a mass-ownership event and a likely prelude to follow-on ransomware.

The Instructure breach is the second major item. ShinyHunters claims 275 million records and 3.65 TB of data across nearly 9,000 schools, including private messages between users, and the extortion pressure will land on institutions that often do not run dedicated security teams. The Mini Shai-Hulud SAP npm worm matters for a different reason: it self-replicates through stolen npm tokens and compromised GitHub accounts, and its credential collectors target AI coding assistant tokens alongside cloud and SSH keys.

The rest of the day is patch debt and tradecraft. The MOVEit Automation authentication bypass and privilege escalation pair, the FreeBSD DHCP client root RCE, and Qilin's use of PowerShell Event ID 1149 to harvest historical RDP credentials from Terminal Services logs are all actionable now. DigiCert's legitimate root certificates being pulled from the Windows trust store is collateral damage from a real code-signing compromise, a reminder that trust-chain failures cascade.

Watchlist: cPanel patch status on every exposed host, MOVEit and FreeBSD updates, and ScriptBlock logging coverage for the Qilin reconnaissance query.