Daily · 2026-05-23
🚨 LiteSpeed cPanel 0-Day, 🎯 Laravel-Lang Supply Chain, 🇳🇱 NL Server Seizure, 🏦 UNC2891 ATM Hack, 🇮🇷 Iranian APTs, ⚽ World Cup Phishing
LiteSpeed cPanel plugin zero-day (CVE-2026-48172, CVSS 10.0) actively exploited for root on shared hosting. Laravel-Lang supply chain compromise backdoors 700+ package versions with a 17-module credential stealer. Netherlands seizes 800 servers linked to Russian sanctions evasion and NoName057(16). UNC2891 bank heist group planted a Raspberry Pi at an ATM. Two major Iranian APT reports (Nimbus Manticore, Screening Serpens) detail new AI-assisted malware and RATs. World Cup phishing infrastructure triples ahead of the tournament.
The LiteSpeed cPanel plugin zero-day is the day's defining story. CVE-2026-48172 lets any authenticated cPanel user execute arbitrary scripts as root through the lsws.redisAble endpoint, with active exploitation and no race condition or authentication bypass required. cPanel's forced fleet-wide uninstall shows the scale of the risk on shared hosting, and CISA's KEV listing gives federal agencies a near-term remediation deadline. LiteSpeed cPanel zero-day
The Laravel-Lang supply chain compromise weaponized four popular PHP localization packages by pointing release tags at malicious forks, so Composer installs pulled a backdoored helpers.php with a 17-module credential stealer without any commit ever touching the official repositories. Laravel-Lang attack
UNC2891's bank operations show the physical dimension: a 4G-enabled Raspberry Pi planted on an ATM network segment, paired with the CAKETAP Solaris rootkit to manipulate payment HSM messages. Ubiquiti's three maximum-severity UniFi OS flaws enable pre-auth compromise of widely deployed network appliances, and the SEO poisoning campaign impersonating Gemini CLI and Claude Code is a reminder that developer tools are now a primary phishing surface.
Watchlist: cPanel and LiteSpeed inventory, Composer lockfile review against the compromised packages, UniFi OS emergency patches, and vendor verification for developer tool downloads.