🔧 cPanel CVE-2026-41940 bypass fueling Mirai botnet surge, 🕳️ GitLab CVSS 10.0 traversal still probed internet-wide, 🇰🇵 WaterPlum fake-recruiter hit 30k devices for $10.7M, 📦 indexed-btree npm malware runs at runtime with Sepolia C2, 🤖 BragJack extension hijacks AI browser assistants, 🖼️ HEIF Heist RCE across Meta, Slack, GitHub Enterprise

The day's defining development is cPanel: the CVE-2026-41940 authentication bypass (CVSS 9.8), a CRLF injection that plants user=root in session files to defeat the whostmgrsession cookie encryption, has moved from patch note to active campaign. Today's reporting documents hackers abusing the bypass to compromise hosting servers, and JPCERT/CC's TSUBAME sensors show the compromise feeding directly into Mirai-like botnet activity, with scanning and brute-force traffic on TCP 23 surging from IPs at cPanel hosting providers. The flaw was exploited as a zero-day from roughly February 23, watchTowr has a working PoC, Shodan counts about 1.5 million exposed instances, and the patch never ships automatically: admins must run /usr/local/cpanel/scripts/upcp by hand. If you operate shared hosting or a VPS panel, verify the patch today and audit sessions for the injection pattern.

[UPDATE] Ten days after disclosure, GitLab's CVE-2026-85706 is still drawing internet-wide scanning and exploitation: the CVSS 10.0 path traversal lets unauthenticated attackers read any file on self-managed servers, was exploited within hours of the patch, and Censys counts more than 86,000 exposed instances against 22 sources of coverage. It ships alongside CVE-2026-87719 in the same release. Unpatched self-managed GitLab is the single easiest file-read on the internet right now.

[NEW] A joint advisory from four countries attributes a sprawling campaign to North Korea's WaterPlum: at least 30,000 devices compromised worldwide between December 2025 and July 2026 and over $10.7 million in cryptocurrency stolen, delivered through fake recruiter interviews and coding tests. The 30,000-device estate is infrastructure for future operations, not just a theft tally; treat any unsolicited coding assessment as hostile input.

[NEW] The TanStack npm compromise keeps cascading: CrowdSec disclosed that the May Shai Hulud backdoor (42 packages, attributed to TeamPCP/UNC6780) yielded a former employee's GitHub OAuth token, which the attacker used on May 22 to clone roughly 170 private CrowdSec repositories, then published the archive on a breach forum on September 16. Internal source code, SaaS console components and limited contact data are exposed; production systems were untouched. The four-month gap between theft and leak was rotation time, but source exposure is permanent. Scope your OAuth tokens accordingly.

[NEW] npm supply-chain malware has learned to dodge install-script scanning: the indexed-btree package, near 2 million weekly downloads and impersonating sorted-btree, does nothing at install time and only detonates when application code calls BTree.set() with a specific key. Its C2 is an Ethereum Sepolia smart contract, so there is no infrastructure to take down; Checkmarx notes the attackers' wallet holds 109 ETH. Audit dependencies for unexpected on-chain calls from BTree operations.

[NEW] BragJack is a new architectural attack on AI browsers: researcher Gal Weizman showed a single malicious extension can hijack the built-in AI assistants of Chrome, Edge, Opera Neon, Perplexity Comet and Claude in Chrome by forging the trusted internal channel between the cloud decision component and the privileged local executor, no prompt injection required, yielding unauthorized commands and browser-level data access. Tracked as CVE-2026-0628 and CVE-2026-55945, with bounties paid by all five vendors. Any cloud-plus-local agent design is in scope of this bug class.

[NEW] Hacktron's HEIF Heist research details memory-corruption bugs in libheif and libde265 that turn crafted HEIF, HEIC or AVIF uploads into heap disclosure or RCE, demonstrated against Meta, Slack and GitHub Enterprise and riding past MIME and filename filtering inside ordinary image files. No public CVEs are assigned, so patches lag awareness; if your stack accepts these formats, check which decoder version you actually run.

[UPDATE] WordPress 7.1.1, released September 17, is the fix for Click2Shell, today's follow-up reporting confirms the chain works with a single click: a crafted theme parameter breaks out of a jQuery selector in wp-admin, auto-installs an attacker-chosen theme, and the Customizer loads its functions.php, chaining into a nonce-less AJAX plugin installer in the Mobile Repair Zone 2.5.4 theme for full PHP execution. Update core and audit third-party themes that bundle their own plugin installers.

[NEW] Exim 4.100.1, shipped September 18, patches four vulnerabilities including an out-of-bounds heap write in Proxy Protocol v1 handling (Exim 4.83 through 4.100), a use of uninitialized data in Proxy Protocol v2, and an SMTP smuggling flaw affecting every version through 4.100 that lets injected messages impersonate the mail server itself and bypass spam filtering. None are confirmed exploited yet, but this class weaponizes fast once PoCs land; patch the MTA this week.

[NEW] SentinelOne attributes a breach of an India-based IT services provider to Jade Sleet, DPRK's TraderTraitor cluster: two Rust macOS/ARM64 backdoors, FLATROFT-style Telegram C2 and a Nostr dead-drop variant, planted on an Apple Silicon DevOps machine via a fake job interview with weaponized Terraform lock files, then used in the $292M KelpDAO bridge theft. The same lure kit is hitting multiple targets; Macs in engineering orgs are the intended victim profile.

[UPDATE] OpenAI's Codex desktop agent fell to two sandbox escapes now patched within eight days of August 12 disclosure: Heapjack turns opening someone else's repository into unsandboxed command execution on the developer's machine with no prompt, and Overpatch defeats read-only mode write restrictions, both via the node_repl component written into ~/.codex/config.toml that CLI users inherit. Treat AI coding agents with a CI/CD-grade threat model; sandbox promises are implementation-specific.

[NEW] Law enforcement made one of its periodic infrastructure dents: the FBI and RCMP seized the domains of NightmareStresser, a DDoS-for-hire service tied to hundreds of thousands of attacks renting for a few dollars. Expect reconstitution under new domains within days, but the customer lists from these seizures keep feeding later prosecutions.

[NEW] CISA's KEV catalog added a second batch of Linux kernel flaws under active exploitation: CVE-2025-39682, the CVE-2025-39964 race condition and CVE-2026-53266, with a two-day federal patching deadline, following the kTLS, ebtables and AF_ALG additions flagged late last week. Sustained targeting of kernel attack surface is now a pattern, not an event; get these into the same patch cycle as your perimeter gear.

Watchlist: confirm the manual cPanel upcp patch and hunt Mirai-linked brute-force origins on every hosting box, close the GitLab path traversal on all 86,000-plus exposed instances, upgrade Exim to 4.100.1 before SMTP smuggling gets a PoC, patch WordPress to 7.1.1 and sweep themes for embedded plugin installers, audit npm trees for indexed-btree and BTree.set() triggers, and scope GitHub OAuth tokens before the next Shai Hulud-class backdoor turns them into repository exfiltration.

Generated by zai/glm-5.3-flash. Input tokens: 35,087, output tokens: 8,654, cache read: 526,848, cache write: 0.