cPanel/WHM Authentication Bypass Leads to Mass Exploitation — Over 40,000 Servers Compromised
Summary A critical authentication bypass vulnerability in cPanel and WebHost Manager (WHM), tracked as CVE-2026-41940 (CVSS 9.8), has been aggressively exploited in the wild, with confirmed compromises of over 40,000…
ShinyHunters Exploits Oracle PeopleSoft Zero-Day to Breach 100+ Universities
Summary ShinyHunters — the prolific data-theft and extortion group tracked by Mandiant as UNC6240 — has exploited a critical zero-day vulnerability in Oracle PeopleSoft to breach more than 100 organizations,…
MS-ISAC Hemorrhages 70% of Members After Federal Funding Cut — Thousands of Jurisdictions Left Exposed
Summary The Multi-State Information Sharing and Analysis Center (MS-ISAC), a cornerstone of US state and local government cybersecurity defense, has lost roughly 70% of its membership after the Department of…
Palo Alto GlobalProtect VPN Auth Bypass Under Active Exploitation — CVE-2026-0257 Upgraded to Critical
Summary Palo Alto Networks has confirmed active exploitation of CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect VPN. The flaw lets unauthenticated attackers forge authentication override cookies to establish unauthorized…
Miasma Supply Chain Worm Compromises 73 Microsoft GitHub Repos and Expands to PyPI in Aggressive Campaign
Summary The Miasma supply chain worm — an evolved variant of the Mini Shai-Hulud worm family — has dramatically expanded its reach beyond the initial Red Hat NPM compromise. On…
Check Point VPN Zero-Day Exploited by Qilin Ransomware Since May — CVE-2026-50751 Hits CVSS 9.3
Summary A critical authentication bypass vulnerability in Check Point’s Remote Access VPN and Mobile Access products, tracked as CVE-2026-50751 (CVSS 9.3), has been actively exploited in the wild since at…
Google Patches Fifth Chrome Zero-Day of 2026 — V8 Engine Flaw CVE-2026-11645 Actively Exploited
Summary Google has released an emergency update for Chrome to address CVE-2026-11645, an actively exploited zero-day vulnerability in the V8 JavaScript and WebAssembly engine. The flaw is an out-of-bounds read…
Microsoft’s Record-Breaking June 2026 Patch Tuesday — 200+ Flaws and 6 Zero-Days Patched
Summary Microsoft dropped a massive June 2026 Patch Tuesday, addressing over 200 security vulnerabilities across its product line — one of the largest patch cycles in the company’s history. Among…
Anthropic Suspends Fable 5 and Mythos 5 Worldwide After U.S. Export Control Directive
Summary Anthropic says the U.S. government issued an export control directive ordering the company to suspend access to Fable 5 and Mythos 5 for any foreign national, inside or outside…
Velvet Ant’s Operation Highland Shows How Attackers Weaponized PAM and SSH for Long-Term Persistence
Summary Sygnia’s new Operation Highland report describes a China-nexus Velvet Ant intrusion that maintained access inside an internal network for nearly a decade, with forensic artifacts dating back to 2016.…