⚡ Weekly Recap: AI-Powered Phishing, Android Spying Tool, Linux Exploit, GitHub RCE & More

Summary: A critical cPanel and WebHost Manager flaw tracked as CVE-2026-41940 is under active exploitation, allowing authentication bypass and remote attackers to gain elevated control of the control panel, with some attacks wiping entire websites and backups and others deploying Mirai botnet variants and a ransomware strain called Sorry. The weekly recap also lists CVE-2026-31431 (Copy Fail) in the Linux kernel, CVE-2026-3854 in GitHub.com and GitHub Enterprise Server, CVE-2026-42208 in LiteLLM, CVE-2026-26268 in Cursor, and CVE-2026-35414 in OpenSSH among the week's high-severity or actively probed vulnerabilities.
Why it matters: The cPanel attacks did not stop at access: some wiped entire websites and their backups, and others installed Mirai botnet variants or the Sorry ransomware, so recovery depends on backups the attacker cannot reach.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-41658 CVE-2025-41659 CVE-2025-41660 CVE-2026-0204 CVE-2026-23627 CVE-2026-24487 CVE-2026-24908 CVE-2026-26268 CVE-2026-3008 CVE-2026-31431 CVE-2026-32202 CVE-2026-35414 CVE-2026-3854 CVE-2026-40684 CVE-2026-40685 CVE-2026-40686 CVE-2026-40687 CVE-2026-41940 CVE-2026-42167 CVE-2026-42208 CVE-2026-42511 CVE-2026-42520 CVE-2026-42523 CVE-2026-42524 CVE-2026-5402 CVE-2026-5403 CVE-2026-5405 CVE-2026-5656 CVE-2026-6100 CVE-2026-6770 CVE-2026-6807 CVE-2026-7322 CVE-2026-7323 CVE-2026-7324 CVE-2026-7343 CVE-2026-7344 CVE-2026-7361 CVE-2026-7363
Related: [remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE Cyber Risks · Aug 25, 2026
CVE-2026-42208: Berri AI LiteLLM SQL Injection Vulnerability Known Exploited Vulnerabilities · May 08, 2026
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Known Exploited Vulnerabilities · May 01, 2026