A newly disclosed architectural weakness in Windows Remote Procedure Call (RPC), dubbed PhantomRPC, allows local attackers to escalate to SYSTEM privileges. Despite the severe impact, Microsoft has declined to assign a CVE-ID and the status remains unpatched, as the vendor classifies it as a design-level behavior.
Vulnerability Details
Affected Product: Microsoft Windows and Windows Server (All versions)
Identifier: None assigned (No CVE-ID)
CVSS Score: N/A (Moderate Severity)
Exploitation Status: Proof-of-Concept available; not currently Actively Exploited
Risk & Impact
Triage: High priority for monitoring and mitigation, as no official patch is planned.
Attack Vector: A local attacker with specific privileges deploys a malicious RPC server mimicking an offline service, intercepting high-privileged client connections to escalate to SYSTEM.
Ease of Exploit: Moderate; requires prior local access and SeImpersonatePrivilege, but exploit paths are effectively unlimited.
Action Plan
Immediate Action: No patch available; maintain strict access controls and keep systems updated to the latest Version.
Workaround: Restrict SeImpersonatePrivilege assignments and avoid blindly disabling background services to prevent attackers from hijacking their RPC endpoints.
Detection: Monitor Event Tracing for Windows (ETW) for RPC_S_SERVER_UNAVAILABLE errors combined with anomalous high-level impersonation activity.
Relevant professional terms
Remote Procedure Call (RPC)
A protocol that allows a program to execute a procedure on another system or process without the programmer explicitly coding the network communication details.
SeImpersonatePrivilege
A Windows security privilege that allows a process to impersonate the security context of a client, often targeted by attackers to escalate privileges to SYSTEM.
cPanel has released an emergency update to address a critical authentication bypass vulnerability (CVE-2026-41940) affecting all supported versions of cPanel and WebHost Manager (WHM). The flaw, which allows unauthenticated remote attackers to gain unauthorized access to the control panel, is actively exploited in the wild and requires immediate remediation.
Vulnerability Details
Affected Product: cPanel & WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5
Identifier: CVE-2026-41940
CVSS Score: 9.3 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is highly recommended due to active in-the-wild exploitation and the critical severity of the flaw.
Attack Vector: Remote attackers can exploit a flaw in the login flow to bypass authentication and gain full administrative access to the control panel.
Ease of Exploit: Low complexity; no prior authentication or user interaction is required, making it highly exploitable.
Action Plan
Immediate Action: Execute the command /scripts/upcp --force as root to force an upgrade to a patched release (e.g., Version 11.136.0.5 or 11.134.0.20).
Workaround: Temporarily block external access to ports 2083 and 2087 (used for WHM and cPanel) until patches can be successfully applied.
Detection: Monitor access logs for unusual login patterns or unauthorized administrative actions, and verify the current system version using /usr/local/cpanel/cpanel -V.
Relevant professional terms
Authentication Bypass
A security vulnerability that allows an attacker to circumvent the login mechanism and gain unauthorized access to a system or application without valid credentials.
CVSS (Common Vulnerability Scoring System)
An industry-standard framework for rating the severity of software vulnerabilities on a 0-10 scale, used by security teams to prioritize patching and remediation efforts.
GitHub has addressed a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-3854, which could have allowed authenticated attackers to compromise millions of private repositories. The flaw was responsibly disclosed through a bug bounty program and is currently patched across GitHub’s cloud infrastructure, with critical updates available for Enterprise Server customers.
Vulnerability Details
Affected Product: GitHub Enterprise Server (versions prior to 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.8, 3.19.4, and 3.20.0) and GitHub Cloud platforms
Identifier: CVE-2026-3854
CVSS Score: 8.7 (High)
Exploitation Status: Not Actively Exploited (Discovered via Bug Bounty)
Risk & Impact
Triage: Critical urgency for GitHub Enterprise Server administrators
Attack Vector: Command injection via a single maliciously crafted git push command, exploiting improper sanitization of user-supplied push options in internal service headers
Ease of Exploit: Remarkably easy for any authenticated user with repository push access
Action Plan
Immediate Action: Upgrade GitHub Enterprise Server to Version 3.20.0 or other patched releases (e.g., 3.19.4, 3.18.8)
Workaround: No official workaround; applying the vendor patch is strictly required
Detection: Monitor git server logs for unusual or malformed git push option values containing unexpected special characters or delimiter sequences
Relevant professional terms
Remote Code Execution (RCE)
A severe security vulnerability that allows an attacker to execute arbitrary commands or code on a target machine or server over a network.
Command Injection
An attack in which the goal is the execution of arbitrary commands on the host operating system via a vulnerable application, typically due to insufficient input validation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated federal agencies to immediately patch CVE-2026-32202, a zero-click Windows vulnerability currently being actively exploited in the wild. This flaw allows attackers to steal NTLM hashes, facilitating lateral movement and unauthorized access across compromised networks.
Vulnerability Details
Affected Product: Microsoft Windows (Windows Shell)
Identifier: CVE-2026-32202
CVSS Score: 4.3 (Medium)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent - Patch immediately (CISA deadline: May 12, 2026).
Attack Vector: Zero-click NTLM hash leak; attackers steal NTLMv2 hashes when a user simply navigates to a folder containing a malicious file.
Ease of Exploit: Low complexity (Zero-click interaction).
Action Plan
Immediate Action: Apply the April 2026 Microsoft Patch Tuesday updates immediately.
Workaround: Restrict NTLM traffic or disable NTLM where possible to prevent relay and pass-the-hash attacks.
Detection: Monitor for anomalous NTLM authentication traffic, pass-the-hash attempts, and unauthorized lateral movement.
Relevant professional terms
Zero-Day
A software vulnerability that is exploited by attackers before the vendor has become aware of it or released a patch.
NTLM Hash
A cryptographic representation of a user’s password used by Microsoft’s NT LAN Manager authentication protocol, which can be stolen and used in pass-the-hash attacks.
Threat actors compromised core SAP npm packages with the “Mini Shai-Hulud” worm. The campaign targets enterprise developers and CI/CD pipelines to harvest cloud secrets.
Key TTPs
Initial Access: Malicious preinstall hooks in poisoned SAP npm packages.
Execution: A bootstrapper downloads the Bun runtime to execute an obfuscated JavaScript payload.
Defense Evasion: Bypasses egress filters using official GitHub URLs and aborts on Russian-locale systems.
Campaign Analysis
This attack highlights an evolution in supply chain threats by utilizing autonomous worm-like propagation. Exfiltrated data is encrypted, forcing defenders to assume total credential compromise.
Targeting & Infrastructure
Target Profile: Enterprise teams using SAP’s Cloud Application Programming Model.
Infrastructure: Exfiltrates data to attacker-created public GitHub repositories on victim accounts.
Relevant Terms
Preinstall Hook: A script that runs automatically before a software package finishes installing.
Dead-Drop: A covert data exchange method using a public location (like a GitHub repo) to hide stolen data.
North Korea’s BlueNoroff APT is targeting cryptocurrency executives using sophisticated social engineering. This financially motivated campaign leverages AI-generated avatars in fake Zoom meetings to deploy malware and steal digital assets.
Key TTPs
Initial Access: Multi-week social engineering via Calendly leading to typo-squatted Zoom URLs.
Execution: Victims are tricked into downloading malicious AppleScript via fake audio repair prompts.
Defense Evasion: Attackers use legitimate SDKs to spoof meeting UIs and deploy hidden files.
Campaign Analysis
BlueNoroff has established a self-reinforcing deepfake pipeline. By siphoning live webcam feeds from compromised victims, they continuously generate highly convincing AI avatars to scale future attacks.
Targeting & Infrastructure
Target Profile: Senior executives in the cryptocurrency and Web3 sectors.
Infrastructure: Over 80 typo-squatted domains and a dedicated media server hosting 950+ deepfake files.
Actionable Intelligence
IPs:172.86.113[.]102, 144.172.114[.]220
Domains:zoom-meeting[.]us, calendly-invite[.]com
Relevant Terms
Deepfake: Synthetic media generated by AI to convincingly replicate a person’s appearance or voice, used in this campaign to fabricate meeting participants.
ClickFix: A social engineering technique that tricks victims into copying and executing a malicious command by presenting it as a technical fix for a simulated problem.
Anthropic’s Claude Mythos is a frontier AI model designed to autonomously scan massive codebases and identify latent security vulnerabilities. It empowers defenders to rapidly discover and patch zero-days at a scale that outpaces traditional human-led code review.
Key Features
Autonomous code scanning across massive codebases.
Detects complex memory-safety and logic errors.
Generates working exploits to validate discovered vulnerabilities.
Use Case (The “So What?”)
Application security and Blue teams can integrate this AI into their secure development lifecycle to shift left, identifying and patching hundreds of flaws before release. However, its ability to generate exploits also presents a dual-use risk if accessed by threat actors.
Availability
Restricted commercial access via Anthropic’s Project Glasswing program.
Relevant Terms
Zero-day: A software vulnerability unknown to the vendor, meaning no patch currently exists.
Memory-safety: A property of programming languages that prevents bugs like buffer overflows or unauthorized RAM access.
