A critical local privilege escalation vulnerability dubbed “Copy Fail” (CVE-2026-31431) has been discovered in the Linux kernel’s cryptographic subsystem. Currently armed with a public proof-of-concept and actively exploited, this flaw allows unprivileged local users to achieve root access in seconds across all major distributions shipped since 2017.
Vulnerability Details
Affected Product: Linux kernel versions 4.14 through 7.0-rc
A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel and WHM is currently actively exploited in the wild. This flaw allows unauthenticated attackers to gain full administrative control over web hosting servers, prompting immediate emergency patching across the industry.
Vulnerability Details
Affected Product: cPanel and WebHost Manager (WHM) versions 11.40 and later (including WP Squared and DNSOnly)
Identifier: CVE-2026-41940
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited (Listed on CISA KEV)
Risk & Impact
Triage: Immediate emergency patching required; treat as a critical, active threat.
Attack Vector: Attackers use CRLF injection in the login request to embed hidden line breaks, manipulating server-side session files to bypass password verification entirely.
Ease of Exploit: Extremely easy; requires no authentication or user interaction, and proof-of-concept (PoC) exploits are publicly available.
Action Plan
Immediate Action: Apply emergency patches (e.g., Version 11.136.0.5 or other supported branches) and restart the “cpsrvd” service.
Workaround: Temporarily block external access to cPanel and WHM ports at the network level until patches are applied.
Detection: Audit access logs for anomalous session creation, specifically failed logins followed by immediate administrative access without valid credentials.
Relevant professional terms
CRLF Injection
A vulnerability where an attacker injects Carriage Return and Line Feed characters into an input field, allowing them to manipulate server responses, HTTP headers, or session files.
Authentication Bypass
A security flaw that enables an unauthorized user to gain access to a system or application by circumventing the standard login and credential verification processes.
The TeamPCP threat group compromised official SAP npm packages in a supply chain attack dubbed “Mini Shai-Hulud”. The campaign targets developer environments and CI/CD pipelines to harvest cloud credentials.
Key TTPs
Initial Access: Abused GitHub OIDC trusted publishing to inject malicious preinstall scripts into npm packages.
Execution: Preinstall scripts download the Bun runtime to execute an obfuscated JavaScript payload.
Defense Evasion: Terminates on Russian-language systems and exfiltrates encrypted data via legitimate GitHub traffic.
Campaign Analysis
This attack demonstrates an evolution in supply chain threats by targeting enterprise CI/CD workflows and AI coding agent configurations. The campaign has already impacted over 1,800 developers across multiple ecosystems.
Targeting & Infrastructure
Target Profile: Developers and enterprise CI/CD pipelines using SAP CAP, Lightning, and Intercom frameworks.
Infrastructure: Leverages attacker-controlled GitHub repositories as dead-drops and dedicated exfiltration domains.
Actionable Intelligence
Domains: zero.masscan.cloud
Relevant Terms
Supply Chain Attack: A cyberattack that targets a software vendor or third-party component to compromise downstream users.
CI/CD Pipeline: Continuous Integration and Continuous Deployment; automated workflows used by developers to build, test, and deploy code.
China-aligned threat group SHADOW-EARTH-053 is conducting a widespread espionage campaign targeting government and defense sectors across Asia and Poland. The operation leverages known vulnerabilities to establish persistent access and deploy advanced backdoors.
Key TTPs
Initial Access: Exploits N-day vulnerabilities in internet-facing Microsoft Exchange and IIS servers.
Execution: Deploys Godzilla web shells to maintain persistent remote access.
Defense Evasion: Stages ShadowPad implants using DLL side-loading with legitimate signed executables.
Campaign Analysis
Active since December 2024, SHADOW-EARTH-053 shares network overlaps with other Chinese clusters like Earth Alux. The campaign highlights a continued reliance on unpatched edge infrastructure to facilitate high-value intelligence gathering.
Targeting & Infrastructure
Target Profile: Government and defense entities in Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, Taiwan, and Poland.
Infrastructure: Relies on compromised internet-facing servers and AnyDesk for remote command execution.
Relevant Terms
DLL Side-Loading: A technique where attackers place a malicious file in a directory so a legitimate application executes it instead of the intended file.
Web Shell: A malicious script uploaded to a compromised web server to provide attackers with remote administrative control.
Threat actors are distributing malicious Ruby gems and Go modules via the GitHub account “BufferZoneCorp” to target developers and CI/CD environments. The campaign utilizes sleeper packages to harvest sensitive credentials and establish persistent remote access.
Execution: Malicious payloads execute automatically during installation (Ruby) or via init() functions (Go).
Defense Evasion: Disabling checksum verification, planting fake go wrappers, and delaying malicious updates to evade initial detection.
Campaign Analysis
This campaign highlights the growing sophistication of supply chain attacks targeting CI/CD pipelines. By abusing trust in open-source ecosystems, attackers achieve widespread credential exposure and persistent backdoor access with minimal effort.
Targeting & Infrastructure
Target Profile: Developers, CI runners, and build environments using Ruby and Go ecosystems.
Infrastructure: Attacker-controlled GitHub repositories (BufferZoneCorp) and Webhook[.]site endpoints for data exfiltration.
