Weekly Cybersecurity Recap: Active cPanel and Linux Exploits, Supply-Chain Attacks and New Malware
Summary
This weekly roundup covers active exploitation of cPanel CVE-2026-41940 and Linux Copy Fail (CVE-2026-31431), TeamPCP supply-chain attacks, SaaS-focused vishing, a GitHub RCE disclosure, new malware and other security developments.
Key points
- CVE-2026-41940 in cPanel and WHM is under active exploitation. The article reports authentication bypass and, in some attacks, wiped websites and backups or deployment of Mirai variants and Sorry ransomware.
- CISA added Linux kernel flaw CVE-2026-31431, known as Copy Fail, to its KEV catalog based on evidence of active exploitation. Researchers say it enables reliable local privilege escalation and can escape Kubernetes containers.
- TeamPCP continued compromising packages in npm, PyPI and Packagist and abusing legitimate CI/CD pipelines to distribute poisoned releases. Researchers recommend checking affected versions and rotating potentially exposed pipeline credentials.
- Cordial Spider and Snarky Spider reportedly use vishing and employer-themed SSO phishing to steal credentials, manipulate MFA devices and access SaaS environments.
- Wiz disclosed CVE-2026-3854, which could allow an authenticated user to trigger remote code execution on GitHub.com or GitHub Enterprise Server with a git push. Microsoft patched the issue within six days of disclosure.
- The roundup describes DEEP#DOOR, a Python backdoor with remote command execution, surveillance and system-manipulation capabilities, and Android surveillance and malware tools KidsProtect and KYCShadow.
- ClickUp said exposed client-side feature-flag configuration included 893 customer email addresses and one improperly referenced API token; it said no other data was exposed.
Article Details
- Event Type
- Weekly cybersecurity news recap covering actively exploited vulnerabilities, cybercrime campaigns, supply-chain attacks, malware and ransomware, and data exposure.
- Impact
- Reported impacts include cPanel/WHM authentication bypasses, elevated control, and website and backup wipes; Copy Fail privilege escalation and Kubernetes container escape; and a GitHub vulnerability that could enable remote code execution and expose repositories and secrets. Other reports describe SaaS credential theft and persistent access, poisoned software packages, ransomware-related data loss, surveillance and data theft, phishing, and ClickUp exposure of 893 customer email addresses and a customer API-token reference. EnOcean reported vulnerabilities could allow command execution and memory disclosure on affected systems; patches were released. Microsoft patched the GitHub vulnerability within six days of responsible disclosure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | battleflight[.]pro | Fake domain reported in a malvertising campaign linked to Versatile Werewolf, used to deliver bogus aviation-software installers. |
MITRE ATT&CK
T1056.001 · KeyloggingDEEP#DOOR and KarstoRAT are reported to support keylogging.T1059.001 · PowerShellThe reported Versatile Werewolf campaign used PowerShell commands or scripts to download a JavaScript loader.T1059.007 · JavaScriptThe reported Versatile Werewolf infection chain used a JavaScript loader to execute a JS-RAT and modules in memory.T1078 · Valid AccountsCordial Spider and Snarky Spider reportedly use captured credentials to enter SaaS environments through authenticated sessions.T1090.002 · External ProxyCrowdStrike reports that Cordial Spider and Snarky Spider use residential proxy networks to blend in with legitimate home-user traffic.T1113 · Screen CaptureDEEP#DOOR and KarstoRAT are reported to capture screenshots.T1123 · Audio CaptureDEEP#DOOR is reported to support microphone access, and KarstoRAT audio monitoring.T1125 · Video CaptureDEEP#DOOR and KarstoRAT are reported to support webcam access or monitoring.T1195.002 · Compromise Software Supply ChainTeamPCP reportedly compromised open-source packages and CI/CD pipelines to distribute poisoned releases under legitimate identities.T1485 · Data DestructionVECT 2.0 ransomware reportedly wipes large files rather than merely encrypting them.T1552.004 · Private KeysDEEP#DOOR is reported to harvest SSH keys.T1562.001 · Disable or Modify ToolsDEEP#DOOR is reported to disable Microsoft Defender services.T1566.001 · Spearphishing AttachmentA reported campaign targeting Russian state structures and aviation companies used malicious archive attachments; another campaign used a Word document with a VBA macro dropper.T1566.004 · Spearphishing VoiceCordial Spider and Snarky Spider reportedly use vishing to direct employees to credential-harvesting pages.
CVE
CVE-2026-20761EnOcean Edge Inc · SmartServer IoTAccording to Claroty: “CVE-2026-20761 allows remote attackers to send malicious, crafted LON IP-852 messages that result in arbitrary command execution on devices.CVE-2026-22885EnOcean Edge Inc · SmartServer IoTCVE-2026-22885 allows remote attackers to send malicious, crafted IP-852 messages that bypass ASLR memory protections and leak memory.” Successful exploitation of the flaws results in attackers obtaining control overCVE-2026-31431Linux · Linux; Red Hat · NVIDIA for RHEL 10; +95 morerecap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware flaws, and urgentCVE-2026-3854GitHub · Enterprise ServerResearchers disclosed a GitHub RCE (CVE-2026-3854) and VECT 2.0 ransomware flaws, underscoring the urgent need for rapid patching and credential rotation.CVE-2026-41940WebPros · cPanel; WebPros · WHM; +1 moreThis recap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware flaws, and urgent
People
Threat Actors
Cordial SpiderReportedly uses vishing, phishing pages, and captured credentials to gain and maintain access to victims’ SaaS environments.GOFFEE APTThe article says fake domains associated with the Versatile Werewolf malvertising campaign also hosted domains linked to GOFFEE APT, and notes possible joint or coordinated campaigns.HeartlessSoulAlias the article gives for Versatile Werewolf, which it links to phishing and malvertising campaigns targeting Russian state structures and aviation companies.Peter StokesU.S. prosecutors charged him as a key member of Scattered Spider; the article reports allegations and charges, not a conviction. The source identifies him as also known as Bouquet.Scattered SpiderNamed as a hacking group; U.S. prosecutors charged Peter Stokes as a key member. The article reports the charge, not a conviction.SNARKY SPIDERReportedly uses vishing, phishing pages, and captured credentials to gain and maintain access to victims’ SaaS environments.TeamPCPIdentified as a cybercriminal group reportedly compromising open-source packages and weaponizing CI/CD pipelines to distribute poisoned releases.The Islamic Cyber Resistance in Iraq – 313 TeamClaimed responsibility for a sustained attack that knocked Canonical’s web infrastructure offline; the article identifies the group as also known as 313 Team.Versatile WerewolfLinked in the article to phishing and malvertising campaigns targeting Russian state structures and aviation companies; the source says the actor is also known as HeartlessSoul.
Malware
Atomic macOS Stealer (AMOS)Acronis said it identified more than 575 malicious skills across 13 developer accounts that target both Windows and macOS systems with trojans, cryptocurrency miners, and AMOS stealer, a macOS-focused infostealer.DEEP#DOOREnables Comprehensive Data Theft—A newly identified stealthy Python-based backdoor framework dubbed DEEP#DOOR provides attackers with persistent remote command execution and surveillance capabilities on WindowsKarstoRATNew KarstoRAT Malware Enables Data Theft —First spotted in early 2026, KarstoRAT is capable of system reconnaissance, audio and webcam monitoring, screenshot capture, key logging, and token theft.KYCShadowNew KYCShadow Android Malware Detected —An Android malware masquerading as a bank KYC verification application is being distributed via WhatsApp and primarily targeting users in India.MiraiOther attacks have deployed Mirai botnet variants and a ransomware strain called Sorry.ShadowLink“These routers were also running a custom command-and-control beacon that was named ShadowLink,” Ctrl-Alt-Intel said.SorryOther attacks have deployed Mirai botnet variants and a ransomware strain called Sorry.Vect 2.0Researchers disclosed a GitHub RCE (CVE-2026-3854) and VECT 2.0 ransomware flaws, underscoring the urgent need for rapid patching and credential rotation.
Vendors
Aqua Securitypackages of several open source software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static code analysis.Checkmarxsource software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static code analysis.cPanelThis recap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware flaws, and urgentEnOceanFlaws in EnOcean’s SmartServer —Two security flaws have been disclosed in EnOcean’s SmartServer IoT platform that affect version 4.60.009 and prior.GitHubResearchers disclosed a GitHub RCE (CVE-2026-3854) and VECT 2.0 ransomware flaws, underscoring the urgent need for rapid patching and credential rotation.MicrosoftBoot Record, force system crashes, exhaust system resources by spawning numerous processes, and disable Microsoft Defender services.
Products
cPanelThis recap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware flaws, and urgentGitHub Enterprise Serverfrom Wiz disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server (CVE-2026-3854, CVSS score: 8.7) that could allow an authenticated user to obtain remote codeGitHub.comresearchers from Wiz disclosed details of a critical security vulnerability impacting GitHub.com and GitHub Enterprise Server (CVE-2026-3854, CVSS score: 8.7) that could allow an authenticated user toi.LONbuilding management and building automation systems running affected versions of this platform and legacy i.LON devices.KICSopen source software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static code analysis.KubernetesMore worryingly, it leaves no traces on disk as exploitation occurs in memory and enables container escape from any pod in a Kubernetes cluster.Linux kernelThis recap highlights active exploitation of cPanel (CVE-2026-41940) and the Copy Fail Linux kernel bug (CVE-2026-31431), ongoing supply-chain campaigns by TeamPCP, new backdoors and ransomware flaws, and urgentTrivyTeamPCP has in recent months compromised the packages of several open source software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static codeWHMcPanel Flaw Comes Under Attack—A critical flaw in cPanel and WebHost Manager (WHM) has come under active exploitation in the wild.
Tools
KICSopen source software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static code analysis.Model Provenance KitCisco Unveils Model Provenance Kit —Cisco unveiled a new open-source tool, named Model Provenance Kit, to help organizations address potential issues associated with the use of third-party AI models.TrivyTeamPCP has in recent months compromised the packages of several open source software projects, including Trivy, a security scanner maintained by Aqua Security, and KICS, a Checkmarx-developed tool for static code
Countries
Albania“The criminal network, allegedly operating several call centres in Tirana, Albania, is believed to have caused significant financial damage, totalling at least â¬50 million,” Europol said.Canada(3,381), Canada (374), and Germany (291).”Germany(3,381), Canada (374), and Germany (291).”IndiaNew KYCShadow Android Malware Detected —An Android malware masquerading as a bank KYC verification application is being distributed via WhatsApp and primarily targeting users in India.PakistanPhishing Campaign Targets Pakistan Orgs —A highly targeted spear-phishing campaign targeting the Punjab Safe Cities Authority and PPIC3 in Pakistan has been found to use legitimate-sounding government infrastructureUnited StatesCopy Fail Linux Flaw Exploited—The U.S.
Industries
AviationWerewolf (aka HeartlessSoul) has been linked to campaigns targeting Russian state structures and aviation companies via phishing emails with malicious archive attachments and malvertising campaigns to deliver aBuilding automationexploitation of the flaws results in attackers obtaining control over building management and building automation systems running affected versions of this platform and legacy i.LON devices.business services“The top three targeted sectors include manufacturing (1,284), business services (824), and retail (682).CryptocurrencyAcronis said it identified more than 575 malicious skills across 13 developer accounts that target both Windows and macOS systems with trojans, cryptocurrency miners, and AMOS stealer, a macOS-focused infostealer.Financial Services“By leveraging Telegram’s native features, threat actors create highly convincing fake platforms across crypto, financial services, AI, and streaming sectors,” CTM360 said.Manufacturing“The top three targeted sectors include manufacturing (1,284), business services (824), and retail (682).Retail“The top three targeted sectors include manufacturing (1,284), business services (824), and retail (682).SaaSAttackers have shifted from one-off breaches to long-term occupation, exploiting control panels, kernels, CI/CD pipelines, and SaaS sessions to push trusted commits and live inside environments.