2026-05-05: cPanel exploitation reaches thousands of servers with Mirai and ransomware payloads

Show Notes - 2026-05-05

Stories Covered

• May 5, 2026
• Today:
• cPanel Authentication Bypass (CVE-2026-41940) Exploited at Scale [Critical Alerts]
• Copy Fail Linux Privilege Escalation (CVE-2026-31431) Under Active Exploitation [Critical Alerts]
• Karakurt Member Sentenced to 102 Months [Ransomware & Extortion]
• RMM Tools Abused in VENOMOUS#HELPER Phishing Campaign [Business & Infrastructure Threats]
• Vishing Groups Operate Within SaaS Environments [Business & Infrastructure Threats]
• TeamPCP Mini Shai-Hulud Worm Campaign (Week of April 27-May 3) [Business & Infrastructure Threats]
• DigiCert Revokes 60 Certificates After Support Portal Compromise [Business & Infrastructure Threats]
• Amazon SES Abused for Phishing at Scale [Business & Infrastructure Threats]
• Trellix Discloses Source Code Repository Breach [Business & Infrastructure Threats]
• Code of Conduct Phishing Campaign Targets 35,000 Users with AiTM Token Theft [Windows / AD Security]
• April Windows Updates Cause Backup Failures [Windows / AD Security]
• Weaver E-cology RCE (CVE-2026-22679) Exploited Since March [General Security News]
• ScarCruft Deploys BirdCall Android Malware via Supply Chain Attack [General Security News]
• Cisco Acquires Astrix Security for Non-Human Identity Management [General Security News]
• MOVEit Automation Critical Authentication Bypass (CVE-2026-4670) [Vulnerability Disclosures]
• Microsoft CVEs Published with Minimal Details [Vulnerability Disclosures]

CVEs Referenced

CVE-2023-43896, CVE-2024-1708, CVE-2026-22679, CVE-2026-31431, CVE-2026-32202, CVE-2026-37457, CVE-2026-40170, CVE-2026-41940, CVE-2026-42798, CVE-2026-4670, CVE-2026-5174

Indicators of Compromise

IP Addresses: 95.111.250.175

Read the full brief