[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffPJ7wPGO2W5qtuzKo-X8GclUOeZws4tRdXES68mev2Y":3},{"article":4,"iocs":53,"watch_terms":72,"solutions":73,"lesson":34},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a20a5c39-f423-4404-9fd4-35991335293e","Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks","critical-cpanel-vulnerability-weaponized-to-target-government-and-msp-networks-cf23c5","A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of managed service providers (MSPs) and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S., by exploiting the recently disclosed vulnerability in cPanel. The activity, detected by Ctrl-Alt-Intel on May 2, 2026, involves the","A previously unknown threat actor has been actively exploiting CVE-2026-41940, a critical authentication bypass vulnerability in cPanel\u002FWHM, to target government and military entities in Southeast Asia (Philippines, Laos) as well as MSPs and hosting providers across multiple countries. The attacker used the AdaptixC2 C2 framework along with OpenVPN and Ligolo for persistence, and exfiltrated Chinese railway-sector documents. Multiple third-party threat actors, including operators of Mirai botnet variants and the Sorry ransomware strain, have also weaponized the vulnerability within 24 hours of public disclosure, with an estimated 44,000 compromised IP addresses detected.","Unknown threat actor exploits critical cPanel vulnerability to target Southeast Asian governments and MSPs.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F05\u002Fcritical-cpanel-vulnerability.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhlgjtQddA9U3D-xf2UWj5GKV2R5tEwjqWWY9fwRQi_fZgG5tf140uw2P4oVfmcvPZcMYuFDo1mvqYKkgKSmgfBxVloaWTrN7vgPiH1FX8ivdh8PFBN9LvfJF13a0ajbXDLEV20pr9d2rSoQo4KWbDYSpSOFJYoPYDHizXQ3tYNGVhhysD8h3FWWpOkHytN\u002Fs1600\u002Fccc.jpg","2026-05-04T09:27:00+00:00","2026-05-04T12:00:19.303663+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"cPanel","product",{"name":21,"type":19},"WebHost Manager (WHM)",{"name":23,"type":24},"OpenVPN","technology",{"name":26,"type":24},"Ligolo",{"name":28,"type":29},"Ctrl-Alt-Intel","vendor",{"name":31,"type":29},"Censys","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",[54,58,62,66,69],{"type":55,"value":56,"context":57},"ip","95.111.250.175","Threat actor C2\u002Fattack origin IP targeting government and MSP networks",{"type":59,"value":60,"context":61},"cve","CVE-2026-41940","Critical cPanel\u002FWHM authentication bypass vulnerability actively exploited",{"type":63,"value":64,"context":65},"malware","AdaptixC2","C2 framework used by primary threat actor for command and control",{"type":63,"value":67,"context":68},"Mirai","Botnet variant deployed by third-party actors exploiting CVE-2026-41940",{"type":63,"value":70,"context":71},"Sorry","Ransomware strain weaponizing CVE-2026-41940",[28,31,18],{"controls":74,"vendors":158},[75,104,129],{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":105,"name":106,"problem":107,"products":108},"patch-management","Automated patch management","Known holes get closed in days, not months.",[109,113,121],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":105,"product_name":110,"url":111,"description":112},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":130,"name":131,"problem":132,"products":133},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[159],{"slug":160,"name":31,"logo_path":161,"roles":162},"censys","\u002Fvendor-logos\u002Fcensys.png",[163],"reported_by"]