testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Product
cPanel
- Mentions · 7d2
- Mentions · 30d5
- All mentions15
- First seenSep 9, 2026
- Last mentioned3d ago
Timeline
15 articles · newest firstAustralia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
52
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
72
Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server
cPanel patched a root command-execution flaw and two stored XSS bugs in WHM.
68
WebPros security advisory (AV26-961)
Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.
68
Hackers now exploit critical Roundcube flaw in code injection attacks
Attackers are exploiting patched Roundcube SQL injection CVE-2026-48842 to bypass login and steal database data.
78
cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data
cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.
44
New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts
cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.
64
New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.
73
Hackers Exploit cPanel CVE-2026-41940 Auth Bypass to Deploy Mirai Malware
Attackers are exploiting CVE-2026-41940, a critical unauthenticated cPanel/WHM auth bypass, to compromise hosting servers and recruit them into Mirai botnets.
80
Hackers Abuse Critical cPanel Authentication Bypass to Compromise Hosting Servers
Attackers exploited critical cPanel CVE-2026-41940 on hosting servers, deploying Mirai variants and ransomware.
85
cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands
CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.
55
cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw
cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.
55
New cPanel Vulnerability Allows Attacker to Gain Full Control of the Server
cPanel disclosed critical SQL injection CVE-2026-67401 in EmailTrack, letting authenticated users with mail privileges gain root code execution; patched builds available.
50
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
- Authenticated Privilege Escalation to Root RCE in cPanel & WHM
- Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
- CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
- CVE-2026-67401<1%9.9Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2021-4402670%9.8SQL Injection in Roundcube Webmail via Search Parameters
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- Stored XSS in cPanel WHM Manage SSL Hosts
Appears with
- WHMproduct · 10
- cPanelvendor · 9
- cPanelorganization · 6
- WP Squaredproduct · 4
- Pleskproduct · 3
- WP Toolkitproduct · 3
- ConfigServer Security & Firewallproduct · 3
- JPCERT/CCorganization · 2
- Canadian Centre for Cyber Securityorganization · 2
- WebProsvendor · 2
- Miraimalware · 2
- Plesk RESTful APIproduct · 1
- WebProsorganization · 1
- Kimi K3ai model · 1
- Claude Opus 4.6ai model · 1
- Laravelproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.