Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-21510+1 related CVE | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 | 61% | KEV | KEV |
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
| CVE-2026-32202 | Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited | 4.3 | 71% | KEV | KEV |
| CVE-2026-3854 | Header-injection RCE via git push options in GitHub Enterprise Server | 8.7 | 40% | ||
| CVE-2026-41940 | Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE) | 9.3 | 99% | KEVRansomwarePoC ×9 | KEV |
From the original article
13 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The AI criminal mastermind is already hiring on gig platforms Labor-hire platforms let anyone with a credit card post a task and pay a stranger to complete it. The RentAHuman platform extends that model to AI agents through a Model Context Protocol server, allowing an agent to post gigs directly.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.