Search: CVE-2026-41940

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to the control panel. This critical vulnerability has a CVSS 4.0 score of 9.3 and is known to be actively exploited in the wild, including use in ransomware campaigns.

The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.

Campaign#llm api theft#ai agent frameworksUnited States+10

A sophisticated supply chain attack campaign involving 42 compromised GitHub repositories linked to the testmetest npm operation was identified. The attackers used compiled native addons that decrypt hidden payloads at runtime, employing extensive anti-analysis techniques to evade detection in CI environments. The campaign included credential theft, repository hijacking, forged commit timelines, and automated malicious package publishing via GitHub Actions using trusted npm publishing. The infrastructure is also connected to shellpanel exploitation targeting cPanel systems. The attackers deployed polymorphic wrappers embedding execution hooks for AI coding assistants and IDEs, with advanced environment detection to avoid execution in sandboxes, debuggers, and security tools.

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Malware#simplehelp#phantom frameworkUnited States