https://cybersecuritytracker.ai/?stack=1Stories and vulnerabilities involving WebPros.Wed, 04 Nov 2026 23:52:50 GMThttps://theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570cst-11386A Miasma-family npm worm dubbed testmetest secretly compromised 42 real GitHub repositories across 11 owners starting in July, using large polymorphic payloads designed to evade GitHub search and automated scanners. The malware steals credentials, hijacks accounts, modifies CI configurations, and includes anti-analysis checks to bypass detection by security tools. Researchers linked the campaign to infrastructure previously used in shellpanel scanning exploits targeting CVE-2026-41940, an authentication bypass in cPanel and WHM. Sources: The Register Security.Mon, 26 Oct 2026 22:29:01 GMThttps://recordedfuture.com/blog/september-2026-cve-landscapecst-10188In September 2026, Insikt Group identified 94 high-impact vulnerabilities for remediation, a 29% increase from August, with 59 rated Very Critical. Forty-three were tracked in the CISA Known Exploited Vulnerabilities catalog, 37 surfaced through open sources, and 14 through honeypot data. The vulnerabilities affected 58 vendors across network edge and security appliances, operating systems, collaboration platforms, artificial intelligence (AI) tools, and operational technology systems, with zero-day exploitation of CVE-2026-88771 and CVE-2026-88772 in Citrix NetScaler and renewed attacks on CVE-2026-35273 in unpatched PeopleSoft systems. Threat actors deployed AI-assisted campaigns combining older vulnerabilities with post-compromise tooling, including a Chinese-speaking actor leveraging Claude, Qwen, and DeepSeek-backed workers and a Russian-speaking actor using hundreds of AI agents to compromise 440 PaperCut NG/MF instances across 395 organizations. Sources: Recorded Future (Insikt Group).Tue, 13 Oct 2026 00:00:00 GMThttps://cyber.gc.ca/en/alerts-advisories/webpros-security-advisory-av26-908cst-7039WebPros issued security advisory AV26-908 on September 10, 2026, identifying vulnerabilities in cPanel & WebHost Manager (WHM) and ConfigServer Security & Firewall (CSF) software across multiple versions. The advisory references CVE-2026-67401 (SQL Injection in cPanel's EmailTrack functionality), CVE-2026-65638, and CVE-2026-65639, with affected version ranges specified for each product. Users and administrators are encouraged to apply updates as they become available. Sources: Canadian Centre for Cyber Security, Communications Security Establishment Canada.Thu, 10 Sep 2026 17:38:55 GMThttps://thehackernews.com/2026/08/new-cpanel-critical-flaw-could-let.htmlcst-3780cPanel released a security patch addressing a critical flaw (CVE-2026-58048, CVSS 9.4) that permitted authenticated hosting customers to execute SQL commands with database root privileges, bypassing privilege boundaries between customer accounts and server administration. The patch also closes two additional privilege escalation pathways. The vulnerability affected the ability to maintain proper account isolation on shared hosting infrastructure. Sources: The Hacker News.Tue, 04 Aug 2026 10:36:27 GMThttps://tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-executioncst-2848Researchers disclosed two WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that can be chained to obtain pre-authentication remote code execution on versions 6.9.x through 7.0.1. Security firms observed active exploitation shortly after the July 17, 2026 disclosure, and patches are included in WordPress 7.0.2 and 6.9.5 with forced automatic updates enabled. Sources: Tenable Blog, SANS Internet Storm Center, Wiz Research, Dark Reading, The Hacker News.Mon, 20 Jul 2026 13:36:32 GMThttps://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940cst-560cPanel & WHM, which manages over 70 million domains, contains an authentication bypass vulnerability (CVE-2026-41940) affecting all currently supported versions. The flaw in session loading and saving mechanisms has been exploited in the wild as a zero-day, and cPanel has released patches across multiple version tracks (110.0.x through 136.0.x) to address the issue. Sources: watchTowr Labs.Wed, 29 Apr 2026 17:19:19 GMT