Good morning. This is your security briefing for Friday, May 01, 2026, covering nine articles. All attribution is by the article authors. All article analysis is automated.
CISA has added a critical authentication bypass vulnerability in cPanel and WHM control panels to its Known Exploited Vulnerabilities catalog. The flaw allows unauthenticated remote attackers to completely bypass authentication and gain unauthorized access to these widely-used web hosting management platforms. According to cPanel, the vulnerability affects all versions after eleven point forty, and attackers can exploit it by injecting security tokens via newline payloads. Active exploitation has been confirmed in the wild with public proof-of-concept code available. Defenders should immediately apply vendor patches, check authentication logs for indicators of compromise since February, and verify system integrity.
Following up on yesterday's coverage, Chinese national Xu Zewei, who allegedly worked as a contract hacker for China's Ministry of State Security, has been extradited from Italy according to the U.S. Attorney's Office in the Southern District of Texas. Xu is charged with participating in the HAFNIUM campaign and other cyber intrusions between February 2020 and June 2021, which targeted thousands of computers globally including U.S. COVID-19 research facilities and a law firm handling sensitive government-related information. The operations exploited Microsoft Exchange Server vulnerabilities and deployed web shells for persistent access.
The Federal Bureau of Investigation is warning that cyber threat actors are increasingly using sophisticated tactics to enable strategic cargo theft from transportation and logistics companies. Attackers deploy remote management software through spoofed emails, impersonate legitimate carriers on load boards, and manipulate bills of lading to redirect high-value shipments. Cargo theft losses reached seven hundred twenty-five million dollars in 2025, representing a sixty percent increase from the previous year.
CISA, in collaboration with multiple federal agencies, has released guidance on adapting zero trust principles to operational technology environments. The guidance addresses cybersecurity risks arising from increasing convergence between information technology and operational technology systems, as well as the remote control of traditionally isolated industrial control systems. The recommendations target operators in critical infrastructure sectors.
DigiCert experienced a security incident in April where threat actors compromised internal support analyst endpoints through malicious ZIP files disguised as screenshots sent via customer chat. The attackers exploited an internal support portal function to harvest initialization codes for pending extended validation code signing certificate orders, resulting in the misissuance of sixty certificates. These certificates were subsequently used to sign Zhong Stealer malware.
BerriAI has disclosed a SQL injection vulnerability in LiteLLM's Proxy API key verification process that allows unauthenticated attackers to read and modify sensitive database contents including managed credentials. The flaw stemmed from improper handling of user-supplied API keys that were directly concatenated into SQL queries rather than using parameterized statements. Users are advised to upgrade to version one point eighty-three point seven or later, or set disable error logs to true as a temporary workaround.
According to SANS Institute research, threat actors including APT29, also known as Midnight Blizzard, and Scattered Spider are exploiting legitimate cloud administration tools, specifically AWS Systems Manager and Azure Run Command, for unauthorized access, lateral movement, and persistence. These tools create significant logging gaps as AWS CloudTrail and Azure Activity Logs redact actual command content while recording execution events, enabling attackers to operate within cloud environments without leaving clear audit trails.
StarLabs reports that Adobe released emergency updates in April to address three critical vulnerabilities in Acrobat DC and Reader that were exploited in the wild as a chained prototype pollution attack. The exploit chain allowed attackers to bypass security boundaries, escalate privileges by registering malicious JavaScript as trusted functions, and execute arbitrary code including file system access and external URL launching. The attack affected Windows and macOS systems running Adobe Reader versions prior to the security updates.
That concludes today's briefing.