## Executive Summary The threat landscape remains dominated by **active exploitation of critical vulnerabilities** in widely deployed enterprise software and a surge in **high-impact supply chain attacks**. Immediate patching is required for critical flaws in **cPanel**, **Cisco SD-WAN**, **Drupal**, and **Microsoft SharePoint**, all of which are confirmed to be under attack. Separately, a major law enforcement operation has disrupted the 'First VPN' service used by ransomware groups, while sophisticated threat actors are deploying new Linux and Windows malware against telecommunications providers.

## ⚠️ Immediate Action Required

* **cPanel Authentication Bypass Actively Leading to Ransomware** A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel & WHM is being actively exploited to gain administrative access, deploy ransomware, and take over servers. Unauthenticated attackers can compromise millions of sites. * **CVE:** CVE-2026-41940 (CVSS: 9.8) * **Status:** Active exploitation detected * **Vulnerable:** cPanel versions 11.40 through 130.0.19 * **Fixed:** Patches available in specific builds; consult cPanel advisory. * **Workaround:** None mentioned in source * **Reference:** [FortiGuard Threat Signal: cPanel & WHM Authentication Bypass](https://fortiguard.fortinet.com/threat-signal-report/6447)

* **Cisco Catalyst SD-WAN Manager Authentication Bypass** A critical flaw (CVE-2026-20127) in Cisco Catalyst SD-WAN Manager allows unauthenticated attackers to gain administrative access. Multiple related flaws (CVE-2026-20128, CVE-2026-20122) are also under active exploitation. * **CVE:** CVE-2026-20127 (CVSS: 10.0) * **Status:** Active exploitation detected * **Vulnerable:** Multiple versions; consult Cisco advisory. * **Fixed:** Patches available; update immediately. * **Workaround:** None mentioned in source * **Reference:** [Rapid7 Research: Metasploit Wrap Up 05/22/2026](https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-05-22-2026)

* **Drupal Core SQL Injection Actively Exploited** A critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core's database abstraction API allows unauthenticated attackers to execute arbitrary SQL on PostgreSQL-backed sites. This flaw has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. * **CVE:** CVE-2026-9082 (CVSS: 6.5) * **Status:** Active exploitation detected * **Vulnerable:** Drupal 10.x and 11.x prior to specific patched releases. * **Fixed:** Patches available for impacted versions. * **Workaround:** None mentioned in source * **Reference:** [The Hacker News: Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)

* **Microsoft SharePoint Remote Code Execution Vulnerabilities** Multiple critical SharePoint vulnerabilities are being actively exploited, including CVE-2026-20963 (RCE, CVSS 8.8) and CVE-2026-32201 (Spoofing, CVSS 6.5). These affect SharePoint Server 2016, 2019, and Subscription Edition. * **CVE:** CVE-2026-20963 (CVSS: 8.8), CVE-2026-32201 (CVSS: 6.5) * **Status:** Active exploitation detected * **Vulnerable:** Versions prior to specific updates. * **Fixed:** Patches released by Microsoft. * **Workaround:** None mentioned in source * **Reference:** [Microsoft Security Response Center: CVE-2026-40357 Microsoft SharePoint Server Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357)

* **Linux Kernel 'Dirty Frag' Privilege Escalation** A critical Linux kernel local privilege escalation (LPE) vulnerability allows unprivileged users to gain root access by exploiting page-cache write flaws. Affected versions include 4.11 to 6.7, and the flaw is actively exploited. * **CVE:** CVE-2026-43284 (CVSS: Not specified) * **Status:** Active exploitation detected * **Vulnerable:** Linux kernel versions 4.11 to 6.7. * **Fixed:** Not specified in source — check vendor advisory * **Workaround:** None mentioned in source * **Reference:** [SC Media: New Linux privilege escalation flaw ‘Fragnesia’ disclosed; PoC available](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available)

## 🔍 Threat Activity

* **Supply Chain Attacks Target Developer Ecosystems.** Two major campaigns are active: 1) The **Laravel-Lang** PHP packages were compromised to inject credential-stealing malware that executes on every PHP request. 2) The **"Megalodon"** campaign poisoned over 5,500 GitHub repositories with malicious CI/CD workflows to steal cloud credentials and SSH keys. * **Chinese Espionage Group Targets Telecoms.** The state-sponsored group Calypso/Red Lamassu is deploying new malware (**Showboat** for Linux, **JFMBackdoor** for Windows) against global telecommunications providers. The Linux malware establishes a SOCKS5 proxy backdoor and scans local networks for lateral movement. * **Law Enforcement Takedowns Impact Threat Actors.** The **'First VPN'** service, used by at least 25 ransomware groups to anonymize attacks, has been dismantled, and its administrator arrested. Separately, the operator of the **Kimwolf** DDoS-for-hire botnet (over 2M IoT devices) was arrested in Canada. * **AI-Generated Zero-Day Bypasses 2FA.** Google identified the first known instance of threat actors using AI to develop a zero-day exploit, which successfully bypasses two-factor authentication in a popular open-source web administration tool.

## 📋 Patches & Updates

* **Multiple Rsync Vulnerabilities.** High-severity flaws in Rsync (versions prior to 3.4.3) allow privilege escalation, information disclosure, and DoS. Patches are available for some distributions (Red Hat, Debian, Ubuntu), but others remain unpatched. * **Squid Proxy Server Updates.** Multiple high-severity DoS and data exposure vulnerabilities (CVE-2026-32748, CVE-2026-33526) affect Squid versions prior to 7.5. Patches are available in Squid 7.5 and via Red Hat updates (RHSA-2026:20580). * **Grafana Critical Updates.** Multiple critical vulnerabilities in Grafana (prior to 12.4.2 and various 11.x/12.x branches) allow remote code execution, information disclosure, and DoS. Patches are available in updated versions. * **Microsoft Defender Zero-Days Patched.** Multiple actively exploited vulnerabilities (CVE-2026-41091, CVE-2026-45498) in Microsoft Defender allow local privilege escalation and DoS. Patches are available for the Microsoft Defender Antimalware Platform and Malware Protection Engine.

## Today's Priorities 1. **Patch cPanel, Cisco SD-WAN, Drupal, and SharePoint servers immediately**, as these are under active attack. 2. **Audit developer environments** for use of compromised Laravel-Lang packages (lang, http-statuses, attributes, actions) and review GitHub repositories for signs of the "Megalodon" CI/CD workflow compromise. 3. **Apply Linux kernel updates** where available to mitigate the actively exploited 'Dirty Frag' LPE vulnerability, prioritizing internet-facing and multi-user systems. 4. **Review and patch Rsync, Squid, Grafana, and Microsoft Defender** installations across the enterprise, as these updates address critical vulnerabilities.

## 🔗 References

• [FortiGuard Threat Signal: cPanel & WHM Authentication Bypass](https://fortiguard.fortinet.com/threat-signal-report/6447)
• [The Hacker News: Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV](https://thehackernews.com/2026/05/drupal-core-sql-injection-bug-actively.html)
• [The Hacker News: Laravel-Lang PHP Packages Compromised to Deliver Cross-Platform Credential Steal](https://thehackernews.com/2026/05/laravel-lang-php-packages-compromised.html)
• [The Hacker News: First VPN Dismantled in Global Takedown Over Use by 25 Ransomware Groups](https://thehackernews.com/2026/05/first-vpn-dismantled-in-global-takedown.html)
• [SC Media: New Linux privilege escalation flaw ‘Fragnesia’ disclosed; PoC available](https://www.scworld.com/news/new-linux-privilege-escalation-flaw-fragnesia-disclosed-poc-available)