Full Daily Digest

The vulnerability in LiteSpeed's cPanel plugin arises from improper privilege assignment, enabling attackers to escalate permissions to root via the lsws.redisAble function. This flaw is particularly dangerous as it affects all versions between 2.3 and 2.4.4, and exploitation can lead to full system compromise. The active exploitation underscores the urgency for patching. LiteSpeed's mitigation guidance includes upgrading to version 2.4.7 or higher, or uninstalling the plugin if immediate patching isn't feasible. The attack path involves leveraging the plugin's functionality to execute arbitrary scripts, making it a prime target for threat actors deploying malware like Mirai and ransomware. Defenders should prioritize log analysis for the provided IOC and ensure all systems are updated to the latest secure versions.

The Hacker News · 2026-05-23 · Vulnerability: LiteSpeed cPanel plugin flaw (CVE-2026-48172) allows root-level script execution, actively exploited in the wild.

The staged publishing feature enforces a human-in-the-loop mechanism, requiring maintainers to authenticate via 2FA before a package is published. This mitigates risks from automated CI/CD workflows and unauthorized publishes. The new install source flags—--allow-file, --allow-remote, and --allow-directory—enable developers to explicitly whitelist installation sources, reducing the attack surface from malicious local or remote packages. These measures are critical as supply chain attacks, like those by TeamPCP, exploit weak controls in package publishing and installation. Organizations should adopt these features immediately, ensuring 2FA is enabled and install sources are tightly controlled to prevent compromise.

The Hacker News · 2026-05-23 · Vulnerability: npm now requires 2FA-gated staged publishing and introduces install source controls to mitigate supply chain attacks.

This attack demonstrates a sophisticated exploitation of cross-ecosystem dependencies, targeting JavaScript build tooling within PHP projects to evade detection. The malicious code, inserted into package.json, triggers a postinstall script that downloads and executes a Linux binary from GitHub. The binary, named 'gvfsd-network,' mimics a legitimate GNOME Virtual File System daemon, potentially enabling remote code execution. The attacker's use of GitHub Releases URLs and GitHub Actions workflows indicates a multi-faceted execution strategy. The payload's widespread presence across GitHub files suggests a broader campaign, though the exact scope remains uncertain. Mitigation requires comprehensive dependency scanning, including JavaScript lifecycle hooks, and verifying the integrity of third-party repositories. Organizations should also monitor GitHub Actions workflows for unauthorized changes and enforce strict access controls.

The Hacker News · 2026-05-23 · Incidents: Eight Packagist packages were compromised in a supply chain attack using GitHub-hosted Linux malware via malicious package.json scripts.

The scale of vulnerabilities uncovered by Claude Mythos AI underscores the accelerating pace of AI-driven vulnerability discovery, which now outpaces traditional manual methods. The critical WolfSSL flaw (CVE-2026-5194) exemplifies the risks, as it could allow attackers to impersonate legitimate services, a tactic often used in phishing and man-in-the-middle attacks. The project's success in identifying 1,726 true positives from 10,000 candidates demonstrates AI's precision in reducing false positives. However, the challenge lies in remediation; with 97 patches issued so far, the backlog remains significant. Organizations must prioritize patch management, especially for critical infrastructure, and consider integrating AI tools into their defensive strategies. The dual-use nature of these AI models necessitates strict access controls to prevent misuse by threat actors.

The Hacker News · 2026-05-23 · Vulnerability: Claude Mythos AI uncovers 10,000+ high-severity vulnerabilities, prompting urgent calls for faster patching and defensive AI adoption.

Underminr represents a sophisticated evolution of domain fronting, targeting shared CDN infrastructure to mask malicious traffic. Unlike traditional domain fronting, which relied on front domains, Underminr manipulates SNI and HTTP Host headers to route requests to different tenants on the same edge. This technique exploits gaps in correlating DNS decisions, edge IPs, and CDN tenant routing. Attackers can leverage this to bypass Protective DNS (PDNS) and other filtering mechanisms, making it particularly dangerous for large-scale hosting providers. Mitigations include enhancing correlation between DNS lookups and actual connections, as well as implementing stricter CDN tenant isolation. Organizations should also monitor for anomalous TCP connections on port 443, where SNI exposes the intended TLS hostname.

SecurityWeek · 2026-05-23 · Vulnerability: Underminr vulnerability exploits shared CDN infrastructure to hide malicious connections behind trusted domains, bypassing DNS monitoring.

The SQL injection vulnerability (CVE-2026-9082) in Drupal Core poses significant risks due to its potential for privilege escalation and remote code execution. Attackers exploit the flaw by sending specially crafted requests through the database abstraction API, targeting PostgreSQL-backed configurations. Over 15,000 attack attempts have been detected, primarily probing gaming and financial services sites. While most activity is reconnaissance, successful exploitation could lead to data extraction or privilege escalation. Patches are available for Drupal 11.x and 10.x, but manual patching is required for older versions like Drupal 9.5 and 8.9. Organizations must prioritize patching, especially Federal Civilian Executive Branch agencies, which are advised to apply fixes by May 27, 2026. Additionally, monitoring for suspicious database queries and implementing web application firewalls can mitigate risks.

The Hacker News · 2026-05-23 · Vulnerability: CISA warns of active exploitation of a critical SQL injection flaw in Drupal Core, urging immediate patching.