Another week, another pile of critical bugs proving that "secure by default" is still mostly a marketing garnish. Grab your patch calendar and your least favorite incident response coffee mug.
This Week's Hall of Shame: Top CVEs
CVE-2026-41940 — cPanel's front door forgot the lock
The Gist: A critical authentication bypass in cPanel & WHM versions after 11.40 lets unauthenticated remote attackers gain access to the control panel. It carries a 9.3 CVSS score, is being exploited in the wild, and yes, there's a public PoC too, because apparently chaos likes documentation.
Why It Should Keep You Up at Night: If your hosting control plane is exposed, this is the kind of bug that turns "admin panel" into "community property." Attackers don't need credentials, just reachability and bad luck on your part. Shipping a login flow with an auth bypass is the sort of move that makes defenders stare into the middle distance like they've seen too much.
Your Playbook:
- Patch cPanel & WHM immediately using the vendor's emergency update guidance and verify all internet-facing management interfaces are running the fixed release.
- Restrict access to cPanel/WHM management ports to trusted IPs only, and review authentication logs for unexpected logins, account changes, or new admin activity since exposure.
Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV | Bleeping Computer | The Hacker News | CVEShield | The Register | Bleeping Computer | HelpNetSecurity | CISA Known Exploited | NVD Analysis | Arctic Wolf Blog
CVE-2026-7333 — Chrome GPU bug tries the sandbox escape room
The Gist: Google patched a use-after-free flaw in Chrome's GPU component prior to version 147.0.7727.138. The bug scores 9.6 CVSS and could allow a remote attacker to trigger a potential sandbox escape via a crafted HTML page, though there's no confirmed in-the-wild exploitation so far.
Why It Should Keep You Up at Night: Browser bugs are still one of the most efficient ways to turn "just clicked a page" into "why is the EDR screaming?" A high-severity memory corruption flaw tied to GPU handling is exactly the sort of thing exploit developers collect like Infinity Stones. If your fleet lags on browser updates, congratulations: you've made web browsing a contact sport.
Your Playbook:
- Update Chrome to version 147.0.7727.138 or later across all managed desktops and verify auto-update is actually working, not just spiritually enabled.
- Prioritize patching high-risk groups first: admins, developers, finance users, and anyone with access to sensitive internal apps from the browser.
Sources: Rapid Risk Radar | Chromium Security Release | CVE Organization | RedHat Vuln DB | NVD Analysis
CVE-2025-71284 — Synway gateway, now with bonus command injection
The Gist: Synway SMG Gateway Management Software contains an unauthenticated OS command injection flaw in the /en/9-2radius.php RADIUS configuration endpoint. With a 9.3 CVSS score and observed exploitation in the wild, attackers can send crafted POST parameters and turn a management interface into their personal shell prompt.
Why It Should Keep You Up at Night: Unauthenticated remote code execution on gateway management software is bad in the same way an asteroid is "weather." This isn't some obscure edge case either; it's direct input getting stuffed into a shell command like nobody learned anything from the last two decades of AppSec pain. If this interface is reachable, assume attackers have already at least knocked on the door.
Your Playbook:
- Immediately isolate any exposed Synway SMG management interfaces from the public internet and place them behind VPN or strict allowlisting.
- Hunt for suspicious POST requests to
/en/9-2radius.php, unexpected shell activity, and configuration changes involving RADIUS parameters such asradius_addressorshared_secret2.
Sources: Rapid Risk Radar | VulnCheck KEV
Industry Intel: What Else is On Fire This Week
- PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials — Because apparently downloading packages now comes with the same trust model as accepting a USB stick in a parking lot. Read more
- New Python Backdoor Uses Tunneling Service to Steal Browser and Cloud Credentials — Attackers keep finding new ways to turn "helpful remote connectivity" into "surprise exfiltration pipeline." Read more
- SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack — Nothing says modern software assurance like enterprise-adjacent npm packages moonlighting as credential vacuums. Read more
- New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs — The threat actors have added AI to the scam kit, because apparently the dystopia needed a productivity boost. Read more
- VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB on Windows, Linux, ESXi — A charming reminder that some ransomware crews aren't here to negotiate; they're here to salt the earth. Read more
Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.