CYBER THREATCAST

Remediate CVE-2026-41940 on affected cPanel and WHM systems immediately, then inspect control panels for unauthorized access or takeover. The authentication bypass can provide unauthenticated remote access and potentially root access, and widespread exploitation followed public disclosure. CrowdStrike found a median exploitation time under one day among observed public-PoC vulnerabilities, with 91% attacked within 48 hours.

Fully update managed Android devices and verify that Chrome and device firmware contain fixes for CVE-2026-3910 and CVE-2025-27038. APT29 is chaining the Chrome V8 and Qualcomm Adreno flaws through malicious or compromised websites to escape the browser sandbox and compromise mobile devices. The documented vulnerabilities were already patched, and fully updated devices were not exposed to the reported chains.

Update affected SonicOS Gen7 and Gen8 firmware and inspect every alternate authentication path on SSL-VPN deployments using SAML. Actively exploited CVE-2026-19868 lets an attacker with valid credentials for another authentication method bypass SAML controls and SAML-enforced MFA. CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a November 20, 2026 remediation deadline for affected federal agencies.

Install WordPress 7.1.4 or the fixed release for the relevant supported branch, and monitor the site throughout the update rather than treating installation as immediate protection. CVE-2026-119977 is actively exploited and can expose installer files that permit unauthenticated PHP execution. The updater initially executes vulnerable site code, creating a final attack window while the fix is being installed.

Patch on-premises SharePoint Server against CVE-2025-53770 and CVE-2025-53771, then hunt for in-memory IIS webshell activity, suo5 tunneling, unexpected account creation, privilege escalation, and lateral access. Storm-2603 exploited unpatched servers, loaded a modular C# webshell directly into the IIS worker process without leaving a backdoor file on disk, and attempted to deploy Warlock ransomware.