A cPanel Account Just Became a Root Shell: What CVE-2026-87899 Means for Shared Hosting

If you run a shared hosting box on cPanel & WHM, stop what you’re doing and check your build number. On September 22, cPanel shipped fixes for three separate vulnerabilities, and the headline one, CVE-2026-87899, is about as bad as it gets on a multi-tenant server: any logged-in cPanel account can run code as root and take over the entire machine.

We’ve spent years cleaning up compromised hosting environments, and this is the exact class of bug that turns a single throwaway account into a full server breach. Below is what actually matters, why it’s dangerous in practice, and what to do today.

Read More

WordPress CVE-2026-87902: Exploited Within Hours, and Why the pearcmd.php Trick Makes It Dangerous

A critical unauthenticated RCE flaw in WordPress core, CVE-2026-87902 (CVSS 9.2), went from patch to active exploitation in a matter of hours. WordPress shipped the fix on September 22, and the first exploitation attempt was logged the same day at 11:49 a.m. UTC. Attackers are chaining the flaw with a well-known PHP gadget, pearcmd.php, to write web shells to disk. If you run WordPress, this is a drop-everything-and-patch situation, and the mechanics are worth understanding because they explain both why the bug is serious and why most sites will survive it.

We monitor and clean WordPress sites at scale, and this is a textbook example of the pattern we see over and over: a core disclosure, a public advisory that hands attackers the recipe, and automated mass-probing before most admins have finished their morning coffee. AgentOffense flagged exactly this compressed timeline as an industry-wide trend in their research on disclosure-to-breach reaction windows, and CVE-2026-87902 is that trend playing out in real time, down to the hour. Here is what the flaw actually does, the classic trick that turns it into code execution, and exactly what to check.

Read More

ShinyHunters Claim to Have Breached the FBI and Hold Data on Every Employee

Late Monday night, a group calling itself ShinyHunters defaced the FBI’s own jobs site and claimed to be sitting on personal data for every current and former employee of the bureau, plus everyone who ever applied to become a special agent. No confirmation from the FBI has landed yet, so this is still a claim, not a confirmed breach, and the honest version of this story has to hold both things at once: some of what’s been shown checks out, and a lot of it doesn’t yet.

Read More

Comment2Shell: A WordPress Comment Can Now Turn Into Full Server Control (CVE-2026-93485)

WordPress patched a core vulnerability on September 17 that turns something as mundane as a blog comment into a path to full server compromise. Researchers are calling it Comment2Shell, tracked as CVE-2026-93485 with a CVSS score of 7.1, and it affects every WordPress core release from 4.7 through 7.1, which covers the overwhelming majority of WordPress sites running today. No authentication is required to fire the first stage. An attacker only needs a comment box that accepts input, which on most WordPress sites means anyone with a browser.

Read More

DORA Penetration Testing and TLPT Requirements: The Complete 2026 Guide

DORA, the EU’s Digital Operational Resilience Act, has been directly applicable law since 17 January 2025, and its testing requirements are where most financial firms run into trouble first. The regulation sets up two genuinely different testing obligations under one name, and conflating them is the single most common mistake we see: basic ICT testing that applies to nearly every in-scope entity every year, and Threat-Led Penetration Testing (TLPT), a far heavier, specialised exercise that only a defined subset of firms ever has to run. This guide separates the two clearly, explains exactly who has to do what, and walks through what a TLPT engagement actually involves phase by phase.

Read More

Not Just Banks: Why iGaming, Crypto Platforms and Shipping Companies in Cyprus Now Need Penetration Testing Too

Ask most Cyprus businesses which sectors get real cybersecurity scrutiny from regulators, and the answer is almost always “banks and investment firms.” That stopped being accurate a while ago. Between MiCA, the National Betting Authority’s licensing regime, IMO shipping cyber requirements, and the Central Bank of Cyprus’s oversight of electronic money institutions, several sectors that used to sit outside financial-grade regulation are now squarely inside it, each with its own testing expectations that a generic vulnerability scan does not come close to covering.

This guide covers what each of these sectors actually needs tested, why the risk profile is different from a standard business website, and what “in scope” really means if you operate a crypto platform, an iGaming site, a shipping company, or an EMI out of Cyprus.

Read More

DORA, NIS2 and CySEC ICT Risk: What Cyprus Financial Firms Actually Need to Test in 2026

If you run a Cyprus Investment Firm, a bank, an insurer, or any other regulated financial business on the island, you are very likely staring at three overlapping cybersecurity obligations right now: DORA, NIS2, and CySEC’s own ICT risk circulars. Each one has its own legal basis, its own regulator, and its own idea of what “tested” actually means. None of them is satisfied by an annual vulnerability scan, and confusing the three, or assuming one covers the others, is the single most common compliance gap we see when we scope a penetration test for a Cyprus financial firm.

This guide walks through what each framework actually requires, who is in scope, how often testing has to happen, and what a penetration test that satisfies DORA, NIS2, and CySEC actually looks like in practice.

Read More

KREMLIN Malware Forges Chrome and Edge Integrity Checks to Steal Banking Sessions

A newly documented malware operation named KREMLIN is quietly rewriting the rules of browser-based credential theft, and despite the name, it has nothing to do with Russian state activity. Researchers tracking the campaign have identified 1,515 infected systems, with 98.75 percent of them located in Brazil, all compromised through a technique that does something most users would assume is impossible: it installs a browser extension on Chrome and Edge that the victim never approved, never saw in a permissions prompt, and cannot easily find by browsing their installed extensions list. The malware’s operators have been refining this approach since at least May 2025, and the most recent evolution of the campaign, which shifted parts of its infrastructure onto Ethereum smart contracts in May 2026, shows just how far attackers are willing to go to keep a credential-theft operation alive against modern defenses.

Read More

Researchers Used Claude to Breach OpenAI in 72 Hours: Inside the Hacktron AI Exploit Chain

On September 18, 2026, a small independent research team called Hacktron AI publicly disclosed something that would have sounded like science fiction two years ago: they used Anthropic’s Claude model to build a working exploit chain, breach OpenAI’s own infrastructure, take over employee accounts, and reach an internal GitHub repository, all within 72 hours. OpenAI confirmed the incident, patched the underlying flaws, and paid a $6,500 bug bounty. No production systems or sensitive user data were exposed. But the story that matters here is not really about OpenAI’s patch cycle. It is about what happens when an AI model becomes a genuinely capable member of the offensive security team, and what that means for every organization that has not yet stress-tested its own defenses against that reality.

Read More

F5 BIG-IP APM Malware Hides a Web Shell in Memory: Inside the PoisonedRefresh Campaign

A new wave of attacks against F5 BIG-IP Access Policy Manager (APM) appliances is forcing security teams to rethink what “clean” actually means on a production edge device. Researchers disclosed this month that a newly identified malware strain, dubbed PoisonedRefresh, injects a fully functional PHP web shell directly into a running process’s memory rather than writing it to disk. A traditional file-integrity scan, antivirus sweep, or malware signature check comes back completely clean, because there is nothing on disk to find. The web shell only exists in RAM, activated the moment Apache loads one of the appliance’s own legitimate PHP scripts.

Read More