LiteSpeed cPanel Plugin CVE-2026-48172 Exploited for Root Scripts
LiteSpeed says CVE-2026-48172 is being actively exploited in its user-end cPanel plugin. Hosts should update to WHM Plugin 5.3.1.0 or remove the user-end plugin while checking cPanel logs.
Packagist Postinstall Malware: What Developers Should Check
A Packagist and GitHub supply-chain campaign used malicious postinstall hooks to fetch Linux malware from GitHub Releases. Check package.json, CI logs, and build tokens.
Trojan:Win32/JScealTaskExec: Meaning and Removal
Trojan:Win32/JScealTaskExec is a Microsoft Defender detection that often returns through PowerShell, Defender exclusions, or scheduled tasks. Learn what to check and how to remove it safely.
Cheap TikTok Coins: Safest Recharge, VPN Risks & Scams
Want cheap TikTok Coins? Compare TikTok's official web recharge with app prices, understand VPN region risks, and avoid fake sellers, generators, APKs, and login-code scams.
Laravel-Lang Composer Packages Rewritten to Steal CI Secrets
Laravel-Lang Composer packages were compromised through rewritten tags that run a PHP credential stealer as soon as Composer autoload is loaded.
Browser Hijacker Removal Guide: Remove PUA Redirects
Remove browser hijackers, PUA redirects, unwanted extensions, forced search, blocked security sites, and settings that return after Chrome or Edge reset.
Grafana Says Missed Token Let Attackers Copy Private Repos
Grafana says attackers copied two private GitHub repositories after one workflow token was missed during post-TanStack credential rotation.
Ghostwriter Uses Prometheus Lures to Drop OYSTERFRESH Malware
CERT-UA says Ghostwriter used compromised accounts and fake Prometheus certificate lures to target Ukrainian government entities with OYSTERFRESH malware.
Nimbus Manticore Uses Fake Installers to Drop MiniFast Backdoor
Check Point says Nimbus Manticore used SEO poisoning, fake software lures, and installer abuse to deploy the new MiniFast backdoor during regional conflict activity.
First VPN Takedown Hits Ransomware Anonymization Service
Europol says First VPN, a Russian-speaking cybercrime VPN, was dismantled in Operation Saffron after years of use by ransomware actors and fraud crews.
Langflow CVE-2025-34291: Token Hijack and RCE Added to CISA KEV
Langflow CVE-2025-34291 can turn a malicious webpage into account takeover and RCE through CORS, refresh-token handling, and code validation. Check versions, exposure, and session rotation.
Trend Micro Apex One CVE-2026-34926 Exploited in the Wild
Trend Micro patched an Apex One on-prem directory traversal flaw after observing exploitation attempts. CISA added CVE-2026-34926 to KEV.
