New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

thehackernews.com Sep 23, 2026

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

Curated by Shubham · TechCapsules · Sep 23, 2026

AI-summarised brief · reviewed before publication

A vulnerability in cPanel’s CalDAV and CardDAV services allows any account holder to execute code with root privileges, granting full server control. A separate flaw in the WP Toolkit plugin lets users modify databases belonging to other accounts. cPanel released patches for all three issues, including a third flaw that permits reading but not altering other users’ calendar data. The root flaw requires only a cPanel account, meaning any shared‑hosting customer could exploit it. The advisories provide no exploitation details or pre‑update checks.

💡 Why It Matters

· The flaw exposes shared‑hosting environments to total takeover, undermining the isolation that hosts promise to their customers.
· It forces providers to prioritize urgent patching and reassess their security posture.

Capsules Cybersecurity

Read full article on thehackernews.com

MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or…

Two MikroTik RouterOS SSH flaws have been combined into a chain dubbed “MikroTrick,” allowing attackers to seize full administrative control of Internet‑exposed routers without a password or SSH key. The first bug (CVE‑2026‑67279) disrupts the SSH state‑machine, letting an unauthenticated client skip the authentication confirmation step after a key renegotiation. The second flaw (CVE‑2026‑86060) injects a malicious argument into the router’s login program; sending “‑2” as the username tricks the program into granting root privileges. Attack logs date to September 2, a day before MikroTik released patches (RouterOS 6.49.21, 7.23.4, 7.24.2). CERT Polska warned on September 5, urging immediate updates, and CISA later added CVE‑2026‑86060 to its exploited‑vulnerabilities catalog. Compromised routers log a failed “-2” login and may spawn an “ops” account that exfiltrates configs remotely.

💡 Exposing SSH to the internet turns a routine remote‑admin feature into a backdoor, forcing operators to rethink firewall rules and default configurations.

theconversation.com · Sep 23

Worried about your car being hacked? You should be – no matter…

Earlier this week, a cybersecurity expert demonstrated that a BYD Shark 6 hybrid ute could be remotely commandeered, gaining control of its locks, headlights, audio and video with relative ease, according to an ABC report. The demonstration adds to growing concerns that Chinese‑made vehicles may transmit audio, video and location data to servers accessible by the Chinese government. Modern cars, regardless of powertrain, collect extensive personal information and relay it via Bluetooth, Wi‑Fi, built‑in SIM or eSIM connections to manufacturers’ cloud infrastructures. These networks expose dozens of onboard computers—handling entertainment, braking, steering and driver‑assist functions—to potential hacking and malware. Researchers have identified similar vulnerabilities in other brands, highlighting the systemic risk posed by outdated software and supply‑chain trust relationships.

💡 The ease of breaching a BYD vehicle proves that any connected car can become a remote weapon, compelling regulators and manufacturers to overhaul automotive cybersecurity standards.

blogs.microsoft.com · Sep 23

Disrupting EvilTokens: Taking down an AI-powered cybercrime platform

Microsoft announced the takedown of EvilTokens, an AI‑driven cybercrime platform that automated the full fraud pipeline from email compromise to financial theft. Launched in February 2026, the service sold access to compromised inboxes for a $1,500 initiation fee and $500 monthly, using a chatbot to scan victims’ mail, map organizational roles, pinpoint “money movers,” and draft convincing impersonation messages. Within months it breached more than 12,000 inboxes across over 10,000 organizations in the United States, Canada, the United Kingdom, Australia, India and France, affecting sectors from finance to healthcare. Microsoft, in partnership with law‑enforcement and hosting providers, seized 50 websites, disabled 150 domains, and supported the arrest of two suspects in the UK. The operation highlighted how AI can lower the expertise barrier for sophisticated fraud.

💡 EvilTokens proves that AI can turn routine credential theft into a turnkey financial‑fraud service, dramatically expanding the pool of capable attackers.

securitybrief.asia · Sep 23

Proofpoint launches AI security against trusted attacks

Proofpoint introduced Agentic Collaboration Security, an AI‑driven system aimed at thwarting attacks that masquerade as routine business communications. The solution blends an intent‑based detection model with automated threat investigation tools, protecting email, collaboration apps, and web browsers from phishing, compromised‑supplier, and payment‑fraud schemes that appear to originate from trusted contacts. By leveraging the Proofpoint Knowledge Graph—a unified data layer of threat intelligence, attack patterns, supplier compromises, and internal organizational context—the Nexus Intent‑Based Detection Model evaluates the purpose of each message in real time, making most decisions in under half a second and escalating ambiguous cases for deeper analysis. The platform operates at both gateway and inbox levels, continuously feeding post‑delivery insights back into pre‑delivery filters to maintain a unified defense.

💡 By targeting the growing wave of “trusted‑sender” attacks, the technology forces adversaries to abandon low‑effort impersonation tactics, raising the cost and complexity of breaching corporate finance and procurement workflows.

thehackernews.com · Sep 23

SharePoint Flaw Initially Listed as Spoofing by Microsoft Enables Authenticated RCE

Microsoft originally labeled CVE‑2026‑65660, a SharePoint Server flaw affecting 2016, 2019 and Subscription Edition, as a spoofing issue with a CVSS of 6.5. Viettel Cyber Security researcher Dinh Ho Anh Khoa later revealed the vulnerability permits authenticated remote code execution, raising the NVD score to 8.8. The bug resides in the SafeControls check of the ToolPane component, where unescaped quotes allow injection of arbitrary .NET classes that are loaded via XamlServices.Parse(), enabling code execution. Patches released on August 11 disable the vulnerable function, and a June 9 fix removes a related authentication bypass that could be chained for pre‑authentication exploits. No public exploits have been observed. Organizations that have not applied the update remain exposed, and flaw also impacts SharePoint 2013 installations.

💡 The reclassification reveals a critical gap in Microsoft’s vulnerability communication, forcing admins to reassess patch priorities for legacy SharePoint deployments.

thehackernews.com · Sep 23

New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host…

A new Linux kernel vulnerability, CVE‑2026‑89775, affects the KVM virtualization subsystem on ARM64 platforms with nested virtualization enabled. The flaw arises from an incorrect size calculation that skips a TLB invalidation, leaving a freed host memory page mapped and writable to a guest VM. Researchers demonstrate that a malicious guest can read and write host kernel memory, enabling a VM escape to execute code on the host. The bug is present in mainline kernels from version 6.16 onward, but the exploitable behavior appears from 6.17. Fixes are included in Linux 6.18.51, 7.2.5 and 7.3‑rc1; distributions are rolling out patches at varying schedules. Exploitation requires the experimental nested‑virtualization mode, which is disabled by default on ARM64, and no public exploit code exists.

💡 It reveals that even rarely used ARM64 nested‑virtualization can break the isolation guarantees of containers and VMs, exposing cloud providers and multi‑tenant systems to direct host compromise.