3 exploits in 72 hours. I fear this is just the beginning.

The last 72 hours have been the noisiest patch window I have lived through in a while. cPanel and WHM were quietly being rooted as a zero-day for two months before the public advisory dropped on April 28. The next day, a nine-year-old Linux kernel logic bug went public with a 732-byte Python exploit that gives any local user root on essentially every major distribution. Hours later, the same TeamPCP crew that hit LiteLLM in March came back with a fresh credential-stealer worm, this time poisoning the official intercom-client npm package and the popular lightning PyPI release.

Three independent incidents, all critical, all dropping inside the same 72 hour window. If you manage hosting, Linux fleets, or any developer pipeline that touches npm or PyPI, you have work to do this week. This post is the consolidated picture: what each incident is, what to patch, and what to hunt for.

What broke and when

cPanel CVE-2026-41940: silently exploited for two months

This one is the worst story of the three because the exploitation predates the advisory by approximately two months. Researcher Sina Kheirkhah at watchTowr Labs reported a critical authentication bypass to WebPros around mid-April. WebPros initially dismissed the report. Then KnownHost publicly confirmed they had been seeing exploitation in their telemetry “at least for the last 30 days, if not longer”, with the earliest verified compromise dating to February 23, 2026.

The root cause is a CRLF injection (literal \r\n bytes) in cPanel’s session-saving logic, specifically inside Cpanel::Session::Modify::saveSession. An unauthenticated attacker:

1. Triggers a failed login to create a pre-auth session file on disk.
2. Sends a follow-up request with an Authorization: Basic header containing raw \r\n.
3. The session module writes the unsanitised header into the on-disk session file, line by line.
4. The injected lines forge keys like user=root, hasroot=1, tfa_verified=1, and successful_internal_auth_with_timestamp.
5. A separate cookie-segment trick bypasses the encryption check on the whostmgrsession cookie.

The result is pre-auth root on WHM. On a shared hosting box that means every tenant’s data, mail, databases, and customer sites are also fully exposed.

Affected: every supported cPanel and WHM build older than the patched releases below, plus WP Squared v136.1.7. Shodan counts roughly 1.5 million internet-exposed cPanel instances, managing somewhere around 70 million domains.

Fixed builds (from the cPanel advisory):

• 110.0.x: 11.110.0.97
• 118.0.x: 11.118.0.63
• 126.0.x: 11.126.0.54
• 132.0.x: 11.132.0.29
• 134.0.x: 11.134.0.20
• 136.0.x: 11.136.0.5

Linux “Copy Fail” CVE-2026-31431: nine years dormant, 732 bytes to root

While cPanel admins were finishing emergency patches, Theori (Taeyang Lee) and the Xint Code Research Team coordinated public disclosure of a Linux kernel logic bug they nicknamed Copy Fail. The bug was introduced in 2017 by an in-place AEAD optimisation (commit 72548b093ee3) and sat there silently for nine years before being reported in March 2026.

What makes Copy Fail “brutal” is the exploit profile, not the CVSS score (7.8 high, but local). The published proof of concept is a 732 byte Python script using only the standard library on Python 3.10 or later. There is no race condition, no kernel offset leak, no ROP, no payload to compile. The same script reaches root on every distribution shipped since 2017, including Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, SUSE 16, Rocky Linux 9.7, and Debian stable.

The attack chains the kernel’s algif_aead socket interface (the AF_ALG family for userspace crypto) with the authencesn AEAD template. The authencesn template reserves four bytes past its output buffer as a scratch pad and never restores them. With a carefully crafted splice() call, an unprivileged user gets a deterministic 4-byte write into any page-cache-backed page: pick /usr/bin/su, patch its setuid binary in cache, run it, get a root shell.

The container escape twist. The page cache is shared across every namespace on a node. If a compromised container can run the exploit, the corrupted setuid binary is visible to the host and to peer containers in shared image layers. That makes Copy Fail a viable Kubernetes container escape primitive on multi-tenant clusters. OVHcloud and Sysdig both flagged this angle for managed Kubernetes, and a Kubernetes-specific PoC is already on GitHub.

Affected kernels: 4.14 through 7.0-rc, all 6.18.x below 6.18.22, all 6.19.x below 6.19.12.

Patched builds:

• Mainline 7.0 (commit a664bf3d)
• Stable 6.19.12 (commit ce42ee42)
• Stable 6.18.22 (commit fafe0fa2)
• Distribution USN, RHSA, SUSE-SU, and DSA updates rolling since April 29
• CloudLinux KernelCare livepatch available with no reboot

If you cannot reboot immediately, blacklist the algif_aead module:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif-aead.conf
rmmod algif_aead 2>/dev/null

On RHEL or Rocky 9.7 the module is built in, so the kernel cmdline mitigation is the only pre-patch option:

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
# reboot required

For containers, push a seccomp profile that blocks socket(AF_ALG, ...) until host nodes are running patched kernels.

Mini Shai-Hulud strikes again: intercom-client and lightning

The third story is a sequel. The TeamPCP threat actor we wrote about for the LiteLLM compromise in March never went away. They have been chaining together compromises ever since (Telnyx, Xinference, Bitwarden CLI, Aqua Trivy), and on April 29 and 30 they shipped what Aikido, Wiz, and Socket are now calling the “Mini Shai-Hulud” worm campaign. Two packages stand out for the impact on MSP-managed environments:

• [email protected] on npm, the official Intercom Node SDK, with roughly 337,000 weekly downloads.
• lightning 2.6.2 and lightning 2.6.3 on PyPI, the PyTorch Lightning training framework, which Socket describes as having hundreds of thousands of downloads per day.

The same window also produced poisoned SAP-CAP packages (@cap-js/[email protected], @cap-js/[email protected], @cap-js/[email protected], [email protected]). Different ecosystems, identical payload pattern.

The shared payload

Every malicious package in this campaign ships the same multi-stage credential stealer.

graph TD
  INSTALL["Install or import malicious package<br/><small>npm install intercom-client OR import lightning</small>"] --> DROPPER["Stage 1: Dropper<br/><small>setup.mjs or _runtime/start.py runs from preinstall hook or import-time code</small>"]
  DROPPER --> BUN["Stage 2: Bun JS runtime fetched<br/><small>Platform-specific Bun binary downloaded from GitHub Releases</small>"]
  BUN --> EXEC["Stage 3: Obfuscated stealer executes<br/><small>execution.js or router_runtime.js, around 11 MB obfuscated</small>"]
  EXEC --> HARVEST["Credential harvest<br/><small>SSH keys, GitHub PATs, npm tokens, AWS, Azure, GCP, Kubernetes, IMDS, env vars, crypto wallets</small>"]
  HARVEST --> CRYPTO["AES-256-GCM encryption<br/><small>Session key wrapped with embedded RSA-4096 public key</small>"]
  CRYPTO --> EXFIL["Exfiltration via GitHub<br/><small>New public repo on the victim account, Dune-themed name, Mini Shai-Hulud signature description</small>"]
  HARVEST --> WORM["Worm propagation<br/><small>Inject preinstall hook into every locally cached npm package the stolen token can publish, bump patch version, republish</small>"]
  style INSTALL fill:#92400e,stroke:#78350f,color:#fef3c7
  style DROPPER fill:#991b1b,stroke:#7f1d1d,color:#fef2f2
  style BUN fill:#991b1b,stroke:#7f1d1d,color:#fef2f2
  style EXEC fill:#991b1b,stroke:#7f1d1d,color:#fef2f2
  style HARVEST fill:#991b1b,stroke:#7f1d1d,color:#fef2f2
  style CRYPTO fill:#991b1b,stroke:#7f1d1d,color:#fef2f2
  style EXFIL fill:#5b21b6,stroke:#4c1d95,color:#ede9fe
  style WORM fill:#5b21b6,stroke:#4c1d95,color:#ede9fe

A few details worth calling out:

• Bun is the canary. The dropper fetches the Bun JavaScript runtime, drops the binary on disk, and uses it to execute the obfuscated stealer. If bun shows up in process telemetry on a host that does not normally run it, especially in the parent chain of npm install or pip install, that is the campaign.
• GitHub itself is the C2. There is no traditional command-and-control domain. Stolen credentials are committed to a brand new public repository created on the victim’s own GitHub account. Names follow a Dune theme. The repo description is the literal string A Mini Shai-Hulud has Appeared. A search for that exact string across an org is enough to catch active compromises.
• The worm. If the stealer recovers npm publish credentials, it walks the developer’s locally cached packages, injects a preinstall hook into each, bumps patch versions, and republishes. One developer’s stolen token can mushroom into a dozen secondary package compromises. Researchers reported more than 1,100 victim repositories carrying the signature description by April 30.

What we know about each package

[email protected]. Published April 29. Last known good version is 7.0.3. Pin and override accordingly. Intercom posted an incident notice on intercomstatus.com advising customers to rotate any credentials reachable from systems that installed the malicious version. To be unambiguous: Intercom the SaaS was not compromised. The npm SDK was. The right risk framing for clients is “our build host pulled a poisoned dependency”, not “Intercom got breached”.

lightning 2.6.2 and 2.6.3. Published April 30 from the compromised pl-ghost GitHub maintainer account. Last known good version is 2.6.1 (January 30, 2026). Socket caught both versions within 18 minutes. PyPI quarantined the project later the same day. The malicious code was injected into __init__.py, so the stealer fires on import lightning, not just on install. Any data science, MLOps, or AI workload that imported the package between publish and quarantine should be treated as a credential breach.

Socket’s writeup published the file hashes for router_runtime.js, the obfuscated payload:

• SHA256: 5f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1
• SHA1: f1b3e7b3eec3294c4d6b5f87854a52471f03997f
• MD5: 40d0f21b64ec8fb3a7a1959897252e09

Indicators of compromise

If you are feeding the values below into a SIEM, strip the defang brackets ([.]) and restore regular dots.

cPanel CVE-2026-41940

No public attacker IPs, domains, or file hashes were released as of April 30. Detection is filesystem and string based.

Linux Copy Fail CVE-2026-31431

There is no malware here, just an exploit primitive, so detection is patch-based first and behavioural second.

Mini Shai-Hulud (intercom-client, lightning, SAP-CAP)

What to hunt for

# Run cPanel's official IoC script
/usr/local/cpanel/scripts/ioc_checksessions_files.sh

# Look for forged keys in session files
grep -RIE "hasroot=1|tfa_verified=1|user=root" /var/cpanel/sessions/ 2>/dev/null

# Check for token_denied + cp_security_token co-occurrence
grep -RIl "token_denied" /var/cpanel/sessions/ 2>/dev/null \
  | xargs -r grep -l "cp_security_token" 2>/dev/null

# Current kernel
uname -r

# Is algif_aead loaded as a module, or built in?
lsmod | grep algif_aead
grep -i algif_aead /boot/config-$(uname -r)

# Search for planted dropper files
find / -type f \
  \( -name "router_runtime.js" -o -name "setup.mjs" -o -name "execution.js" \) \
  2>/dev/null

# Search every managed GitHub org for the exfil-repo signature
gh search repos "A Mini Shai-Hulud has Appeared" --owner <your-org>

# Look for bun in process history (sysmon, auditd, or your EDR)
# Parent of interest: npm, node, pnpm, yarn, python, pip, uv
# Child of interest: bun

Why this matters for MSPs

• Patch fatigue is itself a security risk. Three independent severe issues in 72 hours stretch even a well-resourced team. Prioritise by blast radius (multi-tenant first), and accept that you will be applying mitigations and patches in parallel rather than in sequence.
• “Patched” does not mean “clean”. cPanel’s CRLF bug was exploited as a 0-day for two months before the patch. Anyone who patched on April 28 without running an IoC sweep is still potentially holding a rooted box. The same logic applies to any future story like this: assume compromise spans the time between bug introduction and your patch.
• Supply-chain compromise is the new normal in npm and PyPI. TeamPCP has now run high-profile attacks on LiteLLM (March), Telnyx (March), Bitwarden CLI (April), and now Intercom and PyTorch Lightning (April). The cadence is accelerating. Lockfile hygiene, install-script discipline, and continuous credential rotation are no longer optional.
• Container security needs more than image scanning. Copy Fail demonstrates that a clean container image running on an unpatched host kernel is still a container escape. Node-level kernel patching matters as much as image hygiene, and seccomp profiles that deny exotic syscalls (like AF_ALG socket creation) are cheap insurance.

Closing thought

Three independent severe issues in one news cycle would have been a fluke five years ago. In 2026 it is starting to look like a pattern, and I expect more of it before the year is out. The teams that come out ahead are the ones with disciplined inventories, automated rotation, and a habit of treating “we patched it” as the start of incident response, not the end.

Related reading