CISA added CVE-2026-41940 to the Known Exploited Vulnerabilities catalog on April 30 with a federal remediation deadline of May 3. The vulnerability is a missing authentication flaw in the login flow of cPanel and WHM (WebHost Manager) as well as WP2 (WordPress Squared). cPanel and WHM is the de facto standard web hosting control panel, running on millions of shared hosting servers globally across hosting providers, managed WordPress environments, and self-managed web infrastructure. The flaw allows an unauthenticated remote attacker to bypass the login flow and gain unauthorized access to the control panel without providing valid credentials. From the control panel an attacker has access to file management, email account administration, database access, DNS configuration, and in WHM deployments, the ability to create and modify accounts across the entire server. WebPros, the company behind cPanel, released a security update on April 28 addressing the vulnerability. The two-day federal deadline signals that CISA has confirmed active exploitation is underway. No workaround is available for unpatched systems.

The TeamPCP supply chain campaign that backdoored four SAP npm packages yesterday extended to the Python Package Index overnight. Malicious versions 2.6.2 and 2.6.3 of PyTorch Lightning were published to PyPI on April 30, 2026, carrying the same credential-stealing payload used in the SAP npm campaign. PyTorch Lightning is an open-source Python framework providing a high-level interface for PyTorch, used extensively in machine learning research, model training pipelines, and AI development environments. The project has over 31,100 stars on GitHub. Researchers from Aikido Security, OX Security, Socket, and StepSecurity identified the malicious versions within hours of publication. PyPI administrators quarantined both versions and they are no longer installable from the registry. The payload behavior matches the SAP campaign: a preinstall hook executes a credential stealer targeting GitHub tokens, npm tokens, cloud provider credentials, and Kubernetes secrets, then exfiltrates them to attacker-controlled public repositories. The extension to PyPI from npm in the same 24-hour window confirms TeamPCP is actively expanding its targeting across package ecosystems rather than being limited to a single registry.

Xint.io and Theori researchers disclosed CVE-2026-31431, a local privilege escalation vulnerability in the Linux kernel dubbed Copy Fail. The flaw allows any unprivileged local user to write exactly four bytes into arbitrary positions in the page cache, the in-memory representation of filesystem data. That seemingly small write capability is sufficient to corrupt kernel data structures in a way that results in root-level code execution. The vulnerability affects Ubuntu, Debian, Fedora, and Red Hat Enterprise Linux across a range of kernel versions. Patches are available from all major distribution maintainers. Public proof-of-concept exploit code has been released alongside the disclosure. The researchers confirmed reliable exploitation on current versions of the affected distributions. The CVSS score of 7.8 reflects the local access requirement. Remote exploitation is not possible directly, but the flaw becomes highly significant in any environment where an attacker has achieved limited initial access and needs to escalate privileges.