Summary
A routine npm install can now open the door to covert compromise, as PolinRider quietly backdoors ten hijacked packages and reroutes infected systems through public Ethereum RPC endpoints. Cyware spotlights how this supply-chain attack risks leaked credentials and tampered builds for development teams, with a single IP—95[.]135[.]181[.]151—flagged for immediate blocking.
A critical authentication bypass in cPanel & WHM, tracked as CVE-2026-41940, is fueling mass exploitation across hosting providers. Attackers began leveraging this flaw as a zero-day on April 3, 2026, and widespread attacks erupted after technical details leaked, prompting urgent patching and forensic reviews for compromised SSH keys and web shells.
A breach in Web3Auth has drained approximately $1 million from Keplr crypto wallets linked to Google or Apple sign-ins, impacting about 20% of those accounts. The attackers exploited a private key exposure, forcing Web3Auth to transfer funds into recovery wallets and suspend its embedded wallet service to contain further losses.
Top Malware Reported in the Last 24 Hours
PolinRider backdoors hijacked npm packages
PolinRider has resurfaced in a supply-chain push that backdoors 10 hijacked npm packages and can quietly steer infected systems to new payload servers without updating the compromised package. It stands out by avoiding reliance on installation scripts, and by using two JavaScript loader variants—one built around eval(atob(...)) and another that rebuilds code through character permutation—to sidestep common detection signatures. The malware queries public Ethereum RPC endpoints and falls back to Blockscout to discover where to fetch next-stage code, giving operators a flexible way to redirect victims on demand. The affected packages named in the report are: @adminide-stack/client-redux, @adminide-stack/health-api-server, @adminide-stack/user-activity-browser, @adminide-stack/utils, server-hemera-mongo, cdeops, @adminide-stack/forms-core, @adminide-stack/yantra-help-browser, @cdmbase/wiki-browser, and @pubngo-stack/help-browser. For development teams, this kind of compromise can turn routine installs into a covert foothold that risks leaked credentials and tampered builds; the report advises inspecting environments for the affected packages, isolating compromised hosts, rotating credentials, and blocking 95[.]135[.]181[.]151.
NotC2 hides C2 inside AWS
NotC2 is a proof-of-concept command-and-control framework that abuses AWS services—SQS, Lambda, SNS, and Amazon Bedrock—to blend attacker activity into trusted cloud infrastructure using stolen cloud credentials. Instead of keeping a persistent connection, it uses an asynchronous design where AWS services relay commands and results, which can make malicious traffic look like routine cloud operations. Amazon Bedrock adds a twist by enabling natural-language style tasking that lowers the skill needed for reconnaissance, while overprivileged execution roles can widen the blast radius into discovery or destructive actions. The write-up’s defensive guidance centers on tightening IAM through strict least-privilege policies and watching for suspicious relationships across CloudTrail, Lambda logs, SNS delivery records, and Bedrock invocation logs. It also calls for correlating infrastructure creation, queue-to-function mappings, role assignments, and unexpected Bedrock use to surface behavior that would otherwise hide in normal cloud telemetry.
Top Vulnerabilities Reported in Last 24 hours
cPanel zero-day bypass sparks mass attacks
Attackers exploited a critical authentication-bypass flaw in cPanel & WHM (CVE-2026-41940) to gain access without a valid login, turning a widely used hosting control panel into an easy entry point for takeover. The issue stems from unsanitized input in session files, and it affects cPanel and WHM versions after 11.40 (including WP Squared builds through 11.136.1.6), raising the stakes for hosting providers and their customers. Attackers are already exploiting this in the wild: exploitation began as a zero-day on April 3, 2026, and mass exploitation was observed starting April 30 after technical details circulated. CrowdStrike and Singapore’s Cyber Security Agency were credited with identifying the issue. A patch was released on April 28, 2026, and incident response guidance in the reporting includes conducting audits for SSH keys/cron jobs/web shells, forcing password resets for root and WHM users, and reviewing logs for signs of compromise.
ModSecurity upload bypass risks WAF users
Two high-severity flaws in ModSecurity WAF—CVE-2026-104269 and CVE-2026-73857—could let attackers slip past file-upload protections and, in some cases, potentially reach remote code execution or trigger denial-of-service conditions. In CVE-2026-104269, a multipart parsing mismatch means OWASP CRS upload-related rules 920120, 922100, and 922110 can be bypassed, affecting environments where applications in Go, Python, Node.js, and Java interpret filenames differently than the WAF expects. For CVE-2026-73857, an uninitialized pointer dereference in the XML request body processor can lead to crashes and potentially code execution if attackers can influence memory behavior. No active exploitation was explicitly confirmed in the source material, but the write-ups describe realistic attack paths that put exposed upload workflows at risk. The issues were reported by researchers 0xkalawy and ZeyadZonkorany (CVE-2026-104269) and Tobias Klein (CVE-2026-73857); a fix is available by upgrading libmodsecurity3 to 3.0.17, and recommended hardening steps highlighted include validating file extensions/content using the decoded filename, storing uploads outside the web root, and testing upload rules with filename* payloads.
Web3Auth breach drains Keplr wallets
A security flaw in Web3Auth was exploited to steal funds from Keplr crypto wallets tied to Google or Apple sign-ins, with reporting estimating about $1 million stolen and roughly 20% of those login-linked accounts affected. The incident centered on a private key breach, meaning attackers could move funds as if they were the legitimate user—an especially personal kind of compromise in consumer crypto. Attackers already exploited this in the wild, prompting an urgent response rather than a theoretical warning. Web3Auth said it proactively used the attacker’s route to transfer funds into recovery wallets, with the first such transfers occurring 21 minutes before the public notice, and it paused its embedded wallet service due to broader downstream impact. User guidance in the coverage includes moving unstaked funds to accounts secured by a recovery phrase or hardware wallet and ignoring direct messages or links offering “recovery.”
Frequently Asked Questions
What is PolinRider? PolinRider has resurfaced in a supply-chain push that backdoors 10 hijacked npm packages and can quietly steer infected systems to new payload servers without updating the compromised package. It stands out by avoiding reliance on installation scripts, and by using two JavaScript loader variants—one built around eval(atob(...)) and another that rebuilds code through character permutation—to sidestep common detection signatures.
What is NotC2? NotC2 is a proof-of-concept command-and-control framework that abuses AWS services—SQS, Lambda, SNS, and Amazon Bedrock—to blend attacker activity into trusted cloud infrastructure using stolen cloud credentials. Instead of keeping a persistent connection, it uses an asynchronous design where AWS services relay commands and results, which can make malicious traffic look like routine cloud operations.
What is CVE-2026-41940? Attackers exploited a critical authentication-bypass flaw in cPanel & WHM (CVE-2026-41940) to gain access without a valid login, turning a widely used hosting control panel into an easy entry point for takeover. The issue stems from unsanitized input in session files, and it affects cPanel and WHM versions after 11.40 (including WP Squared builds through 11.136.1.6), raising the stakes for hosting providers and their customers.
What is CVE-2026-104269? Two high-severity flaws in ModSecurity WAF—CVE-2026-104269 and CVE-2026-73857—could let attackers slip past file-upload protections and, in some cases, potentially reach remote code execution or trigger denial-of-service conditions. In CVE-2026-104269, a multipart parsing mismatch means OWASP CRS upload-related rules 920120, 922100, and 922110 can be bypassed, affecting environments where applications in Go, Python, Node.js, and Java interpret filenames differently than the WAF expects.
What is Web3Auth? A security flaw in Web3Auth was exploited to steal funds from Keplr crypto wallets tied to Google or Apple sign-ins, with reporting estimating about $1 million stolen and roughly 20% of those login-linked accounts affected. The incident centered on a private key breach, meaning attackers could move funds as if they were the legitimate user—an especially personal kind of compromise in consumer crypto.