Supply chain attacks keep dominating: npm rolled out 2FA-gated publishing, LiteSpeed’s cPanel plugin is being exploited for root (CVE-2026-48172), a Drupal SQL injection landed in CISA KEV, and eight Packagist packages shipped Linux malware. Plus: the first VPN provider dismantled over ransomware facilitation. This week’s threat intel, distilled.
This week’s must-act items: (1) update the LiteSpeed cPanel plugin — CVE-2026-48172 is actively exploited for root RCE on shared hosting; (2) patch Drupal core — its SQL injection is in CISA KEV under active exploitation; (3) enable 2FA on npm (now mandatory for publishing); (4) audit for the 8 Packagist packages infected with Linux malware; (5) patch Cisco Secure Workload’s CVSS 10.0 REST API flaw. Also this week: law enforcement dismantled a VPN provider used by 25 ransomware groups.
npm Introduces 2FA-Gated Publishing Controls
The npm registry has rolled out mandatory two-factor authentication for package publishing, a move that could fundamentally change the JavaScript supply chain security landscape. The new controls require publishers to enable 2FA before pushing packages, making it significantly harder for attackers to hijack accounts and publish malicious packages.
Why it matters: npm powers over 2 million packages and is the backbone of modern web development. Account takeovers have been a persistent attack vector — this change directly addresses that risk at the registry level. It follows the same month’s node-ipc backdoor compromise, where three package versions shipped a credential stealer.
Action Items
- Enable 2FA on all npm accounts immediately if not already done
- Review your package dependencies for any recently published versions from maintainers with new ownership
- Consider pinning exact versions in your lockfiles
CVE-2026-48172: LiteSpeed cPanel Plugin Exploited for Root Access
A critical vulnerability in the LiteSpeed cPanel plugin (CVE-2026-48172) is being actively exploited to execute arbitrary scripts as root on shared hosting environments. This is particularly concerning because LiteSpeed is deployed across thousands of hosting providers globally.
Impact: Remote code execution as root — complete server compromise.
What to Do
- Update LiteSpeed cPanel plugin to the latest version immediately
- If you’re on shared hosting, contact your provider to confirm patching
- Review server logs for suspicious root-level commands
- Rotate any credentials stored on affected servers
Drupal Core SQL Injection Under Active Exploitation
A SQL injection vulnerability in Drupal core has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The flaw allows unauthenticated attackers to extract sensitive data from Drupal installations.
Mitigation Steps
- Apply the latest Drupal security update immediately — this is not optional
- CISA’s Binding Operational Directive (BOD) 22-01 requires federal agencies to patch within 15 days
- Run WAF rules to block known exploitation patterns as a temporary measure
- Audit database access logs for signs of data exfiltration
Packagist Supply Chain Attack: 8 Packages Infected with Linux Malware
Eight PHP packages on Packagist were compromised using GitHub-hosted Linux malware. The attack demonstrates the growing sophistication of supply chain attacks targeting the PHP ecosystem — attackers are no longer just injecting malicious code, they’re delivering full malware payloads through legitimate package managers.
Pattern: This mirrors similar attacks seen on npm, PyPI, and RubyGems in recent months — the same cross-ecosystem supply chain escalation pattern tracked all quarter.
Claude Mythos AI Discovers 10,000+ High-Severity Flaws
Claude Mythos AI, an AI-powered security research tool, has identified over 10,000 high-severity vulnerabilities across widely used software. This represents a new era of AI-assisted vulnerability discovery — the scale is unprecedented and raises questions about responsible disclosure and patch management capacity.
First VPN Provider Dismantled Over Ransomware Facilitation
In a landmark operation, law enforcement dismantled a VPN provider used by 25 ransomware groups. This signals a shift in how authorities approach the infrastructure that enables cybercrime — going beyond arresting operators to taking down the services themselves.
Cisco Patches CVSS 10.0 Secure Workload REST API Flaw
Cisco addressed a maximum-severity vulnerability (CVSS 10.0) in its Secure Workload product’s REST API. The flaw could allow unauthenticated remote attackers to access sensitive data. A perfect 10.0 score is rare and demands immediate patching.
The Week at a Glance
| Item | Severity | Status | Action |
|---|---|---|---|
| LiteSpeed cPanel plugin CVE-2026-48172 | Critical (root RCE) | Actively exploited | Update plugin now |
| Drupal core SQLi | Critical | CISA KEV, active | Patch to latest core |
| Cisco Secure Workload REST API | Critical (CVSS 10.0) | Patch available | Update product |
| Packagist 8 packages | High (Linux malware) | Packages pulled | Audit dependencies |
| npm publishing 2FA | Hardening | Now mandatory | Enable + audit maintainer changes |
| Ransomware VPN takedown | Enforcement | 25 groups affected | Reassess threat infrastructure intel |
Key Takeaways for Security Teams
- Supply chain security is non-negotiable. Enable 2FA everywhere, pin dependencies, audit your SBOM.
- Patch management velocity matters. CVE-2026-48172 and the Drupal SQL injection are both under active exploitation.
- Shared hosting = shared risk. If your provider hasn’t patched LiteSpeed, escalate immediately.
- AI-powered discovery is scaling. Expect more vulnerabilities to be found faster — your patching process needs to keep up.
- Infrastructure takedowns are the new normal. Law enforcement is going after the enablers, not just the perpetrators.
Recommended Actions This Week
- Update LiteSpeed cPanel plugin on all servers
- Patch any Drupal installations to the latest version
- Enable 2FA on npm, PyPI, and all package registry accounts
- Review Packagist dependencies for the 8 compromised packages
- Update Cisco Secure Workload if deployed in your environment
- Run a full dependency audit using your SBOM tools
Frequently Asked Questions
What is CVE-2026-48172 and how bad is it?
It’s a critical flaw in the LiteSpeed cPanel plugin, actively exploited to execute arbitrary scripts as root on shared hosting. Impact is complete server compromise. Update the plugin immediately; if you’re on shared hosting, press your provider to confirm patching.
Why is the Drupal SQL injection urgent?
It’s in CISA’s Known Exploited Vulnerabilities catalog — confirmed in-the-wild exploitation, and BOD 22-01 obliges federal agencies to patch within 15 days. The flaw lets unauthenticated attackers extract sensitive data. Patch Drupal core to the latest version now and audit DB logs for exfiltration.
What does npm’s 2FA mandate mean for developers?
Publishing now requires two-factor authentication on your npm account. Enable it immediately, review dependencies for versions published by newly-changed maintainers, and pin exact versions in lockfiles to shrink the window for account-takeover-driven package pushes.
How should teams respond to the Packagist malware packages?
Identify whether any of the 8 compromised PHP packages are in your dependency tree, remove/quarantine them, rotate credentials on systems where they ran, and audit SBOMs — the GitHub-hosted Linux malware delivered through them mirrors recent npm/PyPI/RubyGems campaigns.
References
- NVD — CVE-2026-48172 (LiteSpeed cPanel plugin)
- CISA — Known Exploited Vulnerabilities catalog additions (May 2026)
- Cisco — Secure Workload REST API security advisory (CVSS 10.0)
- npm registry blog — 2FA-gated publishing announcement
- Hmmnm — Node-IPC Supply Chain Attack (2026)
- Hmmnm — Bleeding Llama Supply Chain Attack
- Hmmnm — Cybersecurity Threat Briefing: May 2026
