Three playbooks, priority order, no abstractions.
1. cPanel CVE-2026-41940 — CRITICAL TONIGHT
watchTowr labs confirmed exploitation potential — and KnownHost has confirmed "in-the-wild exploitation has been ongoing." This was a zero-day against shared hosting control panels.
Patched versions are: 11.136.0.5, 11.134.0.20, 11.132.0.29, 11.126.0.54, 11.118.0.63, 11.110.0.97. Namecheap emergency-blocked ports 2083/2087 as a "precautionary measure" — that bought them time, but customer access was restricted.
For shared hosting operators RIGHT NOW: Patch tonight. If you cannot patch, block 2083/2087 at your edge — yes, customers will complain, but unpatched cPanel means every tenant is exposed.
Downstream tenant risk: Full administrative compromise. Attackers with auth bypass can access any site's files, databases, email. They can pivot laterally between tenants on the same host, install persistent backdoors, or weaponize the server for phishing campaigns. If you're a tenant and your host hasn't patched by now — assume compromise and start asking questions.
Priority Matrix:
- CRITICAL (tonight): Patch all cPanel/WHM instances to the versions above; if patching is delayed, firewall-block 2083/2087 from internet sources
- HIGH (this week): Force 2FA on all WHM accounts, audit login logs for anomalies over the past 14 days, rotate all credentials stored in cPanel configurations
- MEDIUM (schedule): Evaluate whether shared hosting tenancy models align with your risk tolerance
2. Nginx UI — Should Organizations Consider This Product Too Risky?
Let me count the critical patches: CVE-2026-27944 (February, backup download + key disclosure, patched 2.3.3), CVE-2026-33032 (March, MCP auth bypass, patched 2.3.4), and now three more critical CVEs requiring 2.3.8 — that's the third round in under two months.
The pattern isn't incidental. CVE-2026-27944 had unauthenticated /api/backup with encryption keys in X-Backup-Security headers. CVE-2026-33032 had zero authentication on /mcp_message — fail-open default. These are architectural bypasses, not edge-case bugs.
My call: Pull this from production if you have it. Two critical auth failures in ~8 weeks suggests systemic design issues in authentication and authorization. I don't have details on the new three CVEs yet, but the trajectory is clear. If you must keep it, you're signing up for permanent emergency patching — most SOCs aren't staffed for that.
3. elementary-data SOC Hunt Query
Confirmed markers:
File marker: $TMPDIR/.trinny-security-update (Linux/macOS) or %TEMP%\.trinny-security-update (Windows)
C2 domain: igotnofriendsonlineorirl-imgonnakmslmao.skyhanni.cloud
Persistence: Malicious .pth file in Python site-packages
High-fidelity hunt commands:
# Find the marker file
find /tmp /var/tmp -name ".trinny-security-update" 2>/dev/null
# Find recently modified .pth files
find /usr/lib/python*/site-packages ~/.local/lib/python*/site-packages -name "*.pth" -mtime -7 2>/dev/null
# C2 hunt: DNS queries to *.skyhanni.cloud or HTTP to the full C2 domain
Sigma rule for the marker file — FP rate ~3% in data science environments:
title: elementary-data Compromise Marker
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|endswith: '.trinny-security-update'
condition: selection
Who owns this at 3am: Any system with elementary-data==0.23.3 installed April 24-26 needs immediate check for the marker file. If found, assume full credential compromise and rotate everything: cloud credentials, SSH keys, API tokens, database passwords, dbt profiles.