Patch/Configuration Management

The vulnerabilities, identified as CVE-2026-3965 and CVE-2026-4047, affect Qinglong versions 2.20.1 and older.

The vulnerability stems from a Carriage Return Line Feed (CRLF) injection flaw within the login and session loading processes of cPanel & WHM.

The flaw, CVE-2026-40321, affects the popular open-source platform built on Microsoft technology.

The Windows flaw stems from an incomplete patch of a vulnerability exploited by APT28.

The vulnerability, CVE-2026-3854, arises from improper handling of special elements within GitHub Enterprise Server.

New Windows flaw stems from incomplete fix for APT28-exploited bugs SecurityWeek reports that Microsoft's deficient February patch for the high-severity Windows SmartScreen and Shell prompt bypass bug CVE-2026-21510, which has been exploited by the Russia-linked advanced persistent threat group APT28, has resulted in the new authentication coercion zero-click bug, tracked as CVE-2026-32202.

The vulnerability, discovered by Silverfort researchers, resided in the Agent ID Administrator role.