Dark Reading is celebrating its 20th anniversary by bringing back its "Name That Toon" contest, inviting readers to submit creative cybersecurity-related captions for a cartoon showing scenes from 2006 and 2026. Contestants have until May 26th to submit their entries via email or social media, with the winner receiving a twenty dollar gift card and having their caption published alongside the cartoon. This marks a nostalgic return of a feature that fans of the long-running cybersecurity publication may remember from years past.

South Carolina healthcare provider Sandhills Medical Foundation has disclosed a ransomware attack affecting nearly 170,000 patients, discovered in May 2025 but only publicly disclosed nearly a year later. The breach exposed highly sensitive information including social security numbers, financial data, driver's licenses, and personal health records. The Inc Ransom cybercrime group has since listed Sandhills Medical on its leak website and made the allegedly stolen files available for download.

A critical logic flaw dubbed "Copy Fail" in the Linux kernel has been discovered that allows unprivileged attackers to gain root access on systems running most Linux distributions since 2017. The vulnerability, tracked as CVE-2026-31431 with a severity score of 7.8, can be exploited using a simple 732-byte Python script to modify the in-memory copy of setuid-root binaries, posing particular risks to multi-tenant environments and shared containers. The bug stems from a 2017 optimization in the kernel's encryption template that inadvertently allows attackers to write code past designated memory boundaries, and organizations are urged to update immediately as all changes occur only in memory, leaving disk files unmodified and making detection difficult.

A critical authentication bypass vulnerability in cPanel and WebHost Manager has been exploited in the wild since February, allowing unauthenticated attackers to gain full administrative control over affected systems. The flaw, tracked as CVE-2026-41940 with a severity score of 9.8, affects all versions after 11.40 and could compromise all websites on shared hosting servers, with roughly 1.5 million internet-accessible cPanel instances potentially vulnerable. Major hosting providers immediately blocked access to cPanel ports after disclosure to deploy emergency patches, and administrators are being urged to update immediately or use available detection scripts to check for signs of compromise.

Security researchers at Claroty have discovered critical vulnerabilities in EnOcean's SmartServer IoT platform that could allow hackers to remotely take control of building management and automation systems used in smart buildings, factories, and data centers. The flaws enable attackers to bypass memory protections and execute arbitrary commands with root privileges on the Linux-based devices, potentially compromising internet-exposed systems. EnOcean has released a security update to patch the vulnerabilities, which also affect legacy i.LON devices.

Security researchers at Novee Security discovered a critical vulnerability in Google's Gemini CLI tool that could have allowed attackers to execute arbitrary code on host systems and carry out supply chain attacks. The flaw stemmed from Gemini CLI automatically trusting and loading agent configurations from workspace folders without any security checks or human approval, giving attackers with access to those folders the ability to steal credentials, tokens, and source code while gaining lateral movement to downstream systems. Google has since patched the vulnerability in both Gemini CLI and the associated GitHub Action.

Google has patched critical security vulnerabilities, including a maximum severity CVSS 10 flaw in the Gemini command-line interface that enabled remote code execution through continuous integration pipelines. The company also fixed similar issues in the Cursor code editor that could allow attackers to execute malicious code. These vulnerabilities posed serious risks to developers and organizations using these AI-powered development tools in their workflows.

A new Linux vulnerability dubbed "Copy Fail" has been discovered that could allow attackers to gain root access on major Linux distributions. The flaw affects the file copying mechanism and poses a significant security risk to systems running vulnerable versions of the operating system. Security researchers are urging Linux users to apply patches as soon as they become available from their distribution maintainers.

Cybersecurity researchers at Zscaler ThreatLabz have discovered a malware campaign where hackers are distributing EtherRAT malware by disguising it as legitimate administrative tools through fake GitHub repositories. The attackers are creating convincing facades of popular system administration utilities to trick users into downloading the malicious software. This technique leverages GitHub's trusted reputation to bypass security measures and deploy the remote access trojan on victims' systems.

A newly discovered Python-based backdoor is exploiting tunneling services to steal sensitive credentials from web browsers and cloud platforms. The malware establishes covert communication channels that bypass traditional security measures, allowing attackers to extract login information and authentication tokens without detection. Security researchers at Zscaler ThreatLabz are warning organizations to monitor for unusual tunneling traffic patterns as this attack method becomes increasingly popular among cybercriminals.