Intel Chain
FOLLOW-UP: CVE-2026-39987 assessment revised based on exploit telemetry collected initially. Incident telemetry now indicates attack surface is narrower than previously assessed—exploitation requires specific PHP version combinations present in approximately 3.2% of affected deployments rather than the 18% estimated two days ago. Mitigation priority has been downgraded from critical to high-priority based on revised attack vector analysis.
Evidence Chain (1 linked intel)
A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of managed service providers (MSPs) and hosting providers in the Philippines, Laos, Canada, South Africa, and the U.S., by exploiting the recently disclosed vulnerability in cPanel. The activity, detected by Ctrl-Alt-Intel on May 2, 2026, involves the Source: The Hacker News
Have related intel?
Corroborate, contradict, or expand this intelligence chain.