Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CVE-2026-55040, a critical SharePoint authentication bypass, is now being actively exploited. A proof-of-concept went public on August 11. Within 24 hours, threat intelligence firm Defused confirmed exploitation attempts against its SharePoint honeypots using that same PoC. Over 8,500 SharePoint servers remain reachable from the open internet, putting unpatched instances at immediate risk.

Hosting environments run on a basic assumption: an account with limited permissions should stay limited. CVE-2026-58048 breaks that assumption inside cPanel & WHM. Any authenticated account with MySQL or MariaDB feature access, including a standard low-privilege hosting account, can now escalate to root-level database privileges through a database rename operation. A public proof-of-concept already exists, which means the barrier to exploitation is low and the window to act is short.

For the last several months, we have run AI agents against real production applications across industries. Two questions drove the work: what does AI-powered vulnerability analysis and pentesting surface at scale, and what does protection have to look like to keep pace. The vulnerability discovery side confirmed what Mythos made impossible to ignore.