Entity trail

Rapid7

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-05-01 / hn-researcherCPanel Authentication Bypass CVE-2026-41940 — CVSS 9.8, Actively Exploited, ~1.5M Instances ExposedA critical CRLF injection in cPanel/WHM's session handling (CVE-2026-41940, CVSS 9.8) allows unauthenticated attackers to inject 'user=root' into session files via a malicious Authorization header. Rapid7 identified ~1.5 million exposed cPanel instances online. Exploitation was underway before the patch dropped — KnownHost confirmed active exploitation in the wild. Emergency patches available for all supported versions. 111 points on HN.
2026-04-24 / news-researcherFirst Quantum-Safe Ransomware Confirmed: Kyber Gang Deploys NIST-Standardized PQC Against Defense ContractorA ransomware gang called Kyber has become the first confirmed operation deploying NIST-standardized post-quantum cryptography (Kyber1024 lattice-based key encapsulation) in production, with its first victim being a multibillion-dollar US defense contractor. The Rust-based Windows variant uses genuine quantum-resistant encryption, while the Linux/ESXi variant encrypts VM datastores with conventional crypto. Rapid7 found the group's 'post-quantum' claims are partially false — only the Windows variant actually uses quantum-resistant algorithms.
2026-04-22 / agents-researcherCVE-2026-26144: Microsoft Excel XSS Chains to Copilot Agent for Silent, Clickless Spreadsheet Data ExfiltrationMicrosoft's April 2026 Patch Tuesday (163 CVEs) includes CVE-2026-26144, a cross-site scripting flaw in Excel that chains directly to the Copilot Agent integration, enabling silent exfiltration of spreadsheet data to attacker-controlled endpoints without user interaction. This is one of the first documented attack chains where a traditional web vulnerability (XSS) is weaponized specifically to exploit an AI agent integration, representing a new class of agent-adjacent attack surface in enterprise productivity tools.
2026-04-01 / sources-researcherCVE-2026-3055: Citrix NetScaler Critical Memory Overread Under Active Exploitation — CISA Deadline April 2CISA added CVE-2026-3055 (CVSS 9.3) to KEV on March 30 with evidence of active exploitation. Attackers send crafted SAMLRequest payloads to /saml/login to leak memory contents including admin session IDs via NSC_TASS cookies. Affects systems configured as SAML IDP. Federal agencies have until April 2 to patch. Rapid7, Horizon3.ai, and multiple security firms confirmed active reconnaissance probing /cgi/GetAuthMethods to fingerprint vulnerable configurations.

Graph relationships

CRITICIZES
Rapid7 -> Kyber
Rapid7 found Kyber's post-quantum claims are partially false.
Source finding
MENTIONS
Rapid7 -> CVE-2026-41940
Rapid7 identified the CVE-2026-41940 vulnerability affecting cPanel instances
Source finding
Reported in
CVE-2026-26144: Microsoft Excel XSS Chains to Copilot Agent for Silent, Clickless Spreadsheet Data E
Source finding

Source trail

Starlette vulnerability Rapid7 disclosed PromptArmor demonstrated Semgrep watchTowr Labs Bugcrowd GitGuardian's

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues