New Bluekit phishing service includes an AI assistant, 40 templates

Multiple high-impact threats reported: a new Bluekit phishing-as-a-service offers >40 templates and an AI assistant to speed campaign creation; a critical authentication-bypass in cPanel/WHM (CVE-2026-41940) is being actively exploited with PoC available and emergency updates issued; a widespread Linux local privilege escalation (‘Copy Fail’) allows unprivileged users to gain root on kernels since 2017 (exploit published); Qinglong task scheduler authentication-bypass/RCE is being abused to deploy cryptominers; official SAP npm packages were trojanized (TeamPCP supply-chain credential theft);