3 easy-to-miss cybersecurity risks for small businesses

Malwarebytes Labs roundup (Apr–May 2026) covering multiple active risks: an actively exploited cPanel/WHM bug that can let attackers access sites without credentials; widespread scams abusing PayPal and Apple notifications to funnel victims to fake tech‑support numbers; fake CAPTCHA pages that rack up international SMS charges; large-scale Roblox account theft via trojanized “game enhancements”; a malicious trading site dropping a browser‑takeover malware; trojanized installers (e.g., fake Google Antigravity) stealing accounts; a researcher claim that Claude Desktop installed spyware on macOS;