Week of April 27, 2026: ADT Breach Disclosure and UK Biobank Data Exposure

Security leaders tracked ADT's confirmation of a customer data breach, the UK government's disclosure that half a million UK Biobank volunteer records had appeared for sale on Alibaba, and CISA warnings of active exploitation against a cPanel zero-day, a Windows Shell spoofing flaw, and a nine-year-old Linux kernel bug. CISA and federal partners also published new guidance covering agentic AI adoption and zero trust for operational technology.

ADT Confirms Breach Affecting Customer Data

ADT, the Florida-based alarm monitoring provider, confirmed that hackers accessed a limited set of customer and prospective customer data after detecting unauthorized access on April 20. The company said the exposed information included names, phone numbers, and addresses, with dates of birth and partial Social Security or Tax ID numbers affected in a small percentage of cases. The ShinyHunters group claimed responsibility, alleging more than 10 million records were taken, while Have I Been Pwned listed approximately 5.5 million records as exposed. ADT said payment data and security systems were not affected. (Help Net Security)

UK Confirms Biobank Data Listed for Sale on Alibaba

UK technology minister Ian Murray told the House of Commons that the UK Biobank had identified three online listings on the Chinese marketplace Alibaba offering participant data for sale, with at least one dataset appearing to include information relating to all 500,000 volunteers. The listings were removed following cooperation with the Chinese government, and UK Biobank revoked access for the research institutions identified as the data's source. UK Biobank temporarily suspended access to its research platform and introduced file-size limits to restrict how much de-identified data can be exported. (Help Net Security)

cPanel Zero-Day Exploited for Months Before Patch

WebPros published a security advisory for CVE-2026-41940, a critical authentication bypass affecting cPanel and WHM, on April 28 and released fixes hours later, after researchers found the flaw had been exploited in the wild since February 23. The vulnerability lets unauthenticated attackers manipulate session cookies to gain administrator-level access to hosted servers. Hosting providers including KnownHost began blocking WHM/cPanel login ports as the advisory went out. CISA added CVE-2026-41940 to its Known Exploited Vulnerabilities catalog on April 30, citing evidence of active exploitation. (Help Net Security)

CISA, Microsoft Warn of Active Exploitation of Windows Shell Flaw

CISA and Microsoft warned that attackers were actively exploiting CVE-2026-32202, a zero-click Windows Shell spoofing vulnerability that lets a victim's machine authenticate to an attacker's server merely by opening a folder containing a malicious shortcut file. The flaw stemmed from an incomplete fix for two vulnerabilities patched in February 2026 that had been exploited by APT28. Microsoft issued a patch for CVE-2026-32202 on April 14 without flagging it as exploited; confirmation of active exploitation followed more than two weeks later. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on April 28. (Help Net Security)

CISA and International Partners Release Agentic AI Security Guidance

CISA, the Australian Signals Directorate's Australian Cyber Security Centre, and other international partners published joint guidance on securing agentic AI systems used in critical infrastructure and defense sectors. The guide addresses risks including expanded attack surface, privilege creep, behavioral misalignment, and obscure event records, and recommends avoiding broad or unrestricted access, starting with low-risk use cases, and incorporating agentic AI into existing risk postures. CISA Acting Director Nick Andersen said the guidance helps developers, vendors, and operators align agentic AI adoption with cybersecurity requirements. (CISA)

CISA and Federal Partners Issue Zero Trust Guidance for OT

CISA, together with the Department of War, Department of Energy, FBI, and Department of State, published joint guidance on applying zero trust principles to operational technology environments. The guidance addresses asset visibility, supply chain risk, and identity and access management as OT systems become more interconnected and remotely controlled. FBI Cyber Division Assistant Director Brett Leatherman noted that nation-state actors are pre-positioning on OT networks, while CISA's Chris Butera said zero trust architecture is critical to preventing loss of control of essential systems. (CISA)

Nine-Year-Old Linux Kernel Flaw Enables Reliable Privilege Escalation

Researchers at Theori disclosed CVE-2026-31431, nicknamed Copy Fail, a high-severity local privilege escalation flaw affecting Linux kernels shipped since 2017, along with a public proof-of-concept exploit. The bug lets an unprivileged local user write four controlled bytes into the page cache of any readable file to gain root access, without needing to win a race condition as earlier Linux LPE flaws required. Ubuntu, Amazon Linux, RHEL, and SUSE were confirmed vulnerable. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 1 and set a May 15 remediation deadline for federal agencies. (Help Net Security)