TSUBAME Report Overflow (Apr-Jun 2026)

The TSUBAME quarterly monitoring report (Apr–Jun 2026) describes a sharp early-May increase in Mirai-like scanning and probable infection activity targeting TCP/23, possibly associated with exploitation of a cPanel/WHM authentication bypass (CVE-2026-41940). The surge was globally distributed—most notably in the United States, Europe, Canada, and Japan—with many source IPs tied to hosting providers exposing cPanel interfaces; the report compares sensor and port-targeting trends and recommends prompt patching, restricting remote access, and investigating suspected infections.