Cybersecurity briefing, 2026-04-01

Here is your PlainSec briefing for Wednesday, April 1st.

• Active Dawn zero-day in Chrome enables sandbox escape
• TrueConf update flaw lets attackers reach isolated government networks
• Critical Citrix NetScaler bug lets attackers steal admin sessions
• CISA adds F5 BIG‑IP APM RCE flaw to KEV
• Google Cloud warns of kernel, Envoy, and Vertex AI flaws
• UNC1069 expands Node.js supply chain attacks beyond Axios
• Unauthenticated shell via MAVLink enables remote command execution
• WhatsApp VBS drops renamed Windows tools, MSI backdoors
• Extradited Huione executive signals crackdown on scam financial infrastructure
• Default Vertex AI Agent permissions expose Cloud data
• VenomStealer campaign update
• Open-source AI runtime breach disrupts vendor trust and operations
• CrewAI Code Interpreter flaws let agents escape sandboxes
• Supply-chain actor built reusable cache of stolen build secrets
• Iran signals US tech firms could become military targets
• Preinstalled GIGABYTE utility allows unauthenticated arbitrary file write
• Trojanized LiteLLM package executed multi-stage supply-chain attack
• Backdoored LiteLLM packages exfiltrated secrets and built backdoors

Recent editions

• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories
• Monday, March 30, 2026: Intesa Sanpaolo fined €31.8M over employee snooping · 6 stories
• Sunday, March 29, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 12 stories
• Saturday, March 28, 2026: TeamPCP pauses new supply-chain compromises, monetizes haul · 14 stories
• Friday, March 27, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 31 stories
• Thursday, March 26, 2026: Iran-related cyber campaigns spike with wipers and ransomware · 19 stories
• Wednesday, March 25, 2026: Trivy GitHub Actions compromise exposes CI/CD secrets · 12 stories