Cybersecurity briefing, 2026-04-03

Here's your PlainSec briefing for Thursday, April 3rd.

• Cloud account takeover after Trivy supply-chain compromise
• Next.js React2Shell exploit automates AI and cloud credential theft
• TrueConf update flaw lets attackers reach isolated government networks
• Active Dawn zero-day in Chrome enables sandbox escape
• Unauthenticated RCE chain exposes customer data in ShareFile Storage Zones
• F5 BIG-IP APM flaw reclassified as critical RCE with active exploitation
• Google Cloud Linux kernel flaws enable privilege escalation on container nodes
• FCC targets voice providers for routing scam calls via dormant accounts
• UNC1069 expands Node.js supply chain attacks beyond Axios
• Cisco security advisory: Cisco Integrated Management Controller authentication bypass vulnerability
• Java deserialization RCE in Hitachi Energy Ellipse reporting component
• Cisco IMC command injection lets read-only users execute as root
• Attackers exploit Vite dev server feature to steal files
• Qilin ransomware steals internal and employee data from German party
• Hims & Hers support ticket breach exposes sensitive customer data
• TeamPCP compromises LiteLLM PyPI package, steals credentials
• State-backed hackers target personal messaging apps to bypass corporate controls
• Siemens SICAM 8 firmware flaws cause denial of service via resource exhaustion
• Akira executes full ransomware attacks in under one hour
• REF1695 campaign update

Recent editions

• Thursday, April 2, 2026: Active Dawn zero-day in Chrome enables sandbox escape · 27 stories
• Wednesday, April 1, 2026: TrueConf update flaw lets attackers reach isolated government networks · 18 stories
• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories
• Monday, March 30, 2026: Intesa Sanpaolo fined €31.8M over employee snooping · 6 stories
• Sunday, March 29, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 12 stories
• Saturday, March 28, 2026: TeamPCP pauses new supply-chain compromises, monetizes haul · 14 stories
• Friday, March 27, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 31 stories