Cybersecurity briefing, 2026-04-04

Here's your PlainSec briefing for Saturday, April 4th.

• Cloud Account Takeover After Trivy Supply-Chain Compromise
• Next.js React2Shell Exploit Automates AI and Cloud Credential Theft
• Chinese Hackers Exploit TrueConf Auto-Update to Deploy Espionage Tools
• FortiClient EMS Hotfixes Leave Uncertainty for 8.0 Users
• Active Dawn Zero-Day in Chrome Enables Sandbox Escape
• Axios npm Maintainer Account Hijacked to Push Self-Cleaning RAT
• Unauthenticated RCE Chain Exposes Customer Data in ShareFile Storage Zones
• Chinese APT TA416 Resumes Stealthy Espionage on European Diplomats
• FCC Targets Voice Providers for Routing Scam Calls via Dormant Accounts
• AI-Driven Actor Ran Six Waves of GitHub pull_request_target Abuse
• Open-Source AI Runtime Breach Disrupts Vendor Trust and Operations
• Qilin Ransomware Steals Internal and Employee Data from German Party