Cybersecurity briefing, 2026-04-04

Here's your PlainSec briefing for Saturday, April 4th.

• Cloud account takeover after Trivy supply-chain compromise
• Next.js React2Shell exploit automates AI and cloud credential theft
• Chinese hackers exploit TrueConf auto-update to deploy espionage tools
• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• Active Dawn zero-day in Chrome enables sandbox escape
• Axios npm maintainer account hijacked to push self-cleaning RAT
• Unauthenticated RCE chain exposes customer data in ShareFile Storage Zones
• Chinese APT TA416 resumes stealthy espionage on European diplomats
• FCC targets voice providers for routing scam calls via dormant accounts
• AI-driven actor ran six waves of GitHub pull_request_target abuse
• Open-source AI runtime breach disrupts vendor trust and operations
• Qilin ransomware steals internal and employee data from German party

Recent editions

• Friday, April 3, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 20 stories
• Thursday, April 2, 2026: Active Dawn zero-day in Chrome enables sandbox escape · 27 stories
• Wednesday, April 1, 2026: TrueConf update flaw lets attackers reach isolated government networks · 18 stories
• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories
• Monday, March 30, 2026: Intesa Sanpaolo fined €31.8M over employee snooping · 6 stories
• Sunday, March 29, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 12 stories
• Saturday, March 28, 2026: TeamPCP pauses new supply-chain compromises, monetizes haul · 14 stories