Cybersecurity briefing, 2026-04-05

Here is your PlainSec briefing for Sunday, April 5th.

• Next.js React2Shell exploit automates AI and cloud credential theft
• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• Cloud account takeover after Trivy supply-chain compromise
• UNC1069 expands Node.js supply chain attacks beyond Axios
• AI-driven actor ran six waves of GitHub pull_request_target abuse
• Open-source AI runtime breach disrupts vendor trust and operations

Recent editions

• Saturday, April 4, 2026: Cloud account takeover after Trivy supply-chain compromise · 12 stories
• Friday, April 3, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 20 stories
• Thursday, April 2, 2026: Active Dawn zero-day in Chrome enables sandbox escape · 27 stories
• Wednesday, April 1, 2026: TrueConf update flaw lets attackers reach isolated government networks · 18 stories
• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories
• Monday, March 30, 2026: Intesa Sanpaolo fined €31.8M over employee snooping · 6 stories
• Sunday, March 29, 2026: Coruna exploit kit recycles Triangulation iOS zero‑days · 12 stories