Cybersecurity briefing, 2026-04-07

• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• AI workflow Builder flaw enables full server takeover
• Storm-1175's rapid exploits extend beyond initial web breach
• Docker AuthZ bypass reopens host compromise risk
• Google Cloud issues multiple Linux kernel privilege escalation fixes for GKE nodes
• Kubernetes attacks spike as React2Shell enables cloud identity theft
• APT28 uses compromised routers to steal credentials via DNS hijacking
• Shadow AI in healthcare creates blind spots that hinder incident response
• DPRK hackers use GitHub and Korean docs for persistent espionage
• Single vulnerable driver disables 300+ EDRs, undermining endpoint diversity
• Ransomware extortion targets German political party for coercion
• Spyware maker conviction sets U.S. criminal precedent after a decade
• Cultural interview checks expose North Korean impostors in real time

Recent editions

• Monday, April 6, 2026: Developer machines became high-yield credential farms in LiteLLM supply-chain attack · 5 stories
• Sunday, April 5, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 6 stories
• Saturday, April 4, 2026: Cloud account takeover after Trivy supply-chain compromise · 12 stories
• Friday, April 3, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 20 stories
• Thursday, April 2, 2026: Active Dawn zero-day in Chrome enables sandbox escape · 27 stories
• Wednesday, April 1, 2026: TrueConf update flaw lets attackers reach isolated government networks · 18 stories
• Tuesday, March 31, 2026: Critical Citrix NetScaler memory leak now exploited; admin sessions at risk · 10 stories