Cybersecurity briefing, 2026-04-09

Here's your PlainSec briefing for Wednesday, April 9th.

• Immediate remote code execution risk in Ninja Forms File Uploads
• macOS ClickFix bypass uses Script Editor to evade Terminal warnings
• Hack-for-hire campaign combines phishing and Android spyware in MENA
• GitHub Releases used to spread clipboard-stealing trojan
• AI-powered vulnerability discovery centralized among tech giants
• Corporate wallet breach drains $3.6M from Bitcoin Depot
• APT28 expands supply-chain attacks using fresh Office zero-days
• Iran-linked hackers pause US attacks but keep targeting Israel
• Flatpak sandbox escape exposes Linux hosts to full compromise
• Adobe Reader zero-day uses stealthy fingerprinting before RCE
• Chained RCE in ActiveMQ Classic bypasses authentication

Recent editions

• Wednesday, April 8, 2026: Attackers exploit both decade-old and new flaws in federal systems · 14 stories
• Tuesday, April 7, 2026: FortiClient EMS hotfixes leave uncertainty for 8.0 users · 13 stories
• Monday, April 6, 2026: Developer machines became high-yield credential farms in LiteLLM supply-chain attack · 5 stories
• Sunday, April 5, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 6 stories
• Saturday, April 4, 2026: Cloud account takeover after Trivy supply-chain compromise · 12 stories
• Friday, April 3, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 20 stories
• Thursday, April 2, 2026: Active Dawn zero-day in Chrome enables sandbox escape · 27 stories