Cybersecurity briefing, 2026-04-11

Two critical vulnerabilities in Chrome's machine learning engine could let attackers escape the browser sandbox and run code on your machine.

• Default password flaw enables immediate remote takeover of Juniper collectors
• Marimo advisory details enabled exploits within hours
• Signed CPUID installers delivered malware via DLL sideloading
• Docker AuthZ bypass reopens host compromise risk
• Backdoored Smart Slider update delivered via official channel
• Session replay enables silent payroll theft in Microsoft 365 phishing
• macOS ClickFix bypass uses Script Editor to evade Terminal warnings
• Orthanc flaws risk medical image exposure and remote code execution
• Critical Chrome WebML bugs signal new sandbox escape risk

Recent editions

• Friday, April 10, 2026: Docker AuthZ bypass reopens host compromise risk · 8 stories
• Thursday, April 9, 2026: Immediate remote code execution risk in Ninja Forms File Uploads · 11 stories
• Wednesday, April 8, 2026: Attackers exploit both decade-old and new flaws in federal systems · 14 stories
• Tuesday, April 7, 2026: FortiClient EMS hotfixes leave uncertainty for 8.0 users · 13 stories
• Monday, April 6, 2026: Developer machines became high-yield credential farms in LiteLLM supply-chain attack · 5 stories
• Sunday, April 5, 2026: Next.js React2Shell exploit automates AI and cloud credential theft · 6 stories
• Saturday, April 4, 2026: Cloud account takeover after Trivy supply-chain compromise · 12 stories