Cybersecurity briefing, 2026-04-13

A critical Adobe Acrobat zero-day is being actively exploited right now, and it works on both Windows and macOS.

• Malicious PDFs enable code execution across Windows and macOS
• Phishing marketplace takedown cuts supply but leaves stolen credentials active
• OpenAI rotates macOS certificates after Axios supply-chain compromise
• APT37 shifts to Facebook social engineering to deliver RokRAT malware
• Signed CPUID installers delivered malware via DLL sideloading
• Marimo advisory details enabled exploits within hours
• Basic-Fit breach exposes 1 million members’ personal and bank data
• JanelaRAT’s evolving multi-stage attacks sharpen focus on Latin American banks
• EncystPHP webshell scans signal persistent FreePBX compromise attempts
• Ransomware groups scale double extortion using AI-driven reconnaissance
• Phishing kit takedown disrupts MFA-bypassing access resale market
• Correlating signals exposes reachable Autonomous AI agent on Windows Server
• WolfSSL flaw lets forged certificates bypass multiple signature checks
• Obsidian plugin ecosystem enables stealthy cross-platform RAT attacks
• Immediate remote code execution risk in Ninja Forms File Uploads
• AI workflow Builder flaw enables full server takeover

Recent editions

• Sunday, April 12, 2026: Signed CPUID installers delivered malware via DLL sideloading · 3 stories
• Saturday, April 11, 2026: Default password flaw enables immediate remote takeover of Juniper collectors · 9 stories
• Friday, April 10, 2026: Docker AuthZ bypass reopens host compromise risk · 8 stories
• Thursday, April 9, 2026: Immediate remote code execution risk in Ninja Forms File Uploads · 11 stories
• Wednesday, April 8, 2026: Attackers exploit both decade-old and new flaws in federal systems · 14 stories
• Tuesday, April 7, 2026: FortiClient EMS hotfixes leave uncertainty for 8.0 users · 13 stories
• Monday, April 6, 2026: Developer machines became high-yield credential farms in LiteLLM supply-chain attack · 5 stories