Cybersecurity briefing — 2026-04-15

A critical authentication bypass in nginx-ui is being actively exploited right now, and more than 2,600 instances are sitting exposed on the internet.

• SharePoint Zero-Day Lands in Microsoft’s Huge April Batch
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• 108 Chrome Extensions Steal Google and Telegram Data via Single C2
• Old Excel RCE Returns to CISA’s Exploited List
• ColdFusion Flaws Take Priority Over Adobe’s Broad Patch Load
• EssentialPlugin WordPress suite backdoored, malicious updates pushed
• Trump pushes clean extension as Congress debates Section 702
• n8n webhooks abused to send malware via phishing emails
• SAP ABAP SQL Injection Exposes BW and BPC Data
• Fortinet patches critical FortiSandbox RCE and auth-bypass CVEs (CVE-2026-39808, CVE-2026-39813)
• Google Will Demote Sites That Trap the Back Button
• Mirax Malware Turns Infected Phones into Anonymized Fraud Infrastructure
• Google’s Notice Promise May Have Failed Users
• ShowDoc Servers Become Easy RCE Targets
• Node Kernel Bugs on GKE COS Nodes Enable Host Escalation
• Salesforce Misconfiguration Exposes Tenant Data Without Account Breach
• Manufacturing OT Faces Phishing-to-Ransomware Pressure
• Microsoft strengthens .rdp file protections in April 2026 Windows update