Cybersecurity briefing, 2026-04-15

A critical authentication bypass in nginx-ui is being actively exploited right now, and more than 2,600 instances are sitting exposed on the internet.

• SharePoint zero-day lands in Microsoft’s huge April batch
• Black Shrantac turns perimeter flaws into quiet extortion
• Chrome extensions turn OAuth tokens into account access
• Old Excel RCE returns to CISA’s exploited list
• ColdFusion flaws take priority over Adobe’s broad patch load
• WordPress plugin buyout turns into dormant backdoor risk
• Trump backs clean 702 renewal, reform window narrows
• Trusted n8n subdomains turn into phishing infrastructure
• SAP ABAP SQL injection exposes BW and BPC data
• FortiSandbox bugs let attackers skip login and run commands
• Google will demote sites that trap the back button
• Mirax malware turns infected phones into anonymized fraud infrastructure
• Google’s notice promise may have failed users
• ShowDoc servers become easy RCE targets
• Node kernel bugs on GKE COS nodes enable host escalation
• Salesforce misconfiguration exposes tenant data without account breach
• Manufacturing OT faces phishing-to-ransomware pressure
• Windows now warns before rogue RDP files connect

Recent editions

• Tuesday, April 14, 2026: Malicious PDFs enable code execution across Windows and macOS · 8 stories
• Monday, April 13, 2026: Phishing marketplace takedown cuts supply but leaves stolen credentials active · 16 stories
• Sunday, April 12, 2026: Signed CPUID installers delivered malware via DLL sideloading · 3 stories
• Saturday, April 11, 2026: Default password flaw enables immediate remote takeover of Juniper collectors · 9 stories
• Friday, April 10, 2026: Docker AuthZ bypass reopens host compromise risk · 8 stories
• Thursday, April 9, 2026: Immediate remote code execution risk in Ninja Forms File Uploads · 11 stories
• Wednesday, April 8, 2026: Attackers exploit both decade-old and new flaws in federal systems · 14 stories