Cybersecurity briefing — 2026-04-16

A critical Fortinet zero-day is being actively exploited right now, hotfixes are out, and the status of version 8.0 is still unclear.

• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Windows Task Host Flaw Gives Local Users SYSTEM
• Signed Adware Turns Update Channels Into AV Killers
• Old Excel RCE Returns to CISA’s Exploited List
• Russia-Linked Actors Shift Toward Physical Infrastructure Disruption
• UAC-0247 Uses Fake Aid Lures to Steal Chat Data
• FortiSandbox Bugs Let Attackers Skip Login and Run Commands
• Microsoft Sells Time for Legacy Exchange and Skype
• SharePoint Flaw Lets Attackers Spoof and Read Data
• NIST narrows NVD enrichment to KEV, federal and critical software
• Cisco patches critical Webex SSO and ISE vulnerabilities (CVE-2026-20184, -20147, -20180, -20186)
• Salesforce Misconfiguration Exposes Tenant Data Without Account Breach
• Trump Backs Clean 702 Renewal, Reform Window Narrows
• OpenAI releases GPT-5.4-Cyber with limited rollout to defenders
• Automotive Suppliers Turn Ransomware Into Sector-Wide Risk
• WordPress Plugin Buyout Turns Into Dormant Backdoor Risk
• School Network Attack Exposes Data Beyond Targeted Sites
• Chrome Extensions Turn OAuth Tokens Into Account Access
• Webex SSO Flaw Lets Attackers Impersonate Users