Cybersecurity briefing, 2026-04-16

A critical Fortinet zero-day is being actively exploited right now, hotfixes are out, and the status of version 8.0 is still unclear.

• Nginx UI’s MCP endpoint opens full server takeover
• Black Shrantac turns perimeter flaws into quiet extortion
• Windows Task Host flaw gives local users SYSTEM
• Signed adware turns update channels into AV killers
• Old Excel RCE returns to CISA’s exploited list
• Russia-linked actors shift toward physical infrastructure disruption
• UAC-0247 uses fake aid lures to steal chat data
• FortiSandbox bugs let attackers skip login and run commands
• Microsoft sells time for legacy Exchange and Skype
• SharePoint flaw lets attackers spoof and read data
• NVD backlog leaves most CVEs unenriched
• Cisco Unity Connection bugs expose admin web sessions
• Salesforce misconfiguration exposes tenant data without account breach
• Trump backs clean 702 renewal, reform window narrows
• OpenAI widens Defender access, raises dual-use stakes
• Automotive suppliers turn ransomware into sector-wide risk
• WordPress plugin buyout turns into dormant backdoor risk
• School network attack exposes data beyond targeted sites
• Chrome extensions turn OAuth tokens into account access
• Webex SSO flaw lets attackers impersonate users

Recent editions

• Wednesday, April 15, 2026: SharePoint zero-day lands in Microsoft’s huge April batch · 18 stories
• Tuesday, April 14, 2026: Malicious PDFs enable code execution across Windows and macOS · 8 stories
• Monday, April 13, 2026: Phishing marketplace takedown cuts supply but leaves stolen credentials active · 16 stories
• Sunday, April 12, 2026: Signed CPUID installers delivered malware via DLL sideloading · 3 stories
• Saturday, April 11, 2026: Default password flaw enables immediate remote takeover of Juniper collectors · 9 stories
• Friday, April 10, 2026: Docker AuthZ bypass reopens host compromise risk · 8 stories
• Thursday, April 9, 2026: Immediate remote code execution risk in Ninja Forms File Uploads · 11 stories