Cybersecurity briefing — 2026-04-17

Fortinet just shipped emergency hotfixes for a FortiClient EMS zero-day that attackers are already exploiting in the wild.

• Three Microsoft Defender LPEs Exploited; BlueHammer CVE-2026-33825 Patched
• CVE-2026-34197: Apache ActiveMQ RCE Added to CISA KEV
• End-of-Life TP-Link Routers Face Botnet Infection Attempts
• Operation PowerOFF: 53 DDoS-for-hire Domains Seized, Four Arrested
• UAC-0247 Uses Fake Aid Lures to Steal Chat Data
• Bluesky suffers widespread DDoS outage, services intermittently disrupted
• NVD Backlog Leaves Most CVEs Unenriched
• Marimo Zero-Day Turns AI Demo Hosting Into Malware Delivery
• Microsoft Sells Time for Legacy Exchange and Skype
• Congress approves short-term extension of FISA Section 702
• macOS Users Become the Weak Link in Fake Updates
• Bluesky Outage Points to Hosted Infrastructure Risk
• Tiny Archives Hide Massive Malware Payloads
• Water Plant Sabotage Malware Is One Bug Away
• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Rhysida Leak Leaves 337,000 Patients Exposed
• Automotive Suppliers Turn Ransomware Into Sector-Wide Risk