Cybersecurity briefing, 2026-04-18

A critical Ivanti flaw is being actively exploited right now, and federal agencies just got emergency patch orders with a deadline this Sunday.

• ActiveMQ management endpoints enable credentialed RCE
• End-of-life TP-Link routers face botnet infection attempts
• Defender’s file rewrite turns patched PCs into SYSTEM targets
• DDoS-for-hire networks lose their user base
• Metasploit adds public RCE modules for web apps
• Tycoon takedown pushes phishers toward device-code abuse
• Bluesky’s core features took a day-long DDoS hit
• Black Shrantac turns perimeter flaws into quiet extortion
• APT28 uses Roundcube to reach official inboxes
• Trump backs clean 702 renewal, reform window narrows
• LLMs now cut Chrome exploit development to pocket change
• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• Excel XSS becomes silent data exfiltration path
• Teams helpdesk impersonation turns support into access

Recent editions

• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories
• Thursday, April 16, 2026: Nginx UI’s MCP endpoint opens full server takeover · 20 stories
• Wednesday, April 15, 2026: SharePoint zero-day lands in Microsoft’s huge April batch · 18 stories
• Tuesday, April 14, 2026: Malicious PDFs enable code execution across Windows and macOS · 8 stories
• Monday, April 13, 2026: Phishing marketplace takedown cuts supply but leaves stolen credentials active · 16 stories
• Sunday, April 12, 2026: Signed CPUID installers delivered malware via DLL sideloading · 3 stories
• Saturday, April 11, 2026: Default password flaw enables immediate remote takeover of Juniper collectors · 9 stories