Cybersecurity briefing, 2026-04-20

A breach at cloud development platform Vercel has security teams rotating secrets this morning, while Microsoft ships emergency patches for domain controller crashes caused by its own April updates.

• Vercel breach exposes customer secrets risk
• Serial-to-IP flaws expose legacy OT at scale
• Single verifier let Lazarus forge cross-chain messages
• End-of-life TP-Link routers face botnet infection attempts
• Ransomware crew arms affiliates for cross-platform datacenter hits
• Water plant sabotage malware is one bug away
• Formbook phishing adds redundant delivery paths
• Bluesky’s core features took a day-long DDoS hit
• Session spikes warn before network CVE disclosures
• Windows Server patch breaks domain controllers
• Cisco SD-WAN flaw joins KEV without vendor confirmation
• MCPHub auth bypass lets unauthenticated users act privileged

Recent editions

• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories
• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories
• Thursday, April 16, 2026: Nginx UI’s MCP endpoint opens full server takeover · 20 stories
• Wednesday, April 15, 2026: SharePoint zero-day lands in Microsoft’s huge April batch · 18 stories
• Tuesday, April 14, 2026: Malicious PDFs enable code execution across Windows and macOS · 8 stories
• Monday, April 13, 2026: Phishing marketplace takedown cuts supply but leaves stolen credentials active · 16 stories