Cybersecurity briefing — 2026-04-21

If you run Ivanti's Endpoint Manager Mobile and it's reachable from the internet, you have until Sunday to patch.

• ActiveMQ Brokers Exposed to Active Exploitation at Scale
• Vercel Breach Traced to Context.ai Compromise via Lumma Stealer
• Lazarus Group Drains $290M from KelpDAO via LayerZero DVN
• The Gentlemen RaaS Surges as Bomgar CVE-2026-1731 Exploited
• Trojanized Payment App Turns Android Phones Into Card Skimmers
• App Store Wallet Clones Steal Crypto Recovery Phrases
• Serial-to-IP Flaws Expose Legacy OT at Scale
• Internet-Exposed Ivanti EPMM Appliances Face Active RCE Exploits
• SEC Penalizes Weak Cyber Governance After Data Exposure
• Meraki Portal Breach Risks Cross-Client Camera Exposure
• Palantir publishes 22-point political manifesto, sparks UK contract concerns
• Google Antigravity Patch Leaves Prompt Injection Risk Exposed
• Water Plant Sabotage Malware Is One Bug Away
• Former DigitalMint Negotiator Pleads Guilty in BlackCat Ransom Scheme
• Kyber Turns ESXi and Windows Into One Blackout
• Malicious Model Files Can Own SGLang Servers
• Admin Access Turns Progress ADC Into Command Execution Risk