Cybersecurity briefing, 2026-04-21

If you run Ivanti's Endpoint Manager Mobile and it's reachable from the internet, you have until Sunday to patch.

• ActiveMQ brokers exposed to active exploitation at scale
• Vercel breach exposes customer secrets risk
• Single verifier let Lazarus forge cross-chain messages
• Ransomware crew arms affiliates for cross-platform datacenter hits
• Trojanized payment app turns Android phones into card skimmers
• App Store wallet clones steal crypto recovery phrases
• Serial-to-IP flaws expose legacy OT at scale
• Cisco SD-WAN flaw joins KEV without vendor confirmation
• SEC penalizes weak cyber governance after data exposure
• Meraki portal breach risks cross-client camera exposure
• Palantir ties ideology to surveillance contracts
• Google Antigravity patch leaves prompt injection risk exposed
• Water plant sabotage malware is one bug away
• Ransomware negotiator turned BlackCat insider
• Kyber turns ESXi and Windows into one blackout
• Malicious model files can own SGLang servers
• Admin access turns Progress ADC into command execution risk

Recent editions

• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories
• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories
• Thursday, April 16, 2026: Nginx UI’s MCP endpoint opens full server takeover · 20 stories
• Wednesday, April 15, 2026: SharePoint zero-day lands in Microsoft’s huge April batch · 18 stories
• Tuesday, April 14, 2026: Malicious PDFs enable code execution across Windows and macOS · 8 stories