Cybersecurity briefing — 2026-04-22

A critical flaw in a WordPress plugin used by 90,000 sites is being actively exploited right now, and attackers are getting full remote code execution with a single upload.

• ActiveMQ Brokers Exposed to Active Exploitation at Scale
• ASP.NET Core Token Forgery Leaves Privileged Sessions Behind
• Wiper Attack Removes Recovery Before Destruction Begins
• Harvester Turns Outlook Into Stealth Linux Command Channel
• French ID Portal Leak Raises Account Misuse Risk
• Oracle Communications Takes the Biggest Hit in April CPU
• Trojanized Payment App Turns Android Phones Into Card Skimmers
• No-Code Phishing Pages Reclaim Exchange Credentials
• macOS Native Tools Create Blind Spots for Lateral Movement
• SilentGlass Targets a Neglected Monitor Attack Path
• Kyber Turns ESXi and Windows Into One Blackout
• China’s Cyber Parity Raises the Cost of Blind Spots
• Discontinued D-Link Routers Become Mirai Entry Point
• Proxy Farm Platform Centralizes SIM Abuse Across 17 Countries
• AI and Geopolitics Raise UK Nation-State Cyber Risk
• Admin Access Turns Progress ADC Into Command Execution Risk
• Containerized LLM Sandboxes Can Still Yield Host Root
• Ransomware Negotiators Became Insider Force Multipliers