Cybersecurity briefing, 2026-04-22

A critical flaw in a WordPress plugin used by 90,000 sites is being actively exploited right now, and attackers are getting full remote code execution with a single upload.

• ActiveMQ brokers exposed to active exploitation at scale
• ASP.NET Core token forgery leaves privileged sessions behind
• Wiper attack removes recovery before destruction begins
• Harvester turns Outlook into stealth Linux command channel
• French ID portal breach fuels mass phishing risk
• Oracle Communications takes the biggest hit in April CPU
• Trojanized payment app turns Android phones into card skimmers
• No-code phishing pages reclaim Exchange credentials
• macOS native tools create blind spots for lateral movement
• SilentGlass targets a neglected monitor attack path
• Kyber turns ESXi and Windows into one blackout
• China’s cyber parity raises the cost of blind spots
• Discontinued D-Link routers become Mirai entry point
• Proxy farm platform centralizes SIM abuse across 17 countries
• AI and geopolitics raise UK nation-state cyber risk
• Admin access turns Progress ADC into command execution risk
• Containerized LLM sandboxes can still yield host root
• Ransomware negotiator turned BlackCat insider

Recent editions

• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories
• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories
• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories
• Thursday, April 16, 2026: Nginx UI’s MCP endpoint opens full server takeover · 20 stories
• Wednesday, April 15, 2026: SharePoint zero-day lands in Microsoft’s huge April batch · 18 stories