Cybersecurity briefing — 2026-04-23

A critical flaw in Marimo notebooks went from public advisory to active exploitation in under ten hours.

• Apple patches CVE-2026-28950 after deleted Signal messages recovered
• npm Worm Turns Developer Tokens Into Propagation Fuel
• Allies warn of China‑nexus covert botnet networks using SOHO routers
• Bitwarden CLI npm package @bitwarden/cli@2026.4.0 compromised via GitHub Actions
• GopherWhisper Turns Collaboration Tools Into Espionage Channels
• Biobank Data Sale Exposes Research Access Weakness
• SilentGlass Targets a Neglected Monitor Attack Path
• Federal Privacy Bill Could Override Stronger State Protections
• Passkeys Become the Default Login Standard
• Rituals Member Data Downloaded in Breach
• AI Agents Can Now Chain Cloud Breaches Alone
• ASP.NET Core Token Forgery Leaves Privileged Sessions Behind
• Wiper Attack Removes Recovery Before Destruction Begins
• Surveillance firms impersonate telcos to track phone locations
• Oracle Communications Takes the Biggest Hit in April CPU
• Discontinued D-Link Routers Become Mirai Entry Point
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion