Cybersecurity briefing, 2026-04-23

A critical flaw in Marimo notebooks went from public advisory to active exploitation in under ten hours.

• iPhone notification cache exposed deleted signal messages
• npm worm turns developer tokens into propagation fuel
• China-nexus botnets turn everyday devices into cover
• Trusted Bitwarden CLI release turned secret harvester
• GopherWhisper turns collaboration tools into espionage channels
• Biobank data sale exposes research access weakness
• SilentGlass targets a neglected monitor attack path
• Federal privacy bill could override stronger state protections
• Passkeys become the default login standard
• Rituals member data downloaded in breach
• AI agents can now chain cloud breaches alone
• ASP.NET Core token forgery leaves privileged sessions behind
• Wiper attack removes recovery before destruction begins
• Ghost carriers turn telecom trust into location tracking
• Oracle Communications takes the biggest hit in April CPU
• Discontinued D-Link routers become Mirai entry point
• Black Shrantac turns perimeter flaws into quiet extortion

Recent editions

• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories
• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories
• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories
• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories
• Thursday, April 16, 2026: Nginx UI’s MCP endpoint opens full server takeover · 20 stories