Cybersecurity briefing, 2026-04-24

If you patched your Cisco firewalls and called it done, you may want to look again.

• Cisco firewall backdoors survive patching
• iPhone notification cache exposed deleted signal messages
• npm worm turns developer tokens into propagation fuel
• China-nexus botnets turn everyday devices into cover
• GopherWhisper turns collaboration tools into espionage channels
• Frontier AI shrinks exploit discovery to minutes
• AI code and prompt injection expand the attack surface
• WordPress cache plugin lets attackers upload files
• Trusted Bitwarden CLI release turned secret harvester
• LMDeploy SSRF opens cloud metadata in hours
• Simulation sabotage malware may have preceded Stuxnet
• Passkeys become the default login standard
• AI agents can now chain cloud breaches alone
• Rituals member data downloaded in breach
• AI speeds discovery, but governance becomes the bottleneck
• Vercel breach exposes customer secrets risk
• macOS users become the weak link in fake updates
• SilentGlass targets a neglected monitor attack path

Recent editions

• Thursday, April 23, 2026: npm worm turns developer tokens into propagation fuel · 17 stories
• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories
• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories
• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories
• Friday, April 17, 2026: Defender’s file rewrite turns patched PCs into SYSTEM targets · 18 stories