Cybersecurity briefing — 2026-04-25

Fortinet shipped an emergency hotfix for an actively exploited FortiClient EMS zero-day, and they have not yet said what the fix looks like for users on the 8.0 branch.

• Cisco Firewall Backdoors Survive Patching
• npm Worm Turns Developer Tokens Into Propagation Fuel
• GopherWhisper Turns Collaboration Tools Into Espionage Channels
• AI Code and Prompt Injection Expand the Attack Surface
• LMDeploy SSRF Opens Cloud Metadata in Hours
• China-Nexus Botnets Turn Everyday Devices Into Cover
• Frontier AI Shrinks Exploit Discovery to Minutes
• Simulation Sabotage Malware May Have Preceded Stuxnet
• Teams Trust Turned Into Browser Persistence
• ADT Breach Exposes Identity Data, Not Alarm Systems
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Trusted Bitwarden CLI Release Turned Secret Harvester
• Metasploit Makes Langflow Exploitation Easy to Verify
• macOS Users Become the Weak Link in Fake Updates
• RDP Phishing Warning Breaks on Mixed-Scale Monitors
• Scanner Flaws Expose Files and Privileges on Windows
• Marimo Advisory Details Enabled Exploits Within Hours
• App Store Wallet Clones Steal Crypto Recovery Phrases
• No-Code Phishing Pages Reclaim Exchange Credentials