Cybersecurity briefing, 2026-04-25

Fortinet shipped an emergency hotfix for an actively exploited FortiClient EMS zero-day, and they have not yet said what the fix looks like for users on the 8.0 branch.

• Cisco firewall backdoors survive patching
• npm worm turns developer tokens into propagation fuel
• GopherWhisper turns collaboration tools into espionage channels
• AI code and prompt injection expand the attack surface
• LMDeploy SSRF opens cloud metadata in hours
• China-nexus botnets turn everyday devices into cover
• Frontier AI shrinks exploit discovery to minutes
• Simulation sabotage malware may have preceded Stuxnet
• Teams trust turned into browser persistence
• ADT breach exposes identity data, not alarm systems
• Black Shrantac turns perimeter flaws into quiet extortion
• Trusted Bitwarden CLI release turned secret harvester
• Metasploit makes Langflow exploitation easy to verify
• macOS users become the weak link in fake updates
• RDP phishing warning breaks on mixed-scale monitors
• Scanner flaws expose files and privileges on Windows
• Marimo advisory details enabled exploits within hours
• App Store wallet clones steal crypto recovery phrases
• No-code phishing pages reclaim Exchange credentials

Recent editions

• Friday, April 24, 2026: iPhone notification cache exposed deleted signal messages · 18 stories
• Thursday, April 23, 2026: npm worm turns developer tokens into propagation fuel · 17 stories
• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories
• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories
• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ management endpoints enable credentialed RCE · 14 stories