Cybersecurity briefing, 2026-04-25

Fortinet shipped an emergency hotfix for an actively exploited FortiClient EMS zero-day, and they have not yet said what the fix looks like for users on the 8.0 branch.

• Cisco Firewall Backdoors Survive Patching
• npm Worm Turns Developer Tokens Into Propagation Fuel
• GopherWhisper Turns Collaboration Tools Into Espionage Channels
• AI Code and Prompt Injection Expand the Attack Surface
• LMDeploy SSRF Opens Cloud Metadata in Hours
• China-Nexus Botnets Turn Everyday Devices Into Cover
• Frontier AI Shrinks Exploit Discovery to Minutes
• Simulation Sabotage Malware May Have Preceded Stuxnet
• Teams Trust Turned Into Browser Persistence
• ADT Breach Exposes Identity Data, Not Alarm Systems
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Trusted Bitwarden CLI Release Turned Secret Harvester
• Metasploit Makes Langflow Exploitation Easy to Verify
• macOS Users Become the Weak Link in Fake Updates
• RDP Phishing Warning Breaks on Mixed-Scale Monitors
• Scanner Flaws Expose Files and Privileges on Windows
• Marimo Advisory Details Enabled Exploits Within Hours
• App Store Wallet Clones Steal Crypto Recovery Phrases
• No-Code Phishing Pages Reclaim Exchange Credentials

Recent editions

• Friday, April 24, 2026: Cisco Firewall Backdoors Survive Patching · 18 stories
• Thursday, April 23, 2026: iPhone Notification Cache Exposed Deleted Signal Messages · 17 stories
• Wednesday, April 22, 2026: ActiveMQ Brokers Exposed to Active Exploitation at Scale · 18 stories
• Tuesday, April 21, 2026: ActiveMQ Brokers Exposed to Active Exploitation at Scale · 17 stories
• Monday, April 20, 2026: Vercel Breach Exposes Customer Secrets Risk · 12 stories
• Sunday, April 19, 2026: End-of-Life TP-Link Routers Face Botnet Infection Attempts · 2 stories
• Saturday, April 18, 2026: ActiveMQ Management Endpoints Enable Credentialed RCE · 14 stories