Cybersecurity briefing, 2026-04-26

Two zero days are being actively exploited right now, and one of them turned an AI demo platform into a malware delivery point in under ten hours.

• GopherWhisper Turns Collaboration Tools Into Espionage Channels
• Teams Trust Turned Into Browser Persistence
• Signed Adware Turns Update Channels Into AV Killers
• FortiClient EMS Hotfixes Leave Uncertainty for 8.0 Users
• Nginx UI’s MCP Endpoint Opens Full Server Takeover
• Marimo Zero-Day Turns AI Demo Hosting Into Malware Delivery
• Simulation Sabotage Malware May Have Preceded Stuxnet
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• F5 BIG-IP APM Flaw Reclassified as Critical RCE with Active Exploitation

Recent editions

• Saturday, April 25, 2026: Cisco Firewall Backdoors Survive Patching · 19 stories
• Friday, April 24, 2026: Cisco Firewall Backdoors Survive Patching · 18 stories
• Thursday, April 23, 2026: iPhone Notification Cache Exposed Deleted Signal Messages · 17 stories
• Wednesday, April 22, 2026: ActiveMQ Brokers Exposed to Active Exploitation at Scale · 18 stories
• Tuesday, April 21, 2026: ActiveMQ Brokers Exposed to Active Exploitation at Scale · 17 stories
• Monday, April 20, 2026: Vercel Breach Exposes Customer Secrets Risk · 12 stories
• Sunday, April 19, 2026: End-of-Life TP-Link Routers Face Botnet Infection Attempts · 2 stories