Cybersecurity briefing, 2026-04-26

Two zero days are being actively exploited right now, and one of them turned an AI demo platform into a malware delivery point in under ten hours.

• GopherWhisper turns collaboration tools into espionage channels
• Teams trust turned into browser persistence
• Signed adware turns update channels into AV killers
• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• Nginx UI’s MCP endpoint opens full server takeover
• Marimo zero-day turns AI demo hosting into malware delivery
• Simulation sabotage malware may have preceded Stuxnet
• Black Shrantac turns perimeter flaws into quiet extortion
• F5 BIG-IP APM flaw reclassified as critical RCE with active exploitation

Recent editions

• Saturday, April 25, 2026: Cisco firewall backdoors survive patching · 19 stories
• Friday, April 24, 2026: iPhone notification cache exposed deleted signal messages · 18 stories
• Thursday, April 23, 2026: npm worm turns developer tokens into propagation fuel · 17 stories
• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories
• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories
• Monday, April 20, 2026: Serial-to-IP flaws expose legacy OT at scale · 12 stories
• Sunday, April 19, 2026: End-of-life TP-Link routers face botnet infection attempts · 2 stories