Cybersecurity briefing, 2026-04-28

An incomplete Microsoft patch handed APT28 a zero-click way to steal Windows credentials, and the real fix only landed earlier this month.

• Trusted data tool poisoned, then its container image too
• Cisco firewall backdoors survive patching
• Itron breach leaves utility customers uncertain
• Developer tooling compromises return across npm, PyPI, and Docker
• Vishing crew turns helpdesks into credential farms
• macOS users become the weak link in fake updates
• AI agents turn web pages into attack payloads
• Medtronic breach exposes corporate data, not products
• RPC architecture lets impersonating processes reach SYSTEM
• PackageKit auth bypass turns local users root
• Spamouflage fails to move Tibetan diaspora voters

Recent editions

• Monday, April 27, 2026: Cisco firewall backdoors survive patching · 14 stories
• Sunday, April 26, 2026: GopherWhisper turns collaboration tools into espionage channels · 9 stories
• Saturday, April 25, 2026: Cisco firewall backdoors survive patching · 19 stories
• Friday, April 24, 2026: iPhone notification cache exposed deleted signal messages · 18 stories
• Thursday, April 23, 2026: npm worm turns developer tokens into propagation fuel · 17 stories
• Wednesday, April 22, 2026: ActiveMQ brokers exposed to active exploitation at scale · 18 stories
• Tuesday, April 21, 2026: Vercel breach exposes customer secrets risk · 17 stories