Cybersecurity briefing, 2026-05-04

Fortinet's FortiClient EMS has a zero-day under active exploitation right now, and the emergency hotfix only covers two of the three main branches.

• MOVEit Automation auth bypass forces full-installer upgrades
• ShadowPad espionage campaign targets Exchange and IIS servers
• Canvas breach exposes shared student identity data
• French citizen data sale creates long-term fraud pool
• Tax phishing delivers swappable malware in India and Russia
• Certificate trust breaks when DigiCert is breached
• Signed adware turns update channels into AV killers
• Black Shrantac turns perimeter flaws into quiet extortion
• FortiClient EMS hotfixes leave uncertainty for 8.0 users
• Authenticated users can take root on 3onedata gateways
• AiTM phishing scales by filtering out bots

Recent editions

• Sunday, May 3, 2026: Exchange N-day abuse expands espionage reach across governments · 4 stories
• Saturday, May 2, 2026: SAP build packages turn install time into theft time · 18 stories
• Friday, May 1, 2026: Headless Gemini CLI turns CI into host compromise path · 19 stories
• Thursday, April 30, 2026: LiteLLM SQLi exposes keys behind AI gateways · 7 stories
• Wednesday, April 29, 2026: Supply-chain victims become VECT’s ransomware pool · 12 stories
• Tuesday, April 28, 2026: Trusted data tool poisoned, then its container image too · 11 stories
• Monday, April 27, 2026: Cisco firewall backdoors survive patching · 14 stories