Cybersecurity briefing — 2026-05-04

Fortinet's FortiClient EMS has a zero-day under active exploitation right now, and the emergency hotfix only covers two of the three main branches.

• Progress patches MOVEit Automation auth bypass and privilege escalation (CVE-2026-4670, CVE-2026-5174)
• ShadowPad Espionage Campaign Targets Exchange and IIS Servers
• Instructure's Canvas Hit by Cyberattack; ShinyHunters Claims 3.6TB Leak
• French Citizen Data Sale Creates Long-Term Fraud Pool
• Silver Fox Deploys ABCDoor, ValleyRAT via Tax-Phishing in India, Russia
• Certificate Trust Breaks When DigiCert Is Breached
• Signed Adware Turns Update Channels Into AV Killers
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• FortiClient EMS Hotfixes Leave Uncertainty for 8.0 Users
• Authenticated Users Can Take Root on 3onedata Gateways
• AiTM Phishing Scales by Filtering Out Bots