Briefing del 2026-04-15

Una grave vulnerabilità di bypass dell'autenticazione in nginx-ui è attualmente in fase di sfruttamento attivo, e più di 2.600 istanze sono esposte su Internet.

• SharePoint Zero-Day Lands in Microsoft’s Huge April Batch
• Black Shrantac Turns Perimeter Flaws Into Quiet Extortion
• Chrome Extensions Turn OAuth Tokens Into Account Access
• Old Excel RCE Returns to CISA’s Exploited List
• ColdFusion Flaws Take Priority Over Adobe’s Broad Patch Load
• WordPress Plugin Buyout Turns Into Dormant Backdoor Risk
• Trump Backs Clean 702 Renewal, Reform Window Narrows
• Trusted n8n Subdomains Turn Into Phishing Infrastructure
• SAP ABAP SQL Injection Exposes BW and BPC Data
• FortiSandbox Bugs Let Attackers Skip Login and Run Commands
• Google Will Demote Sites That Trap the Back Button
• Mirax Malware Turns Infected Phones into Anonymized Fraud Infrastructure
• Google’s Notice Promise May Have Failed Users
• ShowDoc Servers Become Easy RCE Targets
• Bug del kernel Node su nodi GKE COS consentono l'escalation dei privilegi sull'host
• Salesforce Misconfiguration Exposes Tenant Data Without Account Breach
• Manufacturing OT Faces Phishing-to-Ransomware Pressure
• Windows Now Warns Before Rogue RDP Files Connect