Briefing del 2026-04-22

Una vulnerabilità critica in un plugin di WordPress utilizzato da 90.000 siti è attualmente in fase di sfruttamento attivo, e gli attaccanti stanno ottenendo l'esecuzione remota di codice con un singolo upload.

• ActiveMQ Brokers Exposed to Active Exploitation at Scale
• ASP.NET Core Token Forgery Leaves Privileged Sessions Behind
• Wiper Attack Removes Recovery Before Destruction Begins
• Harvester Turns Outlook Into Stealth Linux Command Channel
• French ID Portal Breach Fuels Mass Phishing Risk
• Oracle Communications Takes the Biggest Hit in April CPU
• Trojanized Payment App Turns Android Phones Into Card Skimmers
• No-Code Phishing Pages Reclaim Exchange Credentials
• macOS Native Tools Create Blind Spots for Lateral Movement
• SilentGlass Targets a Neglected Monitor Attack Path
• Kyber Turns ESXi and Windows Into One Blackout
• China’s Cyber Parity Raises the Cost of Blind Spots
• Discontinued D-Link Routers Become Mirai Entry Point
• Proxy Farm Platform Centralizes SIM Abuse Across 17 Countries
• AI and Geopolitics Raise UK Nation-State Cyber Risk
• Admin Access Turns Progress ADC Into Command Execution Risk
• Containerized LLM Sandboxes Can Still Yield Host Root
• Ransomware Negotiator Turned BlackCat Insider