Briefing del 2026-04-28

Una patch incompleta di Microsoft ha fornito ad APT28 un modo zero-click per rubare le credenziali di Windows, e la vera soluzione è arrivata solo all'inizio di questo mese.

• Trusted Data Tool Poisoned, Then Its Container Image Too
• Cisco Firewall Backdoors Survive Patching
• Itron breach leaves utility customers uncertain
• Developer Tooling Compromises Return Across npm, PyPI, and Docker
• Vishing Crew Turns Helpdesks Into Credential Farms
• macOS Users Become the Weak Link in Fake Updates
• AI Agents Turn Web Pages Into Attack Payloads
• Medtronic Breach Exposes Corporate Data, Not Products
• RPC Architecture Lets Impersonating Processes Reach SYSTEM
• PackageKit Auth Bypass Turns Local Users Root
• Spamouflage Fails to Move Tibetan Diaspora Voters