Security Brief Daily

Episode 27 — 15 Apr 2026 1. Critical flaw in wolfSSL library enables forged certificate use Source: Bleeping Computer A critical vulnerability in the wolfSSL SSL/TLS library can weaken security via improper verification of the hash algorithm or its size when checking Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. Researchers warn that an attacker could exploit the issue to... 2. Mc...

Episode 25 — 13 Apr 2026 1. Critical Marimo pre-auth RCE flaw now under active exploitation Source: Bleeping Computer Hackers started exploiting a critical vulnerability in the Marimo open-source reactive Python notebook platform just 10 hours after its public disclosure. The flaw allows remote code execution without authentication in Marimo versions 0.20.4 and earlier. It tracked as... 2. Over 20...

Episode 23 — 11 Apr 2026 1. Nearly 4,000 US industrial devices exposed to Iranian cyberattacks Source: Bleeping Computer The attack surface targeted by Iranian-linked hackers in cyberattacks against U.S. critical infrastructure networks includes thousands of Internet-exposed programmable logic controllers (PLCs) manufactured by Rockwell Automation. According to a joint advisory issued by... 2. Eur...

Episode 22 — 10 Apr 2026 1. Hackers exploiting Acrobat Reader zero-day flaw since December Source: Bleeping Computer Attackers have been exploiting a zero-day vulnerability in Adobe Reader using maliciously crafted PDF documents since at least December. The attacks have been discovered by security researcher Haifei Li (the founder of the sandbox-based exploit-detection platform EXPMON), who... 2....

Episode 21 — 09 Apr 2026 1. Hackers use pixel-large SVG trick to hide credit card stealer Source: Bleeping Computer A massive campaign impacting nearly 100 online stores using the Magento e-commerce platform hides credit card-stealing code in a pixel-sized Scalable Vector Graphics (SVG) image. When clicking the checkout button, the victim is shown a convincing overlay that can validate... 2. CISA...

Episode 20 — 08 Apr 2026 1. Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins Source: Bleeping Computer An international operation from law enforcement authorities in partnership with private companies has disrupted FrostArmada, an APT28 campaign hijacking local traffic from MikroTik and TP-Link routers to steal Microsoft account credentials. The Russian threat group APT28,...

Episode 18 — 06 Apr 2026 1. New FortiClient EMS flaw exploited in attacks, emergency patch released Source: Bleeping Computer Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks. Tracked as CVE-2026-35616, the flaw is an improper access control vulnerability that allows... 2...

Episode 17 — 05 Apr 2026 1. Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS Source: The Hacker News Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading......

Episode 16 — 04 Apr 2026 1. Critical Cisco IMC auth bypass gives attackers Admin access Source: Bleeping Computer Cisco has released security updates to address several critical and high-severity vulnerabilities, including an Integrated Management Controller (IMC) authentication bypass that allows attackers to gain Admin access. Also known as CIMC, Cisco IMC is a hardware module embedded... 2. Cla...

Episode 15 — 03 Apr 2026 1. Critical Cisco IMC auth bypass gives attackers Admin access Source: Bleeping Computer Cisco has released security updates to address several critical and high-severity vulnerabilities, including an Integrated Management Controller (IMC) authentication bypass that allows attackers to gain Admin access. Also known as CIMC, Cisco IMC is a hardware module embedded... 2. App...

Episode 14 — 02 Apr 2026 1. Over 14,000 F5 BIG-IP APM instances still exposed to RCE attacks Source: Bleeping Computer Internet threat-monitoring non-profit Shadowserver has found over 14,000 BIG-IP APM instances exposed online amid ongoing attacks exploiting a critical-severity remote code execution (RCE) vulnerability. BIG-IP APM (short for Access Policy Manager) is F5's centralized access... 2....

Episode 13 — 01 Apr 2026 1. Cisco source code stolen in Trivy-linked dev environment breach Source: Bleeping Computer Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to the company and its customers. A source, who asked to remain anonymous,... 2. Cla...

Episode 12 — 31 Mar 2026 1. CISA orders feds to patch actively exploited Citrix flaw by Thursday Source: Bleeping Computer The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their Citrix NetScaler appliances against an actively exploited vulnerability by Thursday. Multiple cybersecurity companies flagged the flaw (CVE-2026-3055) as posing an... 2....

Episode 11 — 30 Mar 2026 1. Critical Fortinet Forticlient EMS flaw now exploited in attacks Source: Bleeping Computer Attackers are now actively exploiting a critical vulnerability in Fortinet's FortiClient EMS platform, according to threat intelligence company Defused. Tracked as CVE-2026-21643 , this SQL injection vulnerability allows unauthenticated threat actors to execute arbitrary code... 2....

Episode 9 — 28 Mar 2026 1. New Infinity Stealer malware grabs macOS data via ClickFix lures Source: Bleeping Computer A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler. The attack uses the ClickFix technique, presenting a fake CAPTCHA that mimics Cloudflare’s human verification... 2. C...

Episode 8 — 27 Mar 2026 1. European Commission investigating breach after Amazon cloud hack Source: Bleeping Computer The European Commission, the European Union's main executive body, is investigating a security breach after a threat actor gained access to its Amazon cloud infrastructure. Although the EU's executive cabinet has yet to disclose the incident publicly, BleepingComputer has... 2. Ant...

Episode 7 — 26 Mar 2026 1. TP-Link warns users to patch critical router auth bypass flaw Source: Bleeping Computer TP-Link has patched several vulnerabilities in its Archer NX router series, including a critical-severity flaw that may allow attackers to bypass authentication and upload new firmware. Tracked as CVE-2025-15517 , this security flaw affects Archer NX200, NX210, NX500, and... 2. Coruna...

Episode 6 — 25 Mar 2026 1. PTC warns of imminent threat from critical Windchill, FlexPLM RCE bug Source: Bleeping Computer PTC Inc. is warning of a critical vulnerability in Windchill and FlexPLM, widely used product lifecycle management (PLM) solutions, that could allow remote code execution. The security issue, identified as CVE-2026-4681, could be leveraged through the deserialization of... 2....

Episode 5 — 24 Mar 2026 1. Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks Source: The Hacker News Citrix has released security updates to address two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical flaw that could be exploited to leak sensitive data from the application. The vulnerabilities are listed below - CVE-2026-3055 (CVSS score...

Episode 4 — 23 Mar 2026 1. CISA orders feds to patch DarkSword iOS flaws exploited attacks Source: Bleeping Computer CISA ordered U.S. government agencies to patch three iOS vulnerabilities targeted in cryptocurrency theft and cyberespionage attacks using the DarkSword exploit kit. As Google Threat Intelligence Group (GTIG) and iVerify researchers revealed last week , the DarkSword delivery... 2....

Episode 2 — 21 Mar 2026 1. Oracle pushes emergency fix for critical Identity Manager RCE flaw Source: Bleeping Computer Update: Added that Oracle declined to comment on whether the vulnerability has been exploited. Oracle has released an out-of-band security update to fix a critical unauthenticated remote code execution vulnerability in Identity Manager and Web Services Manager tracked as... 2. CI...

Episode 1 — 20 Mar 2026 1. International joint action disrupts world’s largest DDoS botnets Source: Bleeping Computer Authorities from the United States, Germany, and Canada have taken down Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices. The joint law enforcement action also targeted virtual... 2. Russian...