Windows 11 cumulative updates KB5083769 & KB5082052 released Microsoft has released Windows 11 KB5083769 and KB5082052 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features.

www.bleepingcomputer.com/news/microso...

Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

www.bleepingcomputer.com/news/microso...

The silent “Storm”: New infostealer hijacks sessions, decrypts server-side
www.bleepingcomputer.com/news/securit...

JanelaRAT: a financial threat targeting users in Latin America
securelist.com/janelarat-fi...

APT41 Delivers 'Undetectable' Backdoor to Steal Cloud Credentials The China-backed threat group is targeting AWS, Google, Azure, and Alibaba cloud environments and using typosquatting to obscure C2 communication.

APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud Credentials
www.darkreading.com/cloud-securi...

APT37’s Pretexting-Based Targeted Intrusion: Analysis of Facebook Reconnaissance and Software Tampering Attacks Pretexting by APT37 was identified. After Facebook contact, they sent an encrypted PDF via messenger and lured targets to install a viewer.

APT37’s Pretexting-Based Targeted Intrusion: Analysis of Facebook
Reconnaissance and Software Tampering Attacks
www.genians.co.kr/en/blog/thre...

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident OpenAI revoked its macOS signing certificate after a malicious Axios dependency incident on March 31, 2026, preventing potential software misuse.

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain
Incident
thehackernews.com/2026/04/open...

FBI, Indonesia take down W3LL phishing tool A widely used phishing tool that allowed hackers to create fake websites that looked like legitimate login portals for just $500 was disrupted by the FBI and law enforcement agencies in Indonesia.

FBI, Indonesia take down W3LL phishing tool
therecord.media/phishing-tak...

CVE-2026-5194 - GitHub Advisory Database Missing hash/digest size and OID checks allow digests...

wolfSSL - Missing hash/digest size and OID checks
URL: github.com/advisories/G...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.3

CVE-2026-40175 - GitHub Advisory Database Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

Axios Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via
Header Injection Chain
URL: github.com/advisories/G...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 10.0

Hims Breach Exposes the Most Sensitive Kinds of PHI Threat actors breached the telehealth brand, and now they may know patients' personal health details. What could they do with that information?

Hims Breach Exposes the Most Sensitive Kinds of PHI
www.darkreading.com/cyberattacks...

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621 Adobe patches CVE-2026-34621 after active exploitation since Dec 2025, preventing remote code execution via malicious PDFs.

Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621
thehackernews.com/2026/04/adob...

Unauthenticated remote code execution due to SSH command-line argument injection ### Impact Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network acces...

Cockpit - Unauthenticated remote code execution due to SSH command-line
argument injection
URL: github.com/cockpit-proj...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8

Unauthenticated remote code execution due to SSH command-line argument injection ### Impact Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network acces...

Cockpit - Unauthenticated remote code execution due to SSH command-line
argument injection
URL: github.com/cockpit-proj...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8

Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass ## Summary Marimo (19.6k stars) has a Pre-Auth RCE vulnerability. The terminal WebSocket endpoint `/terminal/ws` lacks authentication validation, allowing an unauthenticated attacker to obtain a...

Marimo - Pre-Auth Remote Code Execution via Terminal WebSocket Authentication
Bypass
URL: github.com/marimo-team/...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 9.3

Security update available for Adobe Acrobat Reader | APSB26-43
URL: helpx.adobe.com/security/pro...
Classification: Critical, Solution: Official Fix, Exploit Maturity: Functional, CVSSv3.1: 8.6

A Single Operator, Two AI Platforms, Nine Government Agencies: The Full Technical Report | Balens Blog In February, we published our initial findings on the AI-assisted breach of Mexico's government infrastructure, warning of the elevated risk that AI-powered threat actors now pose. A single operator u...

gambit.security/blog-post/a-...

March 2026 Cyber Threat Report: Ransomware & GenAI Risk March 2026 cyber threat update: attacks dip to 1,995/week, ransomware rebounds, and GenAI data leakage risk rises—plus key sector and regional trends.

March 2026 Cyber Threat Landscape Shows No Relief as Ransomware Rebounds and
GenAI Risks Intensify
blog.checkpoint.com/research/mar...

Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data Webloc surveils up to 500M devices using ad data; global law enforcement adoption raises warrantless tracking concerns.

Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad
Data
thehackernews.com/2026/04/citi...

Recovery scammers hit you when you’re down: Here’s how to avoid a ‘second strike’ If you’ve been the victim of fraud, you’re likely already a lead on a ‘sucker list’ – and if you’re not careful, your ordeal may be about to get worse.

Recovery scammers hit you when you’re down: Here’s how to avoid a second
strike
www.welivesecurity.com/en/scams/rec...

blog.quarkslab.com/tearing-down...

www.thetimes.com/uk/defence/a...

hackread.com/storm-1175-h...

New VENOM phishing attacks steal senior executives' Microsoft logins
www.bleepingcomputer.com/news/securit...

Marimo OSS Python Notebook RCE: From Disclosure to Exploitation in Under 10
Hours
www.sysdig.com/blog/marimo-...

U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026
www.trendmicro.com/en_us/resear...

How to protect your organization from AirSnitch Wi-Fi vulnerabilities Practical recommendations for Wi-Fi network isolation and defending against all AirSnitch-style attacks.

AirSnitch: attacking Wi-Fi client isolation and guest networks
www.kaspersky.com/blog/airsnit...

Nearly 4,000 US industrial devices exposed to Iranian cyberattacks
www.bleepingcomputer.com/news/securit...

My #AI avatar fell off the wagon apparently...

Join me for #techmentor and #cybersecurity Live in #redmond with a BIG discount!

bit.ly/4tw0Ndi