Cybersecurity Brief – 2026-04-30

Thu, 30 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

Google patched a CVSS 10-rated remote code execution vulnerability in the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow.
cPanel and WHM released emergency updates for a critical authentication bypass vulnerability affecting most versions, which could allow unauthorised control panel access.
GitHub fixed a critical RCE vulnerability (CVE-2026-3854) that could have exposed millions of private repositories.
Two authentication bypass vulnerabilities in the Qinglong open-source task scheduler are being actively exploited to deploy cryptominers on servers.
A fresh LiteLLM vulnerability was exploited shortly after disclosure, allowing database read and potential modification.
38 vulnerabilities were identified in the OpenEMR medical software, including issues enabling database compromise, RCE, and data theft.
Chrome 147 and Firefox 150 security updates addressed critical and high-severity code execution vulnerabilities.
Researchers highlighted five exploitation methods for PhantomRPC, which Microsoft has classified as “moderate” and does not intend to patch.

Notable Threat Actor Activity

The Silver Fox group is targeting organisations in Russia and India via tax authority impersonation, distributing ValleyRAT and the new ABCDoor backdoor.
North Korean (DPRK) threat actors are using AI-assisted malware insertion, fake companies, and RATs to compromise npm packages and developer environments.
Iranian group Handala targeted US troops in Bahrain with WhatsApp messages threatening drone and missile attacks.
Lotus Wiper malware was deployed in attacks against Venezuelan energy firms and utilities, utilising advanced living-off-the-land and data deletion techniques.
TeamPCP was identified as responsible for the SAP npm supply chain attack and is linked to deployment of Vect 2.0 ransomware, which functions as a wiper due to a design flaw.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI (including LLMs) to automate malware insertion, reconnaissance, and attack workflows, directly integrating AI into the kill chain.
AI-powered reverse engineering tools were used to identify high-severity vulnerabilities, such as the recent GitHub bug.
OAuth sprawl and third-party integrations are being exploited for lateral movement and supply chain compromise, as evidenced by the Vercel breach.
Exposed RDP and VNC servers, including those controlling ICS/OT environments, remain a significant attack surface, with tens of thousands identified as internet-facing.
Dormant backdoors in widely used software (e.g., WordPress plugins) highlight risks of long-term supply chain compromise.

Regulatory or Policy Developments

CISA added actively exploited ConnectWise ScreenConnect and Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and issued a directive for federal agencies to patch a Windows zero-day.
CISA and US government partners released a guide to accelerate zero trust adoption in operational technology (OT) environments.

Cybersecurity Brief – 2026-04-29

Wed, 29 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Vimeo has confirmed a data breach affecting user and customer data, resulting from the Anodot data anomaly detection company breach. The ShinyHunters group is threatening to leak the stolen files unless a ransom is paid.
Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository.
Robinhood systems were leveraged to send legitimate-looking phishing emails, luring recipients to malicious websites.
Electric motorcycles (Zero Motorcycles) and scooters (Yadea) have been found vulnerable to attacks that could compromise rider safety.
A Chinese engineer reportedly stole US military and NASA software over several years by impersonating researchers and convincing organisations to provide sensitive code.

Newly Discovered Vulnerabilities

CVE-2026-42208: A critical pre-authentication SQL injection vulnerability in BerriAI’s LiteLLM Python package has been disclosed and is under active exploitation within 36 hours of public announcement. Attackers are targeting sensitive information stored by the LiteLLM gateway.
CVE-2026-3854: A critical remote code execution vulnerability affecting GitHub.com and GitHub Enterprise Server allows authenticated users to achieve RCE via a single Git push. The flaw exposed millions of repositories.
CVE-2026-25874: Hugging Face’s LeRobot open-source robotics platform is affected by a critical unpatched vulnerability that allows unauthenticated remote code execution.
Vulnerabilities in Robinhood systems enabled attackers to send phishing emails from legitimate infrastructure.
Vulnerabilities in Zero Motorcycles and Yadea electric scooters could allow attackers to compromise device security and rider safety.

Notable Threat Actor Activity

The Brazilian-origin cybercrime group LofyGang has resurfaced after three years, distributing a new stealer malware, LofyStealer (aka GrabBot), targeting Minecraft players.
The North Korean BlueNoroff group is conducting campaigns against cryptocurrency executives, using stolen victim videos, AI-generated avatars, and fake Zoom calls to enhance social engineering and malware delivery.
LAPSUS$ threat group has leaked stolen data from Checkmarx’s private GitHub repository.
Scattered Spider: A dual US-Estonian citizen, allegedly a prolific member of this group, has been arrested in Finland and faces US federal charges.
ShinyHunters is threatening to leak data stolen in the Vimeo breach if ransom demands are not met.
Feuding between ransomware groups 0APT and KryBit has led to the leaking of each other’s infrastructure and operational data, exposing details of ransomware operations.

Trends, Tools, or Tactics of Interest

Threat actors are rapidly exploiting newly disclosed vulnerabilities, with the LiteLLM SQL injection (CVE-2026-42208) being exploited within 36 hours of disclosure.
VECT 2.0 ransomware, due to a flaw in its encryption implementation, irreversibly destroys files larger than 131KB on Windows, Linux, and ESXi, effectively acting as a wiper rather than ransomware.
Threat actors are publishing structured OPSEC playbooks detailing layered infrastructure, identity separation, and long-term evasion strategies to improve operational security and evade detection.
The Vidar malware has become the leading infostealer in the market, filling the gap left by the takedown of Lumma and Rhadamanthys.
Attackers are scaling supply chain attacks by seeding over 70 cloned Open VSX extensions with GlassWorm malware, targeting the VS Code ecosystem.
Fake CAPTCHA scams are being used to trigger international SMS charges on victims’ phones, with scammers profiting from a share of the charges.
The use of AI-generated content and social engineering (e.g., fake Zoom calls, deepfakes) is increasing in targeted attacks, particularly by state-linked and financially motivated groups.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft will deprecate legacy TLS connections for POP and IMAP email clients in Exchange Online starting July 2026, blocking insecure protocols.
A member of the alleged Chinese state-backed Silk Typhoon group has been extradited to the US to face charges related to cyberattacks against US universities.
The FIDO Alliance, Google, and Mastercard are collaborating to address security concerns related to AI agents making autonomous purchases, aiming to prevent unauthorised transactions.
Increased focus on AI governance and agentic AI security, with industry initiatives and webinars promoting multi-layered governance frameworks and cost predictability for AI-driven security solutions.

CVE-2026-3854 on DanSec Daily

Cybersecurity Brief – 2026-04-30

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-04-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry