Thursday 30 April 2026

Major Incidents or Breaches

• Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
• Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
• The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
• Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
• European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
• Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
• Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

• Google patched a CVSS 10-rated remote code execution vulnerability in the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow.
• cPanel and WHM released emergency updates for a critical authentication bypass vulnerability affecting most versions, which could allow unauthorised control panel access.
• GitHub fixed a critical RCE vulnerability (CVE-2026-3854) that could have exposed millions of private repositories.
• Two authentication bypass vulnerabilities in the Qinglong open-source task scheduler are being actively exploited to deploy cryptominers on servers.
• A fresh LiteLLM vulnerability was exploited shortly after disclosure, allowing database read and potential modification.
• 38 vulnerabilities were identified in the OpenEMR medical software, including issues enabling database compromise, RCE, and data theft.
• Chrome 147 and Firefox 150 security updates addressed critical and high-severity code execution vulnerabilities.
• Researchers highlighted five exploitation methods for PhantomRPC, which Microsoft has classified as “moderate” and does not intend to patch.

Notable Threat Actor Activity

• The Silver Fox group is targeting organisations in Russia and India via tax authority impersonation, distributing ValleyRAT and the new ABCDoor backdoor.
• North Korean (DPRK) threat actors are using AI-assisted malware insertion, fake companies, and RATs to compromise npm packages and developer environments.
• Iranian group Handala targeted US troops in Bahrain with WhatsApp messages threatening drone and missile attacks.
• Lotus Wiper malware was deployed in attacks against Venezuelan energy firms and utilities, utilising advanced living-off-the-land and data deletion techniques.
• TeamPCP was identified as responsible for the SAP npm supply chain attack and is linked to deployment of Vect 2.0 ransomware, which functions as a wiper due to a design flaw.

Trends, Tools, or Tactics of Interest

• Threat actors are increasingly leveraging AI (including LLMs) to automate malware insertion, reconnaissance, and attack workflows, directly integrating AI into the kill chain.
• AI-powered reverse engineering tools were used to identify high-severity vulnerabilities, such as the recent GitHub bug.
• OAuth sprawl and third-party integrations are being exploited for lateral movement and supply chain compromise, as evidenced by the Vercel breach.
• Exposed RDP and VNC servers, including those controlling ICS/OT environments, remain a significant attack surface, with tens of thousands identified as internet-facing.
• Dormant backdoors in widely used software (e.g., WordPress plugins) highlight risks of long-term supply chain compromise.

Regulatory or Policy Developments

• CISA added actively exploited ConnectWise ScreenConnect and Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and issued a directive for federal agencies to patch a Windows zero-day.
• CISA and US government partners released a guide to accelerate zero trust adoption in operational technology (OT) environments.