Cybersecurity Brief – 2026-05-01

Fri, 01 May 2026 00:00:00 +0000

Major Incidents or Breaches

Hundreds of thousands of Roblox accounts were compromised through fake “game enhancements” that harvested login credentials, with stolen accounts subsequently sold for profit.
90,000 screenshots, including private messages and photos, from a European celebrity’s smartphone were publicly exposed due to spyware, before being reported and taken down.
A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, WHM, and WP Squared has been actively exploited as a zero-day since late February, granting attackers administrative access to servers. Proof-of-concept code is publicly available.
Several npm packages for SAP’s cloud application ecosystem were compromised in a supply chain attack (“Mini Shai-Hulud”), impacting at least 1,800 downstream projects.
The Lightning Python package and Intercom-client were compromised on PyPI, with malicious versions published to steal credentials. Combined, these packages have nearly 10 million monthly downloads.
A Brazilian anti-DDoS firm was found to be enabling a botnet that conducted large-scale DDoS attacks against Brazilian ISPs.
The FBI reported a sharp surge in cyber-enabled cargo theft attacks targeting transportation and logistics in the US and Canada, with losses exceeding $30 million in 2023.
Law enforcement dismantled nine cryptocurrency investment scam centers, arresting 276 suspects in a joint operation involving US and Chinese authorities.
PayPal email systems are being abused to distribute tech support scams by hijacking legitimate emails.
Two former US ransomware negotiators were sentenced to four years in prison each for their role in facilitating BlackCat (ALPHV) ransomware attacks against US companies.
The leader of an online swatting ring, responsible for targeting over 75 officials and institutions, was sentenced to four years in US federal prison.

Newly Discovered Vulnerabilities

A high-severity local privilege escalation vulnerability (“Copy Fail”) in the Linux kernel, introduced in 2017, allows unprivileged local attackers to gain root access on major distributions. Exploit code is public and patches are available.
Critical vulnerabilities in SonicWall firewalls could allow attackers to bypass security controls, access restricted services, or crash the devices. SonicWall has urged immediate patching.
Two vulnerabilities in EnOcean SmartServer could allow security bypass and remote code execution on building management systems.
A critical flaw in the Gemini CLI allowed attackers to execute arbitrary commands on the host via malicious configuration files, enabling supply chain attacks. The issue has been patched.
The April 2026 KB5083769 Windows 11 update causes failures in third-party backup applications for versions 24H2 and 25H2.
OpenEMR, a widely used open-source medical records system, was reported to have newly discovered vulnerabilities, though details remain limited.

Notable Threat Actor Activity

Iran-linked hackers are targeting critical infrastructure sectors in the US.
The TeamPCP threat group broadened its supply chain attacks, targeting npm packages used in SAP’s cloud development ecosystem.
A sophisticated campaign distributing EtherRAT malware is spoofing administrative tools on GitHub to target high-privilege professional accounts.
Threat actors compromised Lightning and Intercom-client Python packages to steal credentials in a coordinated supply chain attack.
A new Python-based backdoor framework, DEEP#DOOR, was discovered. It leverages tunneling services for persistence and credential theft from browsers and cloud services.
Criminals are using fake cell towers to send scam SMS messages at scale.
A new phishing kit, Bluekit, offers more than 40 templates targeting popular services and integrates basic AI features to assist in campaign creation.

Trends, Tools, or Tactics of Interest

AI is accelerating the speed and scale of cybercrime, with time-to-exploit for new vulnerabilities shrinking to hours. Attackers are increasingly automating scanning and exploitation of newly exposed assets.
AI-assisted software scanning continues to identify longstanding vulnerabilities, with a recent scan uncovering a nine-year-old Linux bug.
There is a growing use of AI in phishing operations, as demonstrated by the Bluekit phishing service.
Attackers begin scanning and targeting new internet-facing assets within minutes of deployment, with compromise attempts occurring within the first 24 hours.
Helpdesk impersonation scams are increasing, exploiting human factors in security.
Abuse of legitimate communications platforms (such as PayPal emails) to deliver scams is ongoing.
DDoS-for-hire services and botnet-enabled attacks remain prevalent, with some security firms implicated in facilitating these attacks.

Regulatory or Policy Developments Affecting the Security Industry

OpenAI has introduced an “Advanced Account Security” mode for at-risk ChatGPT and Codex accounts, aimed at mitigating phishing and account takeover risks.
Anthropic launched “Claude Security” to help defenders respond to the increased risk of AI-powered exploits, particularly as its new AI model, Mythos, is expected to impact cybersecurity operations.

Cybersecurity Brief – 2026-04-30

Thu, 30 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

Google patched a CVSS 10-rated remote code execution vulnerability in the “@google/gemini-cli” npm package and the “google-github-actions/run-gemini-cli” GitHub Actions workflow.
cPanel and WHM released emergency updates for a critical authentication bypass vulnerability affecting most versions, which could allow unauthorised control panel access.
GitHub fixed a critical RCE vulnerability (CVE-2026-3854) that could have exposed millions of private repositories.
Two authentication bypass vulnerabilities in the Qinglong open-source task scheduler are being actively exploited to deploy cryptominers on servers.
A fresh LiteLLM vulnerability was exploited shortly after disclosure, allowing database read and potential modification.
38 vulnerabilities were identified in the OpenEMR medical software, including issues enabling database compromise, RCE, and data theft.
Chrome 147 and Firefox 150 security updates addressed critical and high-severity code execution vulnerabilities.
Researchers highlighted five exploitation methods for PhantomRPC, which Microsoft has classified as “moderate” and does not intend to patch.

Notable Threat Actor Activity

The Silver Fox group is targeting organisations in Russia and India via tax authority impersonation, distributing ValleyRAT and the new ABCDoor backdoor.
North Korean (DPRK) threat actors are using AI-assisted malware insertion, fake companies, and RATs to compromise npm packages and developer environments.
Iranian group Handala targeted US troops in Bahrain with WhatsApp messages threatening drone and missile attacks.
Lotus Wiper malware was deployed in attacks against Venezuelan energy firms and utilities, utilising advanced living-off-the-land and data deletion techniques.
TeamPCP was identified as responsible for the SAP npm supply chain attack and is linked to deployment of Vect 2.0 ransomware, which functions as a wiper due to a design flaw.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI (including LLMs) to automate malware insertion, reconnaissance, and attack workflows, directly integrating AI into the kill chain.
AI-powered reverse engineering tools were used to identify high-severity vulnerabilities, such as the recent GitHub bug.
OAuth sprawl and third-party integrations are being exploited for lateral movement and supply chain compromise, as evidenced by the Vercel breach.
Exposed RDP and VNC servers, including those controlling ICS/OT environments, remain a significant attack surface, with tens of thousands identified as internet-facing.
Dormant backdoors in widely used software (e.g., WordPress plugins) highlight risks of long-term supply chain compromise.

Regulatory or Policy Developments

CISA added actively exploited ConnectWise ScreenConnect and Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and issued a directive for federal agencies to patch a Windows zero-day.
CISA and US government partners released a guide to accelerate zero trust adoption in operational technology (OT) environments.

OpenEMR on DanSec Daily

Cybersecurity Brief – 2026-05-01

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2026-04-30

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments