
Ivanti EPMM Zero-Day Exploited: 850 Servers Exposed Online
Ivanti disclosed a high-severity remote code execution flaw in its Endpoint Manager Mobile software that attackers are already exploiting. Over 850 exposed EPMM instances have been identified worldwide, with most located in Europe. The company released patches and urged credential rotation for previously compromised customers.

DAEMON Tools Breached: Supply Chain Attack Backdoored Thousands
Disc Soft Limited has confirmed that DAEMON Tools Lite was trojanized in a supply chain attack that compromised systems in over 100 countries. The company has released version 12.6 as a clean replacement and urges affected users to uninstall, scan, and reinstall immediately.

Palo Alto Firewalls Hit by Zero-Day Exploit in the Wild
Palo Alto Networks has disclosed CVE-2026-0300, a critical buffer overflow vulnerability in PAN-OS that attackers are already exploiting. The flaw allows unauthenticated remote code execution with root privileges on exposed firewalls. No patch exists yet, and over 5,800 vulnerable devices are currently internet-facing.

Student Hacks Taiwan High-Speed Rail, Halts 4 Trains
A 23-year-old university student used software-defined radio equipment to trigger emergency brakes on Taiwan's high-speed railway, stopping four trains for 48 minutes. The attack exploited a TETRA communication system that had not rotated its security parameters in 19 years.

Credit Union Loan Fraud: How Attackers Skip the Hack
Flare researchers found structured loan fraud methods circulating in underground forums. Attackers bypass technical defenses entirely, using stolen identity data to walk through legitimate lending workflows. Small and mid-sized credit unions are prime targets due to weaker verification systems.

Instructure Confirms Data Breach Affecting Canvas Users
Educational technology company Instructure has confirmed a cyberattack exposed personal information of Canvas learning management system users. The ShinyHunters extortion gang claims responsibility, alleging access to data from nearly 9,000 schools and 275 million individuals.

cPanel Flaw Exploited in Mass 'Sorry' Ransomware Attacks
A critical authentication bypass vulnerability in cPanel and WHM is being mass-exploited to deploy ransomware across thousands of web servers. At least 44,000 IP addresses have been compromised since the flaw was disclosed, with attackers encrypting website data using a Go-based Linux encryptor.

French Police Arrest 15-Year-Old in 11.7M Record Govt Breach
French authorities have detained a teenager suspected of breaching France Titres, the agency that manages French ID documents, and selling 11.7 million stolen records on a cybercrime forum. The minor faces up to seven years in prison if convicted.

Qinglong Task Scheduler Flaws Exploited for Crypto Mining
Hackers have been exploiting two authentication bypass vulnerabilities in the Qinglong open-source task scheduler since early February, deploying cryptominers on developers' servers. The flaws affect versions 2.20.1 and older of the popular Chinese developer tool, which has over 19,000 GitHub stars.

Vercel Breach Shows the Real Risk of Shadow AI Integrations
A Vercel employee's OAuth connection to a third-party AI app led to a breach when that vendor was compromised. The incident highlights how shadow AI integrations create persistent attack pathways into enterprise systems, even when employees stop using the connected apps.

LiteLLM SQL Injection Flaw Under Active Attack Within 36 Hours
Hackers began exploiting a critical pre-authentication SQL injection vulnerability in the LiteLLM AI gateway just 36 hours after public disclosure. The flaw, rated 9.9 CVSS, lets attackers steal API keys and provider credentials without any authentication. Security researchers warn that exposed instances should be treated as compromised.

US Charges Teen Hacker Linked to Scattered Spider Arrests
A 19-year-old dual US-Estonian citizen arrested in Finland faces federal wire fraud and computer intrusion charges for allegedly helping the Scattered Spider collective extort millions from corporations. Court records reveal he participated in at least four breaches, including a hack when he was just 16.

Silk Typhoon Hacker Xu Zewei Extradited to U.S.
Chinese national Xu Zewei, accused of hacking COVID-19 research organizations and exploiting Microsoft Exchange zero-days for China's intelligence services, has been extradited from Italy to face federal charges. The case highlights ongoing U.S. efforts to prosecute state-sponsored cyber operations.

PyPI Package With 1.1M Downloads Hacked to Push Infostealer
Attackers exploited a GitHub Actions script injection flaw to push a malicious version of elementary-data, a popular Python observability tool. The backdoored release stole SSH keys, cloud credentials, crypto wallets, and developer tokens before a community member spotted it.

ADT Data Breach Exposes 5.5 Million Customers' Personal Info
ShinyHunters breached ADT's systems through a voice phishing attack on an employee's Okta account, stealing names, addresses, phone numbers, and partial Social Security numbers. The extortion group leaked 11GB of data after ADT refused to pay. This marks ADT's third data breach since August 2024.

Medtronic Confirms Data Breach After ShinyHunters Claims 9M Records
Medical device giant Medtronic has confirmed hackers accessed its corporate IT systems. The ShinyHunters extortion group claims to have stolen over 9 million records containing personal information and terabytes of internal data.

ADT Confirms Data Breach After ShinyHunters Ransom Threat
Home security company ADT has confirmed unauthorized access to customer data after the ShinyHunters extortion group threatened to leak 10 million stolen records. The breach, discovered April 20, exposed names, phone numbers, addresses, and in some cases partial Social Security numbers. ShinyHunters claims it gained access through a voice phishing attack on an employee's Okta account.

Firestarter Malware Survives Cisco Firewall Patches and Reboots
CISA and the UK's NCSC warn that Firestarter, a custom backdoor attributed to the UAT-4356 threat group, persists on Cisco firewall devices even after firmware updates and security patches. Admins must perform full cold boots or device re-imaging to clear the infection.

10,500 Zimbra Servers Remain Vulnerable to Active XSS Attacks
CISA has added a Zimbra XSS flaw to its Known Exploited Vulnerabilities catalog after confirming active attacks. Over 10,500 servers worldwide remain unpatched, with Asia and Europe bearing the largest exposure. Federal agencies had just three days to patch.

Breeze Cache Plugin Bug Under Active Attack: Update Now
A critical file upload vulnerability in the Breeze Cache WordPress plugin is being actively exploited. The flaw allows unauthenticated attackers to upload arbitrary files and take over websites. Cloudways has patched the issue in version 2.4.5, but more than 400,000 sites may need updating.

Checkmarx KICS Supply Chain Breach Steals Dev Credentials
Hackers compromised Docker images and VS Code extensions for Checkmarx's KICS security scanner, deploying malware that harvests AWS, Azure, Google Cloud credentials, SSH keys, and GitHub tokens from developer environments. The attack window on Docker Hub lasted about 83 minutes on April 22.


