• Attackers actively exploited a SimpleHelp RMM authentication bypass, CVE-2026-48558, to deploy custom malware, with roughly 1,000 exposed servers directly vulnerable.
• The FortiBleed campaign compromised over 430,000 FortiGate firewalls, harvesting more than 110 million credentials tied to INC Ransom and Lynx ransomware.
• Google, Lumen and the FBI dismantled the NetNut/Popa residential proxy network, which controlled around two million compromised consumer devices.
• Citizen Lab documented repeated Pegasus spyware infections of a former MEP who served on the European Parliament's spyware investigation committee.
• A US local government entity paid roughly $1 million to the Kairos extortion group after a data-theft-only intrusion with no ransomware deployed.
• Anthropic's Fable 5 and Mythos 5 models regained access after the US Commerce Department lifted export controls imposed following a jailbreak incident.

Arctic Wolf reported active exploitation of CVE-2026-48558, a critical authentication bypass in SimpleHelp RMM caused by improper OpenID Connect token validation. Attackers forged identity tokens to bypass multi-factor authentication and gain technician-level access. CISA added the flaw to its Known Exploited Vulnerabilities catalogue after roughly 14,000 exposed servers were identified.

Researchers uncovered the FortiBleed campaign, in which attackers deployed the FortigateSniffer tool on around 12,000 FortiGate devices and harvested over 110 million RADIUS, NTLM and Kerberos credentials. The campaign has been linked to the INC Ransom and Lynx ransomware groups, and the underlying flaw was added to CISA's Known Exploited Vulnerabilities catalogue.

The FBI, supported by Google and Lumen, seized domains linked to the NetNut proxy network, also known as Popa, which researchers estimate controlled at least two million compromised devices. Google disabled associated command-and-control accounts, and 316 distinct threat clusters were found using NetNut exit nodes in a single week.

Citizen Lab found that former European Parliament member Stelios Kouloglou was infected with Pegasus spyware twice while serving on the committee investigating such tools. Forensic evidence pointed to the PWNYOURHOME zero-click exploit chain, with infrastructure overlap linked to a prior campaign against Russian and Belarusian journalists.

A US government entity, believed to be Union County, Ohio, paid approximately $1 million to the Kairos extortion group after attackers claimed to steal more than 2TB of data without encrypting systems. Blockchain analysis traced the payment through wallets linked to Bybit, OKX and the Russian service BELQI.

Acronis identified two Mustang Panda espionage campaigns targeting India's hydropower sector and government organisations, deploying the previously undocumented MINIRECON and ZOHOMURK implants. ZOHOMURK abused Zoho WorkDrive for command-and-control using hardcoded OAuth credentials, and CERT-In coordinated victim notification.

NAIC, Nissan, Aflac Japan and others disclosed breaches tied to a zero-day in Oracle PeopleSoft, attributed to the ShinyHunters extortion group. NAIC said only public and outdated data was exposed, while Nissan warned that payroll records and Social Security numbers may have been stolen.

Medtronic notified patients that attackers accessed corporate systems between April 13 and 19, exposing names, Social Security numbers and health information. The incident has been linked to a broader extortion campaign involving the ShinyHunters group.

Kaspersky reported that the Armored Likho APT group used spear-phishing archives to deploy BusySnake Stealer, a Python-based infostealer, against government and energy sector targets in Russia, Brazil and Kazakhstan. The malware harvests clipboard data, browser credentials and cryptocurrency wallet artefacts.

A public proof-of-concept for CVE-2026-55200, a critical pre-authentication flaw in libssh2, allows remote code execution via crafted SSH packets. The bug stems from an integer overflow in packet-length validation during the SSH handshake, with no in-the-wild exploitation reported yet.

CISA confirmed ransomware groups are exploiting CVE-2026-33825, a Microsoft Defender privilege escalation flaw allowing local attackers to steal password hashes and reach SYSTEM privileges. Microsoft patched the bug in April 2026 after earlier zero-day exploitation.

Defused Cyber reported active exploitation of CVE-2026-46817, a critical Oracle Payments flaw allowing unauthenticated takeover of affected E-Business Suite instances. Attacks began roughly six weeks after Oracle's patch, despite no public exploit code being available.

Citrix released patches for six NetScaler ADC and Gateway flaws, including a new HTTP/2 Bomb denial-of-service attack and a memory-overread bug, CVE-2026-8451, in SAML request parsing. The overread flaw can leak uninitialised memory and occasionally crash the nsppe process.

CISA added CVE-2026-45659, a SharePoint deserialisation flaw, to its Known Exploited Vulnerabilities catalogue after confirming active exploitation. Cisco separately confirmed in-the-wild exploitation of CVE-2026-20230 in Unified Communications Manager, enabling server-side request forgery.

Aikido disclosed CVE-2026-48611, a critical phpBB authentication bypass allowing login as any user via a single unauthenticated request. The flaw abused the login_link feature and default apache authentication provider, and was patched in version 3.3.17.

Researchers disclosed Bad Epoll, CVE-2026-46242, a Linux kernel race condition allowing unprivileged processes to escalate to root, with impact extending to Android devices. Exploitation was demonstrated with high reliability in Google's kernelCTF environment.

Microsoft removed 119 Edge extensions linked to the StegoAd campaign, which hid malware payloads inside image and font files. The extensions, downloaded by 2.6 million users, stole Google credentials, second-factor codes and WordPress logins.

A campaign using ten npm maintainer accounts published roughly 30 packages impersonating Polymarket and DeFi tooling, delivering a JavaScript infostealer. A separate dependency-confusion campaign under the @marketfront scope harvested SSH keys and cloud credentials from developers.

Sysdig documented JadePuffer, in which an AI system exploited a Langflow flaw to autonomously breach, move laterally through, and encrypt a production database. The agent performed reconnaissance and credential harvesting before encrypting configuration items and generating a ransom note with an ephemeral key.

Check Point Research described a browser-only ransomware concept derived from LLM-generated malware ideas, exploiting Chrome's File System Access API without native payload installation. The proof-of-concept can enumerate, encrypt and overwrite user-selected files while displaying ransom overlays.

Blackpoint Cyber analysed Avalon, a malware framework delivered through phishing that bypassed AMSI and ETW before deploying an integrated ransomware component, CrownX. CrownX used AES-GCM encryption, disabled recovery features and included a direct disk destruction capability.

Unit 42 identified "phantom squatting," where attackers register LLM-hallucinated domains and weaponise them for phishing and malware delivery. Analysis of 2.1 million LLM-generated URLs found 13,229 malicious URLs and roughly 250,000 unregistered phantom domains available for preemptive registration.

The US State Department offered a $10 million reward for information on UNC5792 and UNC4221, Russian state-linked groups targeting Signal and WhatsApp accounts of government and military officials. WhatsApp separately began rolling out optional usernames to reduce phone number exposure.

US authorities lifted export controls on Anthropic's Fable 5 model, restoring global access after a three-week shutdown tied to a jailbreak technique. Anthropic also reinstated access to Mythos 5 under Project Glasswing for vetted US organisations.

US authorities extradited a 19-year-old dual US and Estonian citizen from Finland after charging him with conspiracy and computer intrusion tied to the Scattered Spider group. Prosecutors allege the group conducted over 100 intrusions generating more than $100 million in ransom payments.