2026-04-02: Google patches the fourth Chrome zero-day of 2026 (CVE-2026-5281, CISA KEV deadline April 15)

Show Notes - 2026-04-02

Stories Covered

• Today:
• Chrome Zero-Day CVE-2026-5281 Under Active Exploitation [Critical Alerts]
• F5 BIG-IP APM RCE Attacks Ongoing (CVE-2025-53521) [Critical Alerts]
• Axios npm Supply Chain Attack Attributed to North Korean Sapphire Sleet [Critical Alerts]
• TrueConf Zero-Day CVE-2026-3502 Exploited in Southeast Asia Government Attacks [Critical Alerts]
• Apple iOS 18 DarkSword Exploit Kit Protection Expanded [Critical Alerts]
• Qilin Ransomware Dominates Japan in 2025, Targets Healthcare and Manufacturing [Ransomware & Extortion]
• TeamPCP Supply Chain Campaign: Mercor AI First Confirmed Victim, AWS Enumeration Documented [Business & Infrastructure Threats]
• EvilTokens PhaaS Fuels Microsoft Device Code Phishing at Scale [Business & Infrastructure Threats]
• CERT-UA Impersonation Campaign Distributes AGEWHEEZE RAT to 1 Million Emails [Business & Infrastructure Threats]
• Classic Outlook Email Delivery Failures Linked to Permission Errors [Windows / AD Security]
• CVE-2026-5281 Google Chrome Dawn Use-After-Free (High Severity) [Vulnerability Disclosures]
• CVE-2025-53521 F5 BIG-IP APM Remote Code Execution (Critical Severity) [Vulnerability Disclosures]
• CVE-2026-3502 TrueConf Zero-Day Update Mechanism Bypass (Medium Severity) [Vulnerability Disclosures]
• CVE-2025-43529, CVE-2025-43520, CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, CVE-2026-20700 iOS DarkSword Exploit Kit [Vulnerability Disclosures]
• Microsoft Security Update Guide CVEs [Vulnerability Disclosures]
• Casbaneiro Banking Trojan Targets Latin America and Europe via Dynamic PDF Lures [General Security News]
• Malicious Script Removes Alternate Data Streams to Evade Detection [General Security News]
• CrowdStrike Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management [General Security News]

CVEs Referenced

CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2025-53521, CVE-2026-20700, CVE-2026-2436, CVE-2026-2441, CVE-2026-33216, CVE-2026-3502, CVE-2026-3909, CVE-2026-3910, CVE-2026-4897, CVE-2026-5119, CVE-2026-5121, CVE-2026-5281

Indicators of Compromise

Domains: sfrclak[.]com, cert-ua[.]tech, 237[.]92., ukr[.]net, cert-ua[.]tech.

Read the full brief