2026-04-19: A critical RCE flaw in protobuf.js (50M weekly downloads) has proof-of-concept exploit code

Show Notes - 2026-04-19

Stories Covered

• Today:
• Critical flaw in Protobuf library enables JavaScript code execution [Critical Alerts]
• Cross-tenant helpdesk impersonation to data exfiltration [Business & Infrastructure Threats]
• Tax documents for school employees potentially stolen across Los Angeles County [Business & Infrastructure Threats]
• Microsoft Teams right-click paste broken by Edge update bug [General Security News]
• Ruby Central in 'real financial jeopardy' following RubyGems maintainer ruckus [General Security News]
• Ukrainian emergency services and hospitals hit by espionage campaign using new AgingFly malware [General Security News]
• Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks [General Security News]
• Judge lets state auditor's investigation into data breach affecting Blue Cross Blue Shield members move forward [General Security News]
• CVE-2026-4786: Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open() [Vulnerability Disclosures]
• CVE-2026-5160 [Vulnerability Disclosures]
• CVE-2026-6100: Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile [Vulnerability Disclosures]
• NAKIVO v11.2: Ransomware Defense, Faster Replication, vSphere 9, and Proxmox VE 9.0 Support [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-4519, CVE-2026-4786, CVE-2026-5160, CVE-2026-6100

Indicators of Compromise

IP Addresses: 9.0.1.0

Read the full brief