2026-04-24: CISA orders federal agencies to patch Microsoft Defender BlueHammer zero-day within two weeks

Show Notes - 2026-04-24

Stories Covered

• Today:
• BlueHammer Microsoft Defender Zero-Day Exploited (CVE-2026-33825) [Critical Alerts]
• Marimo Remote Code Execution (CVE-2026-39987) [Critical Alerts]
• FIRESTARTER Backdoor Persists on Cisco Firewalls After Patching [Business & Infrastructure Threats]
• UNC6692 Social Engineering via Microsoft Teams Deploys SNOW Malware Suite [Business & Infrastructure Threats]
• Scattered Spider Defeats Password Reset Controls to Breach UK Retailer [Business & Infrastructure Threats]
• LMDeploy SSRF Exploited 13 Hours After Disclosure [Business & Infrastructure Threats]
• Trigona Ransomware Deploys Custom Exfiltration Tool [Ransomware & Extortion]
• RAMP Ransomware Marketplace Database Leaked [Ransomware & Extortion]
• Kyber Ransomware Uses Post-Quantum Cryptography [Ransomware & Extortion]
• PhantomRPC: New Windows RPC Privilege Escalation Technique [Windows / AD Security]
• Microsoft Entra ID SSRF Vulnerabilities [Windows / AD Security]
• Microsoft Teams Meeting Join Failures After Edge Update [Windows / AD Security]
• Bitwarden CLI Compromised in Supply Chain Attack [General Security News]
• GopherWhisper APT Targets Government Entities [General Security News]
• China-Nexus Botnets Using Compromised SOHO Devices [General Security News]
• Apple Patches Exploited Notification Database Vulnerability [General Security News]
• NPM Supply Chain Malware Campaign [General Security News]
• DeFi Hack Steals $290 Million Through RPC Infrastructure Compromise [General Security News]
• WordPress Plugin Exploitation [General Security News]
• Rituals Cosmetics Data Breach [General Security News]
• Mile Bluff Medical Center Ransomware Incident [General Security News]
• MajorDoMo Smart Home Platform Exploited [Vulnerability Disclosures]
• Milesight Camera Vulnerabilities [Vulnerability Disclosures]
• SpiceJet Booking System Authorization Bypass [Vulnerability Disclosures]
• ICS Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-20333, CVE-2025-20362, CVE-2025-60710, CVE-2025-65856, CVE-2025-70994, CVE-2026-0740, CVE-2026-27174, CVE-2026-27175, CVE-2026-28950, CVE-2026-33102, CVE-2026-33626, CVE-2026-33819, CVE-2026-33825, CVE-2026-35431, CVE-2026-3844, CVE-2026-3893, CVE-2026-39987, CVE-2026-6074, CVE-2026-6375, CVE-2026-6376

Indicators of Compromise

IP Addresses: 169.254.169.254, 51.7.0.77, 63.8.0.4, 48.8.0.4, 62.8.0.4

Read the full brief