2026-04-28: Supply chain attacks accelerate with a 26-day pause ending in coordinated compromises across npm

Show Notes - 2026-04-28

Stories Covered

• Today:
• Windows Shell Credential Theft (CVE-2026-32202) [Critical Alerts]
• ASP.NET Core Privilege Escalation (CVE-2026-40372) [Critical Alerts]
• D-Link Router Botnet Exploitation (CVE-2025-29635) [Critical Alerts]
• React2Shell Exploitation (CVE-2025-55182) [Critical Alerts]
• LMDeploy SSRF Under Active Exploitation (CVE-2026-33626) [Critical Alerts]
• OpenSSH 15-Year-Old Root Access Flaw (CVE-2026-35414) [Critical Alerts]
• Akira Dominates Cyber Insurance Claims via SonicWall [Ransomware & Extortion]
• TeamPCP Supply Chain Campaign Resumes After 26-Day Pause [Business & Infrastructure Threats]
• Elementary-Data PyPI Package Compromised [Business & Infrastructure Threats]
• GlassWorm v2 Targets OpenVSX with 73 Sleeper Extensions [Business & Infrastructure Threats]
• ShinyHunters Breaches ADT and Medtronic [Business & Infrastructure Threats]
• FIRESTARTER Backdoor on Federal Cisco ASA [Business & Infrastructure Threats]
• UNC6692 Deploys Custom Snow Malware Suite via Teams Impersonation [Business & Infrastructure Threats]
• PhantomCore Exploits TrueConf for Russian Network Breaches [Business & Infrastructure Threats]
• Cursor-Opus AI Agent Deletes Production Database [Business & Infrastructure Threats]
• Robinhood Account Creation Exploited for Phishing [Business & Infrastructure Threats]
• Silk Typhoon Hacker Extradited to US [Business & Infrastructure Threats]
• Microsoft Entra ID Agent ID Administrator Privilege Escalation [Windows / AD Security]
• Unpatched PhantomRPC Windows Privilege Escalation [Windows / AD Security]
• Microsoft Remote Desktop Warning Display Issue [Windows / AD Security]
• Outlook.com Outage Causes Sign-In Failures [General Security News]
• Canada Arrests Three for SMS Blaster Device [General Security News]
• FTC Warns of $2.1 Billion in Social Media Scam Losses [General Security News]
• Deepfake Voice Attacks Outpacing Defenses [General Security News]
• Cybersecurity Professionals Face Pay Stagnation [General Security News]
• Fast16 Malware Predates Stuxnet by Five Years [General Security News]
• Apple iOS Notification Services (CVE-2026-28950) [Vulnerability Disclosures]
• Vercel and Context.ai OAuth Token Compromise [Vulnerability Disclosures]
• France Titres Data Breach [Vulnerability Disclosures]
• UK Biobank Research Data Breach [Vulnerability Disclosures]
• Bitwarden CLI Supply Chain Attack [Vulnerability Disclosures]
• Anthropic Claude Mythos Preview Unauthorized Access [Vulnerability Disclosures]
• Google Antigravity Agentic IDE Prompt Injection [Vulnerability Disclosures]
• Fidelity Brokerage Services Data Breach Settlement [Vulnerability Disclosures]
• Additional Data Breaches [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-20333, CVE-2025-20362, CVE-2025-29635, CVE-2025-55182, CVE-2026-21510, CVE-2026-21513, CVE-2026-28950, CVE-2026-29635, CVE-2026-32202, CVE-2026-33626, CVE-2026-33634, CVE-2026-35414, CVE-2026-40372

Indicators of Compromise

IP Addresses: 169.254.169.254

Read the full brief