CISA added eight actively exploited vulnerabilities to its KEV catalog on April 21, 2026, affecting products including PaperCut, TeamCity, Cisco Catalyst SD-WAN Manager and Zimbra. Federal remediation deadlines run from April to May.
Italy’s data protection authority fined Poste Italiane €6.6M and Postepay €5.8M over disproportionate app data collection, ordering the practices stopped and retention corrected. The article also covers a €31.8M Intesa Sanpaolo fine over repeated insider access.
Bluesky said a DDoS attack starting late April 15, 2026 disrupted feeds, notifications, threads and search. Service stabilized by about 9 p.m. PDT April 16; the company reported no evidence of unauthorized access. “313 Team” claimed responsibility, but attribution is un
France’s ANTS portal breach, detected April 15, 2026, may have exposed account identifiers and personal details. Authorities say uploaded documents and direct account access were unaffected; investigations and security measures are ongoing.
Vercel says attackers used a compromised Context.ai integration to access an employee’s Google Workspace account and internal systems, exposing some non-sensitive environment variables. The scope and possible exfiltration remain under investigation.
The UAE Cyber Security Council says nearly 25% of publicly accessible files contain sensitive personal data, while 68–77% of privately shared files may be exposed. Its Cyber Pulse advisory recommends encryption and stronger access controls.
The CBI arrested a suspected SIM-card supplier in Operation Chakra-V. Investigators allege a POS-agent network procured about 10,000 illegally issued SIMs for use in cyber fraud schemes; the investigation is ongoing.
Cisco patched three ISE vulnerabilities that could enable command execution and privilege escalation, plus a Webex SSO flaw that could allow user impersonation. Cisco reported no known exploitation; no workarounds are available.
The roundup covers Grinex’s reported loss of over $15 million in USDT, sentences in a North Korea-linked IT worker scheme, a TierOne exploit-writing contest, and Rockstar’s confirmation of unauthorized access alongside ShinyHunters’ extortion claim.
CVE-2026-33032 lets unauthenticated attackers use nginx-ui’s MCP endpoint to take over Nginx servers. The article reports in-the-wild exploitation and describes a chain involving CVE-2026-27944; nginx-ui 2.3.4 addresses the issue.
Kuwait’s banking sector has deployed a virtual war room to coordinate real-time fraud detection and response. Officials say it links banks with government bodies to halt suspicious transactions, trace funds and monitor scam patterns.
Operation PowerOFF seized 53 domains, made four arrests and sent warnings to more than 75,000 suspected DDoS-for-hire users. U.S. investigators also seized infrastructure linked to Vac Stresser and Mythical Stress.
A joint advisory attributes an ongoing campaign targeting logistics and technology firms supporting Ukraine to GRU Unit 26165 (APT28). It reports spearphishing, exploitation, malware and IP-camera targeting, and recommends MFA, patching and monitoring.
The article reports that attackers stole an estimated $13–15 million in USDT from Grinex wallets, prompting the exchange to halt trading and withdrawals. Elliptic tracked funds across Ethereum and Tron; foreign-intelligence claims remain unsupported.
Google says Gemini ad-safety systems blocked over 8.3 billion ads and suspended nearly 25 million advertiser accounts in 2025. It reports using behavioral signals and submission-time review; its claim of blocking over 99% of policy-violating ads before serving is not
Forensic investigators confirmed targeted access to personal data at a small number of Northern Ireland schools. The incident, identified April 10, 2026, is contained; investigation and C2k system recovery continue.
Two U.S. nationals were sentenced to 108 and 92 months for helping overseas IT workers obtain jobs at more than 100 U.S. companies using stolen identities and laptop farms. Authorities say the scheme generated over $5 million; some workers accessed sensitive, ITAR-rele
Matthew Lane pleaded guilty and was sentenced to four years in prison for his role in the PowerSchool breach. The article says stolen contractor credentials were used to extract data tied to about 60 million students and 10 million teachers, followed by extortion.
The European Commission says its open-source age-verification app is technically ready and will let users prove their age without revealing their identity. Several EU countries plan wallet integration as officials signal stricter platform enforcement.
CERT-UA reported a March–April 2026 surge in UAC-0247 activity targeting Ukrainian hospitals, emergency services, municipalities and defense-linked users, using humanitarian-aid phishing, malware and credential theft.
Acronis TRU researchers describe a JanaWare campaign active since at least 2020, linking it to a customized Adwind RAT. The reported operation targets Turkish users through phishing and uses geofencing, obfuscation, defense evasion, and AES encryption.
OpenAI says it is expanding Trusted Access for Cyber and rolling out GPT 5.4 Cyber to vetted defenders. The program uses identity verification and phased access to provide defensive capabilities while managing dual-use risks.
Ivanti Neurons for ITSM versions 2025.3 and earlier are affected by flaws that could preserve access after account deactivation or expose limited session data via stored XSS. Ivanti says it has no evidence of exploitation.
The Kali Forms WordPress plugin (versions through 2.4.9) was reportedly exploited for unauthenticated RCE via manipulated form placeholders. Version 2.4.10 patches the flaw; security telemetry recorded over 312,200 blocked attempts.
