MUST READ

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 94

 | 

Trigona ransomware adopts custom tool to steal data and evade detection

 | 

Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

U.S. CISA adds SimpleHelp, Samsung, and D-Link flaws to its Known Exploited Vulnerabilities catalog

 | 

Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844)

 | 

CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network

 | 

12-year-old Pack2TheRoot bug lets Linux users gain root privileges

 | 

Signal phishing campaign targets Germany’s Bundestag President Julia Klöckner

 | 

Checkmarx supply chain attack impacts Bitwarden npm distribution path

 | 

China-linked threat actors use consumer device botnets to evade detection, warn UK and partners

 | 

Luxury cosmetics giant Rituals discloses data breach impacting member personal details

 | 

iOS Flaw Let Deleted Notifications Linger, Apple Issues Fix

 | 

RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace

 | 

U.S. CISA adds a flaw in Microsoft Defender to its Known Exploited Vulnerabilities catalog

 | 

Microsoft Graph API misused by new GoGra Linux malware for hidden communication

 | 

DDoS wave continues as Mastodon hit after Bluesky incident

 | 

Mirai Botnet exploits CVE-2025-29635 to target legacy D-Link routers

 | 

Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw

 | 

Critical BRIDGE:BREAK flaws impact Lantronix and Silex Technology converters

 | 

Venezuela energy sector targeted by highly destructive Lotus wiper

 | 

Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITION

Pierluigi Paganini April 26, 2026

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.

U.S. CISA adds SimpleHelp, Samsung, and D-Link flaws to its Known Exploited Vulnerabilities catalog
Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844)
CISA reports persistent FIRESTARTER backdoor on Cisco ASA device in federal network
12-year-old Pack2TheRoot bug lets Linux users gain root privileges
Signal phishing campaign targets Germany’s Bundestag President Julia Klöckner
Checkmarx supply chain attack impacts Bitwarden npm distribution path
China-linked threat actors use consumer device botnets to evade detection, warn UK and partners
Luxury cosmetics giant Rituals discloses data breach impacting member personal details
iOS Flaw Let Deleted Notifications Linger, Apple Issues Fix
RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace
U.S. CISA adds a flaw in Microsoft Defender to its Known Exploited Vulnerabilities catalog
Microsoft Graph API misused by new GoGra Linux malware for hidden communication
DDoS wave continues as Mastodon hit after Bluesky incident
Mirai Botnet exploits CVE-2025-29635 to target legacy D-Link routers
Microsoft out-of-band updates fixed critical ASP.NET Core privilege escalation flaw
Critical BRIDGE:BREAK flaws impact Lantronix and Silex Technology converters
Venezuela energy sector targeted by highly destructive Lotus wiper
Ransomware negotiator caught secretly assisting BlackCat extortion scheme
North Korea’s Lazarus APT stole $290M from Kelp DAO
The US NSA is using Anthropic’s Claude Mythos despite supply chain risk
U.S. CISA adds Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities catalog
Bluesky hit by 24-hour DDoS attack as pro-Iran group claims responsibility
France’s ANTS ID System website hit by cyberattack, possible data breach
Scattered Spider member Tyler Buchanan pleads guilty to major crypto theft
CVE-2023-33538 under attack for a year, but exploitation still unsuccessful
Third-party AI hack triggers Vercel breach, internal environments accessed
AI Model Claude Opus turns bugs into exploits for just $2,283
Cyber attacks fuel surge in cargo theft across logistics industry

International Press – Newsletter

Cybercrime

Beyond the breach: inside a cargo theft actor’s post-compromise playbook 

British National Pleads Guilty to Hacking into Companies and Stealing At Least $8 Million in Virtual Currency

Cyberattack at French identity document agency may have exposed personal data  

Florida Man Working as a Ransomware Negotiator Pleads Guilty to Conspiracy to Deploy Ransomware and Extort U.S. Victims  

Teen arrested in Northern Ireland over cyberattack on school network 

Inside RAMP: What a leaked database reveals about Russia’s ransomware marketplace 

The National Police dismantles the largest online illicit distribution platform for manga in Spanish in Almeria  

Extortion in the Enterprise: Defending Against BlackFile Attacks  

Trigona Affiliates Deploy Custom Exfiltration Tool to Streamline Data Theft  

Malware

The iPhone — invincible no more: a look at DarkSword and Coruna  

FIRESTARTER Backdoor  

Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware  

Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained  

Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm  

Hacking

A Deep Dive Into Attempted Exploitation of CVE-2023-33538  

Bluesky Disrupted by Sophisticated DDoS Attack  

Our evaluation of Claude Mythos Preview’s cyber capabilities  

Exploiting Serial-to-Ethernet Converters in Critical Infrastructure  

Microsoft Patches Critical ASP.NET Core CVE-2026-40372 Privilege Escalation Bug

CVE-2026-33626: How attackers exploited LMDeploy LLM Inference Engines in 12 hours  

Pack2TheRoot (CVE-2026-41651): Cross-Distro Local Privilege Escalation Vulnerability  

Intelligence and Information Warfare

Hacked hospitals, hidden spyware: Iran conflict shows how digital fight is ingrained in warfare  

Scoop: NSA using Anthropic’s Mythos despite blacklist  

Same packet, different magic: Mustang Panda hits India’s banking sector and Korea geopolitics

Harvester: APT Group Expands Toolset With New GoGra Linux Backdoor  

GopherWhisper: A burrow full of malware 

Defending against China-nexus covert networks of compromised devices  

President of German parliament hit by Signal hack, report says 

UAT-4356’s Targeting of Cisco Firepower Devices 

Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener

Cybersecurity

Eliminating Your Attack Surface Is the Best Defense Against Vulnerabilities Discovered by Anthropic’s Mythos Model 

Vercel April 2026 security incident  

Apple Patches iOS Flaw Allowing Recovery of Deleted Chats  

ENISA Cybersecurity Market Analysis Framework (ECSMAF) – V3.0  

Microsoft Vibing — capturing screenshots and voice samples without governance  

SANS Critical Advisory: BugBusters – AI Vulnerability Discovery Hype vs. Reality  

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

Cybercrime data breach Hacking hacking news information security news IT Information Security malware Newsletter Pierluigi Paganini Security Affairs Security News

you might also like

Pierluigi Paganini April 26, 2026
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 94
Read more
Pierluigi Paganini April 26, 2026
Trigona ransomware adopts custom tool to steal data and evade detection
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 94

Malware / April 26, 2026

Trigona ransomware adopts custom tool to steal data and evade detection

Cyber Crime / April 26, 2026

Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITION

Breaking News / April 26, 2026

U.S. CISA adds SimpleHelp, Samsung, and D-Link flaws to its Known Exploited Vulnerabilities catalog

Security / April 25, 2026

Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026-3844)

Uncategorized / April 25, 2026