2026-04-28: Supply chain attacks accelerate with a 26-day pause ending in coordinated compromises across npm

Show Notes - 2026-04-28 Stories Covered: - Today: - Windows Shell Credential Theft (CVE-2026-32202) (https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html) - ASP.NET Core Privilege Escalation (CVE-2026-40372) (https://research.checkpoint.com/2026/27th-april-threat-intelligence-report/) - D-Link Router Botnet Exploitation (CVE-2025-29635) (https://research.checkpoint.com/2026/27th-april-threat-intelligence-report/) - React2Shell Exploitation (CVE-2025-55182) (https://research.checkpoint.com/2026/27th-april-threat-intelligence-report/) - LMDeploy SSRF Under Active Exploitation (CVE-2026-33626) (https://research.checkpoint.com/2026/27th-april-threat-intelligence-report/) - OpenSSH 15-Year-Old Root Access Flaw (CVE-2026-35414) (https://www.securityweek.com/openssh-flaw-allowing-full-root-shell-access-lurked-for-15-years/) - Akira Dominates Cyber Insurance Claims via SonicWall (https://databreaches.net/2026/04/27/one-ransomware-crew-now-drives-half-of-all-cyber-claims-at-bay/) - TeamPCP Supply Chain Campaign Resumes After 26-Day Pause (https://isc.sans.edu/diary/rss/32926) - Elementary-Data PyPI Package Compromised (https://www.bleepingcomputer.com/news/security/pypi-package-with-11m-monthly-downloads-hacked-to-push-infostealer/) - GlassWorm v2 Targets OpenVSX with 73 Sleeper Extensions (https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/) - ShinyHunters Breaches ADT and Medtronic (https://www.bleepingcomputer.com/news/security/home-security-giant-adt-data-breach-affects-55-million-people/) - FIRESTARTER Backdoor on Federal Cisco ASA (https://thehackernews.com/2026/04/weekly-recap-fast16-malware-xchat.html) - UNC6692 Deploys Custom Snow Malware Suite via Teams Impersonation (https://thehackernews.com/2026/04/weekly-recap-fast16-malware-xchat.html) - PhantomCore Exploits TrueConf for Russian Network Breaches (https://thehackernews.com/2026/04/phantomcore-exploits-trueconf.html) - Cursor-Opus AI Agent Deletes Production Database (https://go.theregister.com/feed/www.theregister.com/2026/04/27/cursoropus_agent_snuffs_out_pocketos/) - Robinhood Account Creation Exploited for Phishing (https://www.bleepingcomputer.com/news/security/robinhood-account-creation-flaw-abused-to-send-phishing-emails/) - Silk Typhoon Hacker Extradited to US (https://www.bleepingcomputer.com/news/security/alleged-silk-typhoon-hacker-extradited-to-us-for-cyberespionage/) - Microsoft Entra ID Agent ID Administrator Privilege Escalation (https://thehackernews.com/2026/04/microsoft-patches-entra-id-role-flaw.html) - Unpatched PhantomRPC Windows Privilege Escalation (https://www.darkreading.com/vulnerabilities-threats/unpatched-phantomrpc-flaw-windows-privilege-escalation) - Microsoft Remote Desktop Warning Display Issue (https://www.bleepingcomputer.com/news/microsoft/microsoft-new-remote-desktop-warnings-may-display-incorrectly/) - Outlook.com Outage Causes Sign-In Failures (https://www.bleepingcomputer.com/news/microsoft/microsoft-says-outlookcom-outage-is-causing-sign-in-failures/) - Canada Arrests Three for SMS Blaster Device (https://www.bleepingcomputer.com/news/security/canada-arrests-three-for-operating-sms-blaster-device-in-toronto/) - FTC Warns of $2.1 Billion in Social Media Scam Losses (https://www.bleepingcomputer.com/news/security/ftc-americans-lost-over-21-billion-to-social-media-scams-in-2025/) - Deepfake Voice Attacks Outpacing Defenses (https://www.bleepingcomputer.com/news/security/deepfake-voice-attacks-are-outpacing-defenses-what-security-leaders-should-know/) - Cybersecurity Professionals Face Pay Stagnation (https://go.theregister.com/feed/www.theregister.com/2026/04/27/from_a_massive_skills_gap/) - Fast16 Malware Predates Stuxnet by Five Years (https://thehackernews.com/2026/04/weekly-recap-fast16-malware-xchat.html) - Apple iOS Notification Services (CVE-20 ...