Apr 15, 2026 · #27

Episode 27 — 15 Apr 2026 1. Critical flaw in wolfSSL library enables forged certificate use Source: Bleeping Computer A critical vulnerability in the wolfSSL SSL/TLS library can weaken security via improper verification of the hash algorithm or its size when checking Elliptic Curve Digital Signature Algorithm (ECDSA) signatures. Researchers warn that an attacker could exploit the issue to... 2. McGraw-Hill confirms data breach following extortion threat Source: Bleeping Computer Education company McGraw-Hill has confirmed in a statement to BleepingComputer that hackers exploited a Salesforce misconfiguration and accessed its internal data. The company assured that the breach did not affect its Salesforce accounts, customer databases, or internal... 3. Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover Source: The Hacker News A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild. The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that... 4. Microsoft adds Windows protections for malicious Remote Desktop files Source: Bleeping Computer Microsoft has introduced new Windows protections to defend against phishing attacks that abuse Remote Desktop connection (.rdp) files, adding warnings and disabling risky shared resources by default. RDP files are commonly used in enterprise environments to connect to remote... 5. Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities Source: The Hacker News Microsoft on Tuesday released updates to address a record 169 security flaws across its product portfolio, including one vulnerability that has been actively exploited in the wild. Of these 169 vulnerabilities, 157 are rated Important, eight are rated Critical, three are... 6. European Gym giant Basic-Fit data breach affects 1 million members Source: Bleeping Computer Dutch fitness giant Basic-Fit announced that hackers breached its systems and gained access to information belonging to a million of its customers. The company operates the largest gym chain in Europe, owning more than 1,700 clubs and over 430 franchises in 12 countries,... 7. 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users Source: The Hacker News Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting... 8. CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software Source: The Hacker News The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2026-21643 (CVSS score:...