Apr 16, 2026 · #28

Episode 28 — 16 Apr 2026 1. US nationals behind DPRK IT worker 'laptop farm' sent to prison Source: Bleeping Computer Two U.S. nationals have been sent to prison for helping North Korean remote information technology (IT) workers to pose as U.S. residents and get hired by over 100 companies across the country, including many Fortune 500 firms. 42-year-old Kejia Wang and 39-year-old Zhenxing... 2. New AgingFly malware used in attacks on Ukraine govt, hospitals Source: Bleeping Computer A new malware family named ‘AgingFly’ has been identified in attacks against local governments and hospitals that steal authentication data from Chromium-based browsers and WhatsApp messenger. The attacks were spotted in Ukraine by the country's CERT team last month. Based on... 3. Critical Nginx UI auth bypass flaw now actively exploited in the wild Source: Bleeping Computer A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authentication. The flaw, tracked as CVE-2026-33032, is caused by nginx-ui leaving the ‘/mcp_message’ endpoint unprotected,... 4. CISA flags Windows Task Host vulnerability as exploited in attacks Source: Bleeping Computer CISA warned U.S. government agencies to secure their systems against a Windows Task Host privilege escalation vulnerability that could allow attackers to gain SYSTEM privileges. Task Host is a core Windows system component that serves as a container for DLL-based processes,... 5. UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign Source: The Hacker News The Computer Emergencies Response Team of Ukraine (CERT-UA) has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from... 6. n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails Source: The Hacker News Threat actors have been observed weaponizing n8n, a popular artificial intelligence (AI) workflow automation platform, to facilitate sophisticated phishing campaigns and deliver malicious payloads or fingerprint devices by sending automated emails. "By leveraging trusted... 7. Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover Source: The Hacker News A recently disclosed critical security flaw impacting nginx-ui, an open-source, web-based Nginx management tool, has come under active exploitation in the wild. The vulnerability in question is CVE-2026-33032 (CVSS score: 9.8), an authentication bypass vulnerability that... 8. April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More Source: The Hacker News A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnerability impacting SAP Business Planning and Consolidation and SAP Business...