Apr 24, 2026 · #36

Episode 36 — 24 Apr 2026 1. LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure Source: The Hacker News A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public disclosure. The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5),... 2. CISA orders feds to patch BlueHammer flaw exploited as zero-day Source: Bleeping Computer CISA has given U.S. government agencies two weeks to secure their Windows systems against a Microsoft Defender privilege escalation vulnerability that has been exploited in zero-day attacks. Tracked as CVE-2026-33825 , this high-severity security flaw allows low-privileged... 3. Hackers exploit file upload bug in Breeze Cache WordPress plugin Source: Bleeping Computer Hackers are actively exploiting a critical vulnerability in the Breeze Cache plugin for WordPress that allows uploading arbitrary files on the server without authentication. The security issue is tracked as CVE-2026-3844 and has been leveraged in more than 170 exploitation... 4. CISA, National Cyber Security Centre (NCSC) UK, and Global Partners Issue Advisory on Chinese Government-Linked Covert Cyber Networks Source: CISA News Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on... 5. Cosmetics giant Rituals discloses data breach affecting customers Source: Bleeping Computer Dutch cosmetics giant Rituals disclosed a data breach after attackers stole the personal information of an undisclosed number of customers from its "My Rituals" membership database. The company revealed the security incident in a Wednesday notice, saying that the breach was... 6. New GopherWhisper APT group abuses Outlook, Slack, Discord for comms Source: Bleeping Computer A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord in attacks against government entities. Active since at least 2023, the hackers have been linked... 7. CISA Warns of FIRESTARTER Malware Targeting Cisco ASA including Firepower and Secure Firewall Products Source: CISA News Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on... 8. Vercel Finds More Compromised Accounts in Context.ai-Linked Breach Source: The Hacker News Vercel on Wednesday revealed that it has identified an additional set of customer accounts that were compromised as part of a security incident that enabled unauthorized access to its internal systems. The company said it made the discovery after expanding its investigation...