2026-04-02: Chrome's fourth actively exploited zero-day of 2026 (CVE-2026-5281) landed with a CISA KEV deadline

Show Notes - 2026-04-02 Stories Covered: - 2026-04-02 - Today: - Chrome Zero-Day CVE-2026-5281 - Fourth Actively Exploited Bug of 2026 (https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html) - Apple iOS 18.7.7 - DarkSword Exploit Kit Patches, CISA Deadline April 3 (https://www.bleepingcomputer.com/news/security/apple-expands-ios-18-updates-to-more-iphones-to-block-darksword-attacks/) - TrueConf CVE-2026-3502 - Zero-Day Exploited by Chinese-Nexus Actor in Government Campaign (https://www.bleepingcomputer.com/news/security/hackers-exploit-trueconf-zero-day-to-push-malicious-software-updates/) - Qilin Ransomware - 2025 Year in Review and 2026 Outlook (https://blog.talosintelligence.com/an-overview-of-ransomware-threats-in-japan-in-2025-and-early-detection-insights-from-qilin-cases/) - TrueChaos Campaign (Chinese-Nexus, TrueConf exploitation) - Axios Supply Chain / Sapphire Sleet (DPRK) - AGEWHEEZE RAT (UAC-0255 / Cyber Serp) - ADS Removal / DonutLoader Dropper (SANS ISC) - Axios npm Supply Chain Attack - Sapphire Sleet (DPRK), 70M+ Weekly Downloads Affected (https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/) - TeamPCP / LiteLLM Supply Chain - First Confirmed Victim, Active Cloud Credential Exploitation (https://isc.sans.edu/diary/rss/32856) - F5 BIG-IP APM - 14,000+ Instances Still Exposed to Critical RCE (https://www.bleepingcomputer.com/news/security/over-14-000-f5-big-ip-apm-instances-still-exposed-to-rce-attacks/) - EvilTokens - New Service Commoditizing Microsoft Device Code Phishing (https://www.bleepingcomputer.com/news/security/new-eviltokens-service-fuels-microsoft-device-code-phishing-attacks/) - Classic Outlook Email Delivery Failures - Known Issue Under Investigation (https://www.bleepingcomputer.com/news/microsoft/microsoft-links-classic-outlook-bug-to-email-delivery-issues/) - CERT-UA Impersonation Campaign Distributes AGEWHEEZE RAT to 1M Emails (https://thehackernews.com/2026/04/cert-ua-impersonation-campaign-spread.html) - Casbaneiro Banking Trojan Targeting Spanish-Speaking Organizations via Horabot (https://thehackernews.com/2026/04/casbaneiro-phishing-targets-latin.html) - Talos 2025 Year in Review - Key Defender Takeaways (https://blog.talosintelligence.com/inside-the-talos-2025-year-in-review-a-discussion-on-what-the-data-means-for-defenders/) - CVE-2026-5121 - CVE-2026-2436 - CVE-2026-5119 - CVE-2026-33216 - CVE-2026-29785 - CVE-2026-4897 - CVE-2026-2739 - CVE-2026-5107 - CVE-2026-5201 (https://msrc.microsoft.com/update-guide/) CVEs Referenced: CVE-2025-14174, CVE-2025-31277, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700, CVE-2026-2436, CVE-2026-2441, CVE-2026-2739, CVE-2026-29785, CVE-2026-33216, CVE-2026-3502, CVE-2026-3909, CVE-2026-3910, CVE-2026-4897, CVE-2026-5107, CVE-2026-5119, CVE-2026-5121, CVE-2026-5201, CVE-2026-5281 Indicators of Compromise: Domains: sfrclak[.]com, npm[.]org, 237[.]92, cert-ua[.]tech Full brief: https://carolinacleartech.com/brief/2026-04-02/