Security incidents in April 2026

A critical login bypass in cPanel & WHM and WP Squared (CVE-2026-41940) lets attackers into hosting control panels without a password. Used in attacks since at least February, including ransomware. Fixes are out.

CISA says ScreenConnect flaw CVE-2024-1708 is used in attacks, including by ransomware gangs. A fix has existed since Feb 2024 (23.9.8). If you or your IT provider run self-hosted ScreenConnect, confirm it is on 23.9.8 or later.

Attackers have exploited Samsung MagicINFO 9 Server, business software for managing displays. The original 21.1050 update left a related flaw exposed. Ask IT to install the latest release, currently 21.1092.3, and remove public internet access.

CISA listed two SimpleHelp remote-support flaws (CVE-2024-57726, CVE-2024-57728) as exploited on 24 April 2026. Fixed in v5.5.8 and later. If you or your IT provider run SimpleHelp, update, change admin and technician passwords, and replace API keys.

The D-Link DIR-823X router has a command injection flaw (CVE-2025-29635) that a Mirai botnet has used since March 2026. The router is end of life and will get no fix. If you own one, replace it with a supported router.

Two exploited Cisco Catalyst SD-WAN Manager flaws expose private information and a service password without a login. Businesses should have their network provider install Cisco’s fixed releases and arrange a compromise assessment.

Attackers are exploiting CVE-2025-48700 in Zimbra’s Classic webmail interface to access sensitive information. Viewing a malicious email can trigger it. Ask your email provider or IT team to confirm its Zimbra server runs a supported, patched release.

Attackers are exploiting CVE-2025-32975 to impersonate users of Quest KACE SMA, a business computer-management appliance. Fixes have been available since 2025. Ask IT to install a supported, patched release and remove direct internet access.

Attackers are using a Kentico Xperience website-management flaw that lets someone with privileged staging access run code on the server. Website owners should ask their provider to install Kentico's latest cumulative hotfix and check for compromise.

Attackers exploited CVE-2026-20122 in Cisco’s business network-management software, including in chains that installed backdoors. Ask your IT provider to update affected systems and check for compromise.

Attackers are exploiting an old PaperCut NG/MF flaw that exposes user account information without a login. Fixes have existed since March 2023. Ask your organisation's IT team to update its print-management server and check for compromise.

CISA says attackers, including ransomware gangs, are using CVE-2024-27199, a path traversal flaw in self-hosted JetBrains TeamCity. The fix has existed since March 2024 in version 2023.11.4. Businesses running older TeamCity On-Premises servers should update now.

Attackers exploited a SharePoint Server flaw that can expose or alter sensitive information without a login. Fixes cover Server 2016, 2019 and Subscription Edition. Ask your IT provider to confirm updates are installed and check for compromise.

CISA added a 2009 Excel flaw (CVE-2009-0238) to its list of flaws used in attacks on 14 April 2026. Opening a booby-trapped Excel file can let an attacker run code. Microsoft fixed it in 2009, so only very old, unsupported Office needs action: upgrade it.

A Windows Shell flaw (CVE-2026-32202) lets a booby-trapped shortcut file make your PC send a sign-in hash to an attacker. It is being used in attacks. Fixed in Microsoft's April 2026 updates: install the latest Windows updates.

Attackers are exploiting a critical flaw in Fortinet FortiClient EMS 7.4.4, a business system for managing endpoint security. Ask IT to upgrade the EMS server to a current supported release; 7.4.5 first fixed this flaw.

CISA flagged a VBA flaw affecting old Windows Office versions and other VBA-based programs. Microsoft released fixes in 2012. Check the relevant Office updates and ask other software vendors whether their bundled VBA copies are fixed.

Two patched Windows flaws let attackers who already have access gain greater control. CISA confirmed exploitation in April and later flagged ransomware use of CVE-2025-60710. Install current Windows security updates and restart.

Attackers are exploiting CVE-2020-9715 in old Adobe Acrobat and Reader installations on Windows and Mac. Adobe fixed every affected release track in August 2020. Open Help > Check for Updates and install the latest version.

Attackers are exploiting a missing login check in exposed Marimo editable notebooks to run commands and collect credentials. Update to 0.23.0 or later, restrict network access and investigate any previously exposed installation.

Attackers used malicious PDFs to collect computer information and steal local file data through Adobe Reader. Adobe fixed CVE-2026-34621 across affected Windows and Mac products. Open Acrobat or Reader and choose Help > Check for Updates.

Russia's APT28 hijacked home and small-office routers, mainly TP-Link, to redirect traffic and steal passwords and tokens. The FBI reset many routers, but replace end-of-life routers, update firmware, change default logins and switch off remote management.

Attackers used FortiClient EMS 7.4.5–7.4.6 to take over management functions without logging in and spread password-stealing malware. Organisations should upgrade EMS to 7.4.7 or later and investigate managed computers for compromise.

Attackers used a flaw in Apache ActiveMQ Classic's management interface to run code on business servers. Two later flaws bypassed its original fix. Ask IT to install a current supported release, rather than stopping at the March updates.

CISA says an old Exchange Server flaw, CVE-2023-21529, is being used in attacks, including ransomware. Any signed-in user could run code on the server. Organisations running their own Exchange should check they are on the fixed builds from Microsoft; home users are unaffected.

Attackers used tampered TrueConf updates to infect Windows computers in Southeast Asian government organisations. Versions 8.1.0–8.5.2 are affected. Install 8.5.3.884 or later from TrueConf, and ask IT to check for compromise.

BlueHammer (CVE-2026-33825) lets someone already on a Windows PC use Microsoft Defender to gain full control. Attackers tried it in a real intrusion and CISA says ransomware gangs use it. Fixed 14 April; check Defender platform is 4.18.26030.3011 or newer.

Attackers exploited a memory flaw in Dawn, a graphics component used by Chromium browsers. Chrome, Edge and Opera have released fixes. Update your browser to its latest version and restart it to complete installation.

iPhones could keep notification previews, including Signal message text, after the app was deleted; the FBI reportedly recovered messages this way. Apple fixed it on 22 April (CVE-2026-28950). Update to iOS or iPadOS 26.4.2 (or 18.7.8) and hide previews on the Lock Screen.

Wasabi Protocol's single admin key was compromised on 30 April 2026, letting an attacker upgrade its contracts on four blockchains and drain over US$5 million. No recovery or compensation plan has been found. Users should avoid Wasabi contracts and revoke approvals.

Australian investment provider Generation Life was breached via an external service provider. It confirmed a limited, unquantified number of people's personal information was affected; funds and transactions were not. Ignore unexpected contact; verify via [email protected].

Three Alibaba listings offered UK Biobank research data, one apparently covering all 500,000 volunteers. Listings were removed and those responsible banned; sales remain unconfirmed. Participants can contact UK Biobank with concerns.

Dutch cosmetics brand Rituals says attackers downloaded part of its My Rituals member database: names, contact details, birth dates and gender. Passwords and payment details were not accessed. Treat unexpected messages mentioning your account as suspect. No fix is needed.

France Titres estimated 11.7 million ANTS accounts were affected by an identity-data breach. Attachments and biometrics were excluded. The portal reopened and a suspect was charged. Change your ANTS password and watch for impersonation messages.

Stolen ADT customer and prospective customer data included home contact details; HIBP identified 5.5 million email addresses. ADT says alarms and payment information were unaffected. Verify unexpected calls independently and review your credit reports.

Attackers stole 116,500 rsETH from KelpDAO’s bridge using compromised LayerZero infrastructure. Backing has been restored, but holders of retired rsETH tokens should check Kelp’s official recovery guide before the June 2027 deadline.

Rhea Lend on NEAR lost about US$18.4M on 16 April 2026 when an attacker beat its margin trading slippage check. Much was returned or frozen, and Rhea says it will cover the roughly US$0.4M gap. Margin trading is discontinued. Whether lending reopened is unconfirmed.

Grinex suspended operations after customer crypto was stolen from its wallets. Reports put the loss around US$14–15 million. Repayment remains unconfirmed. Affected customers should preserve account records and contact official support.

An attacker stole French pupils’ names, ÉduConnect identifiers, schools, classes and some emails and unused-account activation codes. The ministry reset codes. Ask the school for help with blocked accounts and verify unexpected school messages directly.

Unauthorised parties accessed some Booking.com guests’ reservation and contact information. Booking.com reset affected booking PINs and said the incident was contained. Verify payment requests independently, even when they include real booking details.

McGraw Hill data published after extortion contained 13.5 million email addresses and some names, addresses and phone numbers. The company says it secured the exposed webpages. Check your email on Have I Been Pwned and verify unexpected messages directly.

An attacker deceived a Carnival employee and stole customer information, including government ID numbers. Nearly six million customers were notified. Read your notice, monitor accounts and use the free credit monitoring if eligible.

Attackers stole approximately 50.903 bitcoin from Bitcoin Depot’s company wallets. The company found no evidence of customer data theft. No customer update or password reset was advised; recovery of the stolen funds remains unconfirmed.

Attackers stole personal and bank account details of about one million Basic-Fit members across six European countries. Basic-Fit blocked access and notified members. Watch for convincing fake messages and unfamiliar bank transactions.

Ransomware at ChipSoft stole Dutch patients’ personal and medical information and disrupted portals and mobile services. ChipSoft says the stolen data was destroyed. Ask your healthcare provider whether your records were involved.

Canada Life’s employee-account breach led to a leak containing about 237,800 email addresses and some support tickets. Some customer notices also listed sensitive insurance data. Verify unexpected messages and activate any credit monitoring offered.

Attackers seized control of Solana trading platform Drift and stole roughly US$295 million. Affected users can claim DFX recovery tokens, but launch payouts covered only about 1% of losses. Check official claim terms: redeeming ends future rights on those tokens.

Socket found 108 malicious Chrome extensions with about 20,000 installs. Some collected Google profile details; Telegram Multi-account stole Telegram Web sessions. Remove listed extensions and revoke affected Telegram sessions. Full removal remains unconfirmed.

CPUID’s official download links sent some Windows users to STX RAT malware on 9–10 April. CPUID fixed the links, but that does not clean infected PCs. If you ran a download from that period, have the computer checked.

Official, signed DAEMON Tools Lite installers carried malware from 8 April. Disc Soft says free Lite 12.5.1 was affected. Uninstall it, run a full antivirus scan, then install clean version 12.6.0.2445 or later if needed.

China-linked Sequin Carp posed as whistleblowers to get journalists to approve a malicious app on a real Google sign-in, giving lasting Gmail access without a password. Never approve unexpected access requests. Review Google account permissions and remove unfamiliar apps.

A fake Ledger Live app on the Mac App Store tricked 50+ people into entering wallet recovery phrases, costing about US$9.5M (7-13 April). Apple removed it. Never type a recovery phrase into any app; get Ledger software only from ledger.com.

WhatsApp warned about 200 people, mainly in Italy, about a spyware-laced imitation of its iPhone app. It blamed ASIGINT, part of SIO. Anyone warned should remove the imitation and install official WhatsApp; no WhatsApp security patch applies.