Daily Threat Briefing — Apr 16, 2026

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of April 16, 2026.

1. Newly Discovered PowMix Botnet Hits Czech Workers Using Randomized C2 Traffic
   — The Hacker News
   
   Cybersecurity researchers have warned of an active malicious campaign that's targeting the workforce in the Czech Republic with a previously…
2. Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face
   — Bleeping Computer
   
   Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hug…
3. Two-Factor Authentication Breaks Free from the Desktop
   — Dark Reading
   
   Threat actors know how to bypass security systems outside of traditional IT environments. Implementing 2FA could provide a needed extra secu…
4. Google expands Gemini AI use to fight malicious ads on its platform
   — Bleeping Computer
   
   Google says it is increasingly using its Gemini AI models to detect and block harmful ads on its advertising platforms, as scammers and thre…
5. Microsoft's Original Windows Secure Boot Certificate Is Expiring
   — Dark Reading
   
   The Secure Boot refresh is one of the largest coordinated security maintenance efforts across the Windows ecosystem, Microsoft said. Update …
6. New ATHR vishing platform uses AI voice agents for automated attacks
   — Bleeping Computer
   
   A new cybercrime platform called ATHR can harvest credentials via fully automated voice phishing attacks that use both human operators and A…
7. ThreatsDay Bulletin: Defender 0-Day, SonicWall Brute-Force, 17-Year-Old Excel RCE and 15 More Stories
   — The Hacker News
   
   You know that feeling when you open your feed on a Thursday morning and it's just… a lot? Yeah. This week delivered. We've got hackers …
8. [Webinar] Find and Eliminate Orphaned Non-Human Identities in Your Environment
   — The Hacker News
   
   In 2024, compromised service accounts and forgotten API keys were behind 68% of cloud breaches. Not phishing. Not weak passwords. Unmanage…
9. 6-Year Ransomware Campaign Targets Turkish Homes & SMBs
   — Dark Reading
   
   While enterprises breaches make more headlines, smaller incidents tend to be under-reported, if at all, allowing campaigns to last longer wi…
10. ISC Stormcast For Thursday, April 16th, 2026 https://isc.sans.edu/podcastdetail/9894, (Thu, Apr 16th)
    — SANS ISC
    
    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
11. [Guest Diary] Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)
    — SANS ISC
    
    [This is a Guest Diary by Alec Jaffe, an ISC intern as part of the SANS.edu Bachelor's Degree in Applied Cybersecuri…
12. ISC Stormcast For Wednesday, April 15th, 2026 https://isc.sans.edu/podcastdetail/9892, (Wed, Apr 15th)
    — SANS ISC
    
    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

🛡️ NVD — Last 20 Scored Vulnerabilities

Latest scored CVEs from the National Vulnerability Database (6623 in last 30 days).
Critical: 4 ‷ High: 8 ‷ Medium: 7 ‷ Low: 1. View full dashboard →

1. CVE-2026-41082
   — CVSS 7.3 (HIGH)
   
   In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
2. CVE-2026-24749
   — CVSS 5.3 (MEDIUM)
   
   The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2, images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile:…
3. CVE-2025-43883
   — CVSS 4.1 (MEDIUM)
   
   Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper check for unusual or exceptional conditions vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability…
4. CVE-2026-41080
   — CVSS 2.9 (LOW)
   
   libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
5. CVE-2025-36579
   — CVSS 5.1 (MEDIUM)
   
   Dell Client Platform BIOS contains a Weak Password Recovery Mechanism vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability, leading to unauthorized ac…
6. CVE-2026-3324
   — CVSS 8.2 (HIGH)
   
   Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
7. CVE-2026-37347
   — CVSS 9.1 (CRITICAL)
   
   SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php.
8. CVE-2026-37346
   — CVSS 4.7 (MEDIUM)
   
   SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=.
9. CVE-2026-37345
   — CVSS 9.8 (CRITICAL)
   
   SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php.
10. CVE-2026-37338
    — CVSS 9.4 (CRITICAL)
    
    SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php.
11. CVE-2026-37337
    — CVSS 7.3 (HIGH)
    
    SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.
12. CVE-2026-37336
    — CVSS 7.3 (HIGH)
    
    SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.
13. CVE-2026-33804
    — CVSS 7.4 (HIGH)
    
    @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not account for duplicate slash…
14. CVE-2026-30656
    — CVSS 7.5 (HIGH)
    
    A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option. The callback function str_fdp_pli_cb() does not validate the input pointer and call…
15. CVE-2026-30459
    — CVSS 7.1 (HIGH)
    
    An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message.
16. CVE-2026-2840
    — CVSS 6.4 (MEDIUM)
    
    The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all versions up to, and including, 2.4.4 due to insuffic…
17. CVE-2026-6410
    — CVSS 5.3 (MEDIUM)
    
    @fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option. The dirList.path() function resolves directories outside the configured static root using path.join…
18. CVE-2026-6270
    — CVSS 9.1 (CRITICAL)
    
    @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent scope and then registe…
19. CVE-2026-5785
    — CVSS 8.1 (HIGH)
    
    Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
20. CVE-2026-4160
    — CVSS 5.3 (MEDIUM)
    
    The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'submission_id' parameter in versions up to, and…

Source: NVD CVE API 2.0

Generated by CryptXNet.ai Threat Intelligence Platform · April 16, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com