CyberPulse

A state intelligence-linked threat actor is conducting an active password-spraying campaign against Microsoft 365 environments across the Gulf, impacting 300+ organizations in three distinct attack waves on March 3, 13, and 23 — each separated by exactly 10 days. Targets include government, municipalities, technology, transportation, and energy. A state-sponsored actor deployed BRICKSTORM kernel implants and passive backdoors targeting VMware vSphere/vCenter/ESXi for long-term espionage below the guest OS layer. The Coruna iOS exploit kit was confirmed to contain an updated kernel exploit from the Operation Triangulation campaign. Apple expanded DarkSword patches to iOS 18.7.7 for older devices. Malicious npm packages masquerading as Strapi community plugins were identified across four sock puppet accounts.

• https://thehackernews.com/2026/04/iran-nexus-password-spraying-m365-israel-uae.html
• https://www.cybersecurity-review.com/news-april-2026/
• https://www.securityweek.com/brickstorm-vmware-vsphere-kernel-implants/
• https://thehackernews.com/2026/04/malicious-strapi-npm-plugins.html
• https://www.securityweek.com/coruna-operation-triangulation-kernel-exploit/
• https://thehackernews.com/2026/04/fortinet-forticlient-ems-cve-2026-35616-zero-day.html
• https://thehackernews.com/2026/04/apple-darksword-ios-18-7-7-patches.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Today is the KEV remediation deadline for the F5 BIG-IP APM vulnerability CVE-2025-53521 (CVSS 9.3), reclassified from DoS to RCE after confirmed exploitation. A critical flaw in Open VSX's pre-publish scanning pipeline was disclosed — scanner failures were silently interpreted as "no scanners configured," allowing malicious extensions to bypass all vetting and explaining how the GlassWorm campaign evaded detection. Citrix NetScaler CVE-2026-3055 reconnaissance has intensified with attackers targeting the specific vulnerable endpoint. Three new vulnerabilities in LangChain and LangGraph expand the AI framework attack surface. The DarkSword iOS exploit chain has reportedly leaked to GitHub. A senior energy official publicly warned that adversaries may be pre-positioned inside energy infrastructure networks.

• https://thehackernews.com/2026/03/f5-bigip-apm-rce-kev.html
• https://thehackernews.com/2026/03/open-vsx-scanning-bypass-glassworm.html
• https://thehackernews.com/2026/03/citrix-netscaler-active-reconnaissance.html
• https://thehackernews.com/2026/03/langchain-langgraph-vulnerabilities-ai.html
• https://www.hendryadrian.com/cybersecurity-news-daily-recap-28-mar-2026/
• https://cybernews.com/darksword-ios-exploit-leaked-github/
• https://this.weekinsecurity.com/this-week-in-security-march-29-2026-edition/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The Criminal Marketplace Youre Not Monitoring

The Agent Internet Is Already Leaking

Palo Alto Unit 42 published a live threat brief confirming sixty hacktivist groups are now active in coordinated cyber operations, with allied foreign collectives joining the fight. An Electronic Operations Room was established within hours of the strikes to synchronize targeting across the coalition. Check Point Research confirmed that Handala Hack is routing attacks through Starlink IP ranges from inside the nationwide internet blackout, creating a detection blind spot for defenders relying on geographic IP filtering. A national CERT intercepted an OT attack on SCADA systems managing civilian food reserves — representing an escalation from traditional energy targeting to food infrastructure. Actionable guidance covers Starlink ASN blocking, OT exposure hunting, and DDoS preparation for allied foreign convergence.

• https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/
• https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/
• https://www.infosecurity-magazine.com/news/iran-cyber-attacks-global-google/
• https://www.nextgov.com/cybersecurity/2026/03/intelligence-firms-watch-uptick-iran-cyber-activity-after-us-israel-strikes/411802/
• https://www.sentinelone.com/blog/sentinelone-intelligence-brief-iranian-cyber-activity-outlook/
• https://industrialcyber.co/industrial-cyber-attacks/us-israeli-campaign-triggers-iranian-counteroffensive-targeting-gulf-energy-critical-infrastructure/
• https://cybernews.com/editorial/iran-us-conflict-blackout-cyberattacks-misinformation/
• https://www.digit.in/features/general/elon-musks-starlink-shaping-2026-iran-us-israel-cyber-war-heres-how.html

The mean time from CVE publication to working exploit has collapsed to approximately 10 hours in 2026 — down from 56 days in 2024 and 23 days in 2025, across 3,532 CVE-exploit pairs. Google's Threat Intelligence Group confirmed it thwarted a hacker group using AI to discover a zero-day and plan a mass vulnerability exploitation operation — the first confirmed case of AI-powered coordinated mass exploitation planning. Ivanti EPMM CVE-2026-6973 was exploited as a zero-day. Palo Alto PAN-OS CVE-2026-0300 allows unauthenticated root-level RCE on firewalls through the authentication portal — active exploitation, no patch available. Dirty Frag, an unpatched Linux kernel flaw, enables root privilege escalation with public PoC. cPanel CVE-2026-41940 (max severity auth bypass) is under mass exploitation from 2,000+ attacker IPs. 84 TanStack npm package artifacts were compromised in a supply chain attack.

• https://www.cnbc.com/2026/05/11/google-thwarts-effort-hacker-group-use-ai-mass-exploitation-event.html
• https://thehackernews.com/2026/05/ivanti-epmm-palo-alto-pan-os-zero-day.html
• https://research.checkpoint.com/2026/11th-may-threat-intelligence-report/
• https://thehackernews.com/2026/05/cpanel-cve-2026-41940-mass-exploitation.html
• https://thehackernews.com/2026/05/dirty-frag-linux-kernel-privilege-escalation.html
• https://cybersecuritynews.com/tanstack-npm-supply-chain-compromise/
• https://thehackernews.com/2026/05/exploitation-window-10-hours-2026.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The 17 Billion Warning Sign

A rival AI company officially launched GPT-5.4-Cyber, a frontier model optimized for defensive cybersecurity, days after Project Glasswing — making the AI cyber arms race live with two competing frontier models now shipping for enterprise security. A critical authentication bypass (CVE-2026-33032, CVSS 9.8) was discovered in the Model Context Protocol (MCP) integration for nginx-ui, allowing any network attacker to invoke all MCP tools without authentication. Patch Tuesday zero-days identified: CVE-2026-32201 (SharePoint spoofing, in KEV, deadline April 28) and CVE-2026-33825 (Defender privilege escalation to SYSTEM, the "BlueHammer" disclosure). A new cybercrime platform ATHR offers fully automated voice phishing using human operators and AI agents. Attackers are exploiting Marimo Python notebooks to deploy NKAbuse malware hosted on Hugging Face Spaces.

• https://thehackernews.com/2026/04/openai-gpt-54-cyber-defensive-model.html
• https://thehackernews.com/2026/04/nginx-ui-mcp-auth-bypass-cve-2026-33032.html
• https://www.securityweek.com/microsoft-patches-exploited-sharepoint-zero-day-and-160-other-vulnerabilities/
• https://www.bleepingcomputer.com/news/security/athr-voice-phishing-platform-ai-agents/
• https://www.bleepingcomputer.com/news/security/marimo-python-notebook-nkabuse-hugging-face/
• https://www.integrity360.com/cyber-news-roundup-april-17th-2026
• https://www.anthropic.com/glasswing
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Check Point Research disclosed critical vulnerabilities in Anthropic's Claude Code where simply opening an untrusted repository could silently execute commands on a developer's machine, steal API credentials, and compromise an entire team's workspace — all through configuration files treated as harmless metadata. Separately, Google and Mandiant dismantled GRIDTIDE, a China-linked espionage campaign that used Google Sheets as command-and-control infrastructure to breach 53 organizations across 42 countries, targeting telecoms and governments for surveillance. Both stories reveal the same pattern: trusted, inert-looking data becoming active attack surfaces.

• https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/
• https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html
• https://www.theregister.com/2026/02/26/clade_code_cves/
• https://www.darkreading.com/application-security/flaws-claude-code-developer-machines-risk
• https://www.securityweek.com/claude-code-flaws-exposed-developer-devices-to-silent-hacking/
• https://securityaffairs.com/188508/security/untrusted-repositories-turn-claude-code-into-an-attack-vector.html
• https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign
• https://www.bleepingcomputer.com/news/security/chinese-cyberspies-breached-dozens-of-telecom-firms-govt-agencies/
• https://www.securityweek.com/google-disrupts-chinese-cyberespionage-campaign-targeting-telecoms-governments/
• https://www.infosecurity-magazine.com/news/google-prolific-china-hacking/

A stolen civil servant credential gave an attacker weeks of unrestricted access to FICOBA — France's national bank account registry containing every bank account opened in the country. 1.2 million accounts were browsed, exposing IBANs, names, addresses, and tax IDs. No MFA, no anomaly detection, no rate limiting. The breach creates immediate SEPA direct debit fraud risk across the EU. Phishing campaigns targeting affected customers were already detected within days.

• https://www.bleepingcomputer.com/news/security/data-breach-at-french-bank-registry-impacts-12-million-accounts/
• https://therecord.media/attackers-breach-france-national-bank-account-database
• https://www.helpnetsecurity.com/2026/02/19/ficoba-data-breach-bank-accounts/
• https://securityaffairs.com/188200/hacking/french-ministry-confirms-data-access-to-1-2-million-bank-accounts.html
• https://www.techradar.com/pro/security/french-government-systems-hacked-over-1-2-million-private-financial-accounts-hit
• https://www.scworld.com/brief/hacker-accesses-1-2-million-french-bank-accounts-using-stolen-credentials
• https://www.webpronews.com/frances-financial-data-catastrophe-how-hackers-breached-government-systems-and-exposed-1-2-million-private-accounts/