Google Threat Intelligence Group and iVerify published simultaneous research on Coruna, a nation-state-grade iOS exploit kit containing 23 exploits across five full attack chains targeting iOS 13 through 17.2.1. The kit proliferated from a commercial surveillance vendor to state-linked espionage operations to mass criminal deployment in under twelve months — marking the first observed mass exploitation of mobile devices using nation-state-grade tools. Combined with this week's Cisco SD-WAN three-year dwell time (compliance deadline tonight), APT28's MSHTML zero-day, and a Qualcomm Android zero-day under active exploitation, defenders face a convergence of advanced capabilities being deployed simultaneously across network, desktop, and mobile layers.

• https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
• https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html
• https://www.helpnetsecurity.com/2026/03/03/coruna-ios-exploit-kit/
• https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking
• https://cyberscoop.com/coruna-ios-exploit-kit-leaked-us-framework/
• https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html
• https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis
• https://thehackernews.com/2026/03/google-confirms-cve-2026-21385-in.html

Attackers hijacked the update infrastructure for Smart Slider 3 Pro (800K+ WordPress installations) and pushed a fully weaponized remote access toolkit through the official update channel for approximately six hours. Adobe released an emergency patch for CVE-2026-34621 (CVSS 8.6), a prototype pollution flaw in Acrobat Reader under active exploitation via malicious PDFs. The GlassWorm campaign evolved with a Zig-compiled dropper targeting multiple developer IDEs simultaneously. Google shipped Device Bound Session Credentials (DBSC) in Chrome 146, binding session cookies to hardware TPM to block infostealer session replay. Thousands of internet-exposed Rockwell PLCs were confirmed, expanding the OT attack surface quantification.

• https://thehackernews.com/2026/04/smart-slider-3-pro-wordpress-update-hijack.html
• https://thehackernews.com/2026/04/adobe-acrobat-reader-cve-2026-34621-zero-day.html
• https://thehackernews.com/2026/04/glassworm-zig-dropper-developer-ides.html
• https://www.hendryadrian.com/cybersecurity-news-daily-recap-11-apr-2026/
• https://hackread.com/adobe-reader-zero-day-actively-exploited/
• https://www.bleepingcomputer.com/news/security/rockwell-plc-thousands-exposed/
• https://this.weekinsecurity.com/this-week-in-security-april-12-2026-edition/
• https://www.bleepingcomputer.com/news/security/google-chrome-dbsc-device-bound-session-credentials/

DarkSword, a second nation-state-grade iOS exploit kit, has been disclosed — this one targeting current iOS versions (18.4–18.7) with six vulnerabilities including four zero-days, deployed by three separate operators since November 2025. Unlike Coruna which targeted legacy iOS, DarkSword compromises fully patched modern devices. A critical SharePoint deserialization flaw (CVE-2026-20963) patched in January is now confirmed actively exploited. Formal guidance was issued to harden Microsoft Intune after the medical technology wiper, with the confirmed device count revised to ~80,000. The GlassWorm supply chain campaign escalated across npm, Open VSX, and GitHub simultaneously, now using Solana blockchain for C2 and in-memory-only execution.

• https://www.cybersecbrief.com/news/cybersec/cybersec-2026-03-19
• https://www.cybernewscentre.com/20th-march-2026-cyber-update-headlines-of-the-week/
• https://www.bleepingcomputer.com/news/security/sharepoint-vulnerability-now-exploited-in-attacks/
• https://www.hendryadrian.com/cybersecurity-news-daily-recap-19-mar-2026/
• https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html
• https://www.bleepingcomputer.com/news/security/glassworm-supply-chain-attack-targets-github-npm-vscode-extensions/
• https://www.scworld.com/news/no-restoration-timeline-for-medical-device-maker-stryker-after-cyberattack
• https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

A low-skill, Russian-speaking hacker used commercial AI services to breach over 600 enterprise firewalls across 55 countries in five weeks. No zero-days required. Amazon just showed us what the automation of mediocrity looks like at scale.

• https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/
• https://www.bleepingcomputer.com/news/security/amazon-ai-assisted-hacker-breached-600-fortigate-firewalls-in-5-weeks/
• https://thehackernews.com/2026/02/ai-assisted-threat-actor-compromises.html
• https://cybersecuritynews.com/600-fortigate-devices-hacked/
• https://blog.cloudflare.com/cloudflare-outage-february-20-2026/
• https://cybersecuritynews.com/cloudflare-down-6-hour-of-massive-global-service-outage/
• https://cybersecuritynews.com/cybersecurity-news-weekly/

Cisco patched CVE-2026-20093 (CVSS 9.8) in the Integrated Management Controller — an authentication bypass that allows an unauthenticated attacker to change any user's password, including the administrator, and gain full system control via a single crafted HTTP request. This continues the management plane attack pattern tracked since March across Intune, Cisco FMC, SD-WAN, and FortiClient EMS. A mass exploitation campaign using automated credential harvesting compromised 766 hosts via a web framework vulnerability, exfiltrating database credentials, SSH keys, cloud secrets, and API keys. Ransomware tracking shows 2,726 victims year-to-date through April 3 with 104 in the first three days of April. A state-linked actor publicly announced intent to escalate attacks on technology companies across the region.

• https://thehackernews.com/2026/04/cisco-imc-authentication-bypass-cve-2026-20093.html
• https://dev.to/mrcomputerscience/breaking-cybersecurity-news-for-20260404-pithy-cyborg-threats-breaches-intel-bok
• https://this.weekinsecurity.com/this-week-in-security-april-5-2026-edition/
• https://kcnet.in/2026/04/02/cybersecurity-incidents-alerts-april-2026/
• https://cybernews.com/news/iran-threatens-us-big-tech-middle-east/
• https://www.cybermaterial.com/p/cyber-briefing-20260401
• https://thehackernews.com/2026/04/chrome-zero-day-dawn-webgpu.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

With conventional military options destroyed in this weekend's coordinated strikes, threat intelligence firms assess that cyber operations are now the sole remaining instrument of asymmetric retaliation — and state-linked cyber units were activated before the kinetic trigger was pulled. This briefing reveals that the wiper malware scenario already happened: a Shamoon 4.0 variant struck Gulf energy infrastructure in January, compromising 15,000 workstations, while port disruptions and rolling blackouts hit weeks before the current escalation. New threat vectors include deepfake social engineering deployed during communications blackouts, with staff receiving fake CEO evacuation messages while internet and news are degraded. CISA is operating at reduced staffing during the most acute threat period in years. Actionable guidance covers wiper preparedness, deepfake countermeasures, OT/ICS hardening, and supply chain contingency planning for simultaneous disruption of the Strait of Hormuz and Red Sea shipping lanes.

• https://www.govexec.com/defense/2026/02/strikes-iran-will-test-us-cyber-strategy-abroad-and-defenses-home/411784/
• https://www.khaleejtimes.com/world/asia/usisraeliran-trigger-unprecedented-cyberattacks
• https://fortune.com/2026/03/01/cyber-retaliation-iran-hack-corporate-security/
• https://fortune.com/2026/02/28/iran-death-ground-existential-threat-us-attacks-retaliation-terrorism-cyberattacks-strait-of-hormuz/
• https://time.com/7381884/iran-missiles-dubai-palm-gulf/
• https://www.cnn.com/world/live-news/israel-iran-attack-02-28-26-hnk-intl
• https://en.wikipedia.org/wiki/2026_Israeli%E2%80%93United_States_strikes_on_Iran
• https://www.ic3.gov/CSA/2025/250630.pdf
• https://windward.ai/blog/middle-east-on-the-precipice-gps-jamming-in-the-arabian-gulf-and-strait-of-hormuz-disrupts-970-ships-daily/
• https://vinciworks.com/blog/the-compliance-fallout-from-the-2026-iran-war-key-risks-and-red-flags/

The Malware That Thinks

A board-level strategic briefing synthesizing the week that confirmed the AI cyber arms race is live. Two frontier AI companies shipped cyber-specialized models within nine days of each other. A twelve-company coalition committed $100M. Mandiant M-Trends reports 22-second adversary handoff times while CrowdStrike tracks 29-minute eCrime breakout — both shrinking. A CVSS 9.8 authentication bypass in the Model Context Protocol proves the AI agent integration layer is being deployed with default-open configurations. AI coding tools correlate with a 4x spike in critical findings — AI is simultaneously finding and creating more vulnerabilities. And automated voice phishing using human operators and AI agents has launched as a platform. Four board-level questions address machine-speed SOC operations, AI agent protocol governance, AI-generated code scrutiny, and social engineering defense updates.

• https://www.anthropic.com/glasswing
• https://thehackernews.com/2026/04/openai-gpt-54-cyber-defensive-model.html
• https://thehackernews.com/2026/04/nginx-ui-mcp-auth-bypass-cve-2026-33032.html
• https://thehackernews.com/2026/04/mandiant-m-trends-2026-22-second-handoff.html
• https://www.crowdstrike.com/global-threat-report/
• https://thehackernews.com/2026/04/ai-coding-tools-critical-findings-quadrupling.html
• https://www.bleepingcomputer.com/news/security/athr-voice-phishing-platform-ai-agents/
• https://www.darktrace.com/blog/the-state-of-ai-cybersecurity-2026

The Machine Underground

A global utility infrastructure vendor disclosed unauthorized access to its corporate IT systems via SEC 8-K filing, creating potential supply chain exposure for electricity, gas, and water utilities running its smart metering and grid management products. A new threat group (UNC6692) is deploying the three-component Snow malware suite — Snowbelt browser extension, Snowglaze tunneler, and Snowbasin backdoor — for deep persistent access via social engineering. Four new KEV additions include a CVSS 9.9 privilege escalation in SimpleHelp remote support software used by managed service providers. A second medical device company disclosed a breach, confirming the sector as a target category. Firefox 150 and Tor 15.0.10 patch CVE-2026-6770 in the shared browser engine.

• ttps://www.securityweek.com/itron-8k-sec-filing-unauthorized-access/
• https://www.bleepingcomputer.com/news/security/unc6692-snow-malware-suite-browser-tunneler-backdoor/
• https://thehackernews.com/2026/04/cisa-adds-4-exploited-flaws-simplehelp-samsung-dlink.html
• https://www.bleepingcomputer.com/news/security/medtronic-breach-corporate-it-systems/
• https://www.securityweek.com/firefox-150-tor-15-cve-2026-6770/
• https://www.cybermaterial.com/p/cyber-briefing-20260427
• https://www.bleepingcomputer.com/news/security/new-checkmarx-supply-chain-breach-affects-kics-analysis-tool/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog