CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities catalog, including two Windows privilege escalation flaws from 2023 and 2025, and a five-year-old Adobe Acrobat bug that allows arbitrary code execution. The warning also covers recent zero-day exploits in Adobe Reader and Fortinet FortiClient, plus an Exchange vulnerability linked to the Medusa ransomware gang and a 2012 Visual Basic flaw that's seeing renewed exploitation. Federal agencies have two weeks to patch most of these vulnerabilities, with the Fortinet bug requiring immediate attention by mid-April.

RCI Hospitality Holdings, one of the largest adult nightclub operators in the U.S., has disclosed a data breach affecting numerous independent contractors after a simple web vulnerability exposed sensitive personal information including names, Social Security numbers, and driver's license numbers. The incident stemmed from an insecure direct object reference vulnerability on an IIS web server that was discovered March 23rd but may have allowed access since March 19th. The company says no customer or financial data was compromised and business operations remain unaffected, though it's unclear exactly how many individuals were impacted.

Google is integrating a Rust-based DNS parser into the modem firmware of its Pixel phones, starting with the Pixel 10 series, to address mounting security concerns around cellular modems. The move is part of Google's broader push to replace memory-unsafe C and C++ code with Rust, a language that eliminates entire classes of vulnerabilities that attackers have increasingly exploited in cellular modem firmware. While this initial implementation replaces just one risky component, Google says it lays the groundwork for more memory-safe code in future baseband processors.

Despite federal sanctions, the cybercrime operation Triad Nexus continues to evade restrictions by using front companies, account mules, and major cloud services from Amazon, Cloudflare, Google, and Microsoft to maintain legitimacy for their scams. The group, linked to Asian organized crime and responsible for over 200 million dollars in losses through pig butchering scams and brand impersonation, is now shifting focus to emerging markets in Spanish, Vietnamese, and Indonesian regions while blocking US access to avoid detection. They're also distancing themselves from the sanctioned Funnull content delivery network by routing traffic through randomly generated domains and setting up clean front companies to keep their fraud operations running.

SAP has released 20 security patches in its April 2026 update, with the most critical being a SQL injection vulnerability in ABAP programs used by Business Planning and Consolidation software, scored at 9.9 out of 10 on the severity scale. The flaw allows low-privileged users to upload files with malicious SQL code that could lead to arbitrary code execution, potentially letting attackers extract sensitive financial data, alter reports, or corrupt database content. SAP fixed the issue by completely deactivating the vulnerable code, and while there's no evidence of active exploitation, users are urged to apply the patches immediately.

Basic-Fit, Europe's largest gym chain with over 5 million members, has disclosed a data breach affecting approximately 1 million members across the Netherlands, Spain, Germany, France, Belgium, and Luxembourg. The company says it detected and blocked unauthorized access within minutes, but hackers managed to download personal information including names, email addresses, physical addresses, phone numbers, dates of birth, and bank account details. Basic-Fit reports that no passwords or identification documents were compromised, and the company is not currently aware of the stolen data being leaked or misused.

Security researchers have discovered 108 malicious Chrome extensions that were designed to steal sensitive data from Google accounts and Telegram, affecting approximately 20,000 users. The extensions operated as a sophisticated data-theft campaign, targeting login credentials and other private information from unsuspecting Chrome browser users. This discovery highlights the ongoing security risks posed by browser extensions and the importance of vetting add-ons before installation.

Zscaler's 2026 VPN Risk Report reveals a fourfold increase in critical security risks based on analysis of 216 million security findings. The report highlights that artificial intelligence has dramatically shortened the window for human response to threats, effectively transforming remote access systems like VPNs into one of the fastest paths for attackers to breach networks. Security experts warn that VPNs, once considered secure gateways, are now enabling attackers to move through systems at speeds comparable to AI-driven threats.

Cybersecurity researchers have discovered that the Mirax Android malware has infected over 220,000 devices after being distributed through Meta advertising platforms. The malicious remote access trojan converts infected Android devices into SOCKS5 proxies, which can be used to route internet traffic and potentially hide cybercriminal activities. This case highlights growing concerns about malware distribution through legitimate advertising networks, making it easier for attackers to reach large numbers of potential victims.

Google has rolled out end-to-end encryption for Gmail to enterprise users on Android and iOS devices, expanding on last year's desktop implementation. The feature uses client-side encryption, allowing organizations to control their own encryption keys while users can now read and compose encrypted messages directly within the mobile Gmail app. It's currently available for Google Workspace Enterprise Plus customers with specific add-ons, and administrators need to enable it through the admin console before users can activate it by selecting additional encryption from the lock icon.