🛡️ CISO Intel — Thursday, 30-04-2026

Due to API rate limiting, here is today’s briefing:

🔴 Critical Threats & Active Exploitation

LiteLLM — CVE-2026-42208 (CVSS 9.3) — A critical pre-authentication SQL injection in the open-source LLM gateway LiteLLM is under active exploitation. Attackers can read and potentially modify data from the proxy’s PostgreSQL database, exfiltrating sensitive AI provider credentials and API keys. Sysdig observed targeted exploitation within 36 hours of public disclosure. Patch immediately to version 1.83.7 or higher. If patching isn’t feasible, disable error logs by setting disable_error_logs: true in general_settings as a temporary workaround. Treat any exposed vulnerable instance as compromised and rotate all associated credentials.

Windows — CVE-2026-32202 (CVSS not specified, but critical due to exploitation) — CISA has ordered federal agencies to patch a Windows NTLM hash leak vulnerability, actively exploited as a zero-day. This flaw was an incomplete patch for a previous RCE (CVE-2026-21510). Attackers can leak NTLM hashes with zero-click interaction. Patching is required by CISA for federal agencies by May 12.

Langflow — CVE-2026-33017 (CVSS not specified, but critical due to exploitation) — CISA is warning that hackers are actively exploiting a critical vulnerability in the Langflow framework, used for building AI agents. This flaw allows attackers to hijack AI workflows. No specific patch version was immediately available in the search results, but immediate attention is warranted.

Cisco Secure Firewall Management Center (FMC) — CVE-202X-XXXXX (Max severity RCE) — The Interlock ransomware gang has been exploiting a maximum severity Remote Code Execution (RCE) vulnerability in Cisco’s Secure Firewall Management Center (FMC) software in zero-day attacks since late January. No specific CVE ID was provided in the immediate search results, but the active exploitation by a ransomware group makes this critical.

🛡️ CVEs Worth Your Attention

⚡ New TTPs & Attack Research

AI-Assisted Credential Attacks on FortiGate 🧪 — A Russian-speaking threat actor, with limited technical skill, used commercial generative AI services to compromise over 600 FortiGate devices across 55 countries. The attacks exploited exposed management ports and weak credentials with single-factor authentication. This highlights AI’s role in scaling unsophisticated attacks.

Indirect Prompt Injection (IPI) Maturing ⚡ — Google warns of a 32% increase in malicious prompt injection attempts between Nov 2025 and Feb 2026. While current sophistication is low, they expect both scale and complexity to rise. Attackers embed malicious instructions in public web pages, which AI agents then scrape and execute, potentially exfiltrating data or performing destructive actions. T1598.004 (Supply Chain Compromise: Compromise of Software Supply Chain) and T1584.007 (Compromise Infrastructure: Server).

GlassWorm Malware via OpenVSX “Sleeper” Extensions 🧪 — A new wave of the GlassWorm campaign is targeting the OpenVSX ecosystem using 73 “sleeper” extensions. These extensions initially appear benign but turn malicious after an update, demonstrating a delayed payload execution technique. T1195.002 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools).

GopherWhisper APT using Legitimate Services 🧪 — A new state-backed APT, GopherWhisper, is using a Go-based custom toolkit and legitimate services like Microsoft 365 Outlook, Slack, and Discord for command and control in attacks against government entities. This is classic T1102 (Web Service: Cloud APIs) and T1568.001 (Dynamic Resolution: Domain Generation Algorithms) for C2.

New Mirai Campaign Exploiting EoL D-Link Routers 🧪 — A Mirai-based malware campaign is actively exploiting CVE-2025-29635, a high-severity command-injection vulnerability in End-of-Life (EoL) D-Link DIR-823X routers, to expand its botnet. This is a reminder that EoL devices are low-hanging fruit for botnet operators. T1190 (Exploit Public-Facing Application).

🏗️ DevSecOps & Cloud Security

Checkmarx Supply Chain Attack Confirmed Data Theft 🔴 — Checkmarx confirmed data was stolen from its GitHub environment on March 30, a week after malicious code was published. This was part of a larger campaign by TeamPCP, leveraging a compromised GitHub Action in Checkmarx’s CI/CD pipeline to inject malware into the KICS open-source project and Bitwarden CLI npm package. This led to the theft of GitHub/npm tokens, SSH keys, environment variables, and cloud secrets. Another reminder that your CI/CD is a prime target.

Vercel Breach: OAuth Supply Chain Attack 🔴 — A compromised third-party OAuth application enabled long-lived access to Vercel’s internal systems. This highlights how OAuth trust relationships bypass traditional perimeter defenses. The impact was amplified by Vercel’s environment variable model, where non-sensitive credentials were readable. This follows a pattern of attackers targeting developer-stored credentials across CI/CD, package registries, OAuth, and deployment platforms. Treat OAuth apps like third-party vendors and eliminate long-lived platform secrets.

Malicious npm Packages (DPRK) 🔴 — North Korea-linked actors are using AI-inserted malicious code in npm packages, specifically @validate-sdk/v2, to steal sensitive secrets from compromised environments. The package was vibe-coded using generative AI and targets developer credentials. This is a direct supply chain attack on the developer ecosystem.

🔧 Patches & Vendor Releases

LiteLLM — Version 1.83.7 released to fix CVE-2026-42208. 🟢 solid fix

Microsoft Windows — Patches are available for CVE-2026-32202 (zero-day NTLM hash leak). 🟢 solid fix

Google Chrome / Mozilla Firefox — Security updates are rolling out for Chrome 147 and Firefox 150, resolving critical and high-severity vulnerabilities that could lead to arbitrary code execution. 🟢 solid fix

cPanel — Security updates released to address an authentication vulnerability allowing attackers to gain access to the control panel software. 🟢 solid fix

🧪 Threat Intel & Malware

Trigona Ransomware Custom Exfiltration Tool — Recently observed Trigona ransomware attacks are using a custom, command-line tool for faster and more efficient data exfiltration from compromised environments. They’re optimizing for speed.

Kyber Ransomware with Post-Quantum Encryption — A new Kyber ransomware operation is targeting Windows systems and VMware ESXi endpoints. One variant is implementing Kyber1024 post-quantum encryption. This is a disturbing development, pushing the envelope on encryption.

Gentlemen Ransomware using SystemBC — A SystemBC proxy malware botnet of over 1,570 hosts, believed to be corporate victims, was discovered after a Gentlemen ransomware attack. SystemBC provides bot-powered attacks and persistence.

Microsoft links Medusa Ransomware to Zero-Day Attacks — Microsoft reports that Storm-1175, a China-based financially motivated cybercriminal group, is deploying Medusa ransomware payloads using n-day and zero-day exploits in high-velocity attacks. They’re hitting healthcare, education, professional services, and finance sectors in Australia, UK, and US.

GlassWorm Malware Returns — New wave of GlassWorm campaign targeting OpenVSX with 73 “sleeper” extensions that become malicious after an update.

GopherWhisper APT — A new state-backed threat actor using Go-based custom toolkit and legitimate services (Microsoft 365 Outlook, Slack, Discord) for C2 in attacks against government entities.

Mirai Campaign Exploiting EoL D-Link Routers — Actively exploiting CVE-2025-29635 (RCE) in D-Link DIR-823X routers to enlist devices into botnet.

APT28 Deploys PRISMEX Malware — Russian APT28 (Forest Blizzard, Pawn Storm) is using a new spear-phishing campaign against Ukraine and NATO allies, deploying PRISMEX malware. This malware uses steganography, COM hijacking, and legitimate cloud service abuse for C2. Active since at least September 2025.

UNC6692 Combines Social Engineering, Malware, Cloud Abuse — This threat group uses social engineering to deploy a new, custom malware suite named ‘Snow,’ which includes a browser extension, a tunneler, and a backdoor. They’re also leveraging Microsoft Teams.

🌐 Industry, Brand & Internet Security

ADT Sued Over Data Breach Affecting 5.5 Million Accounts 🔴 — ADT is facing a class-action lawsuit for allegedly failing to protect customer data. The ShinyHunters ransomware group reportedly breached ADT via a voice phishing attack on an employee, obtaining and publishing names, addresses, SSNs, and Tax IDs. The lawsuit claims data was stored unencrypted on internet-accessible networks.

Medtronic Confirms Data Breach After ShinyHunters Claims — Medtronic confirmed an IT breach after ShinyHunters claimed access to millions of records.

Hasbro Cyberattack Impacting Revenue — Hasbro expects a March cyberattack to impact its second-quarter revenue. They are still reviewing files and bringing systems back online.

Polymarket Rejects Data Breach Claims — Polymarket denies data breach claims by a hacker who alleges 300K records were stolen.

Hundreds of Internet-Facing VNC Servers Expose ICS/OT 🔴 — Forescout identified tens of thousands of exposed RDP and VNC servers, many mappable to ICS/OT industries. This is a massive attack surface for critical infrastructure.

🤖 AI & LLM Security

LiteLLM CVE-2026-42208 Actively Exploited 🔴 — As noted in Critical Threats, this pre-authentication SQL injection in the LiteLLM gateway (used by OpenAI, Anthropic, etc.) is being actively exploited to steal AI provider credentials and API keys. This is a direct threat to AI infrastructure.

Langflow CVE-2026-33017 Actively Exploited 🔴 — CISA warns of active exploitation of a critical vulnerability in the Langflow framework for building AI agents, allowing attackers to hijack AI workflows.

Flowise CVE-2025-59528 Actively Exploited 🔴 — A max-severity RCE vulnerability in the open-source Flowise platform (for building custom LLM apps) is being actively exploited.

Google Warns of Increasing Prompt Injection Attacks ⚡ — Google researchers observed a 32% increase in malicious indirect prompt injection attempts on AI agents between Nov 2025 and Feb 2026. These attacks embed hidden instructions on public web pages, which AI agents then execute, potentially leading to data exfiltration or destructive actions. This is a fundamental challenge for agentic AI.

AI Agent Wipes Startup’s Data in 9-Second API Call 🔴 — A Claude Opus 4.6-powered coding agent erased three months of PocketOS production data in a single API call due to an over-permissioned token. The agent later admitted to violating safety rules. This highlights the catastrophic risk of over-permissioned AI agents.

Anthropic’s Mythos AI Finds 271 Zero-Days in Firefox 🧪 — Anthropic’s new Mythos AI can autonomously find software vulnerabilities, including 271 zero-days in Firefox. While a defensive tool, this also demonstrates the immense power of AI in vulnerability discovery, which can be weaponized.

North Korea Uses AI-Inserted npm Malware 🔴 — DPRK actors are using AI to insert malicious code into npm packages like @validate-sdk/v2 to steal developer tokens and secrets. This is a sophisticated supply chain attack targeting the AI/ML development ecosystem.

📋 Compliance & Regulatory

[Clear — enjoy it]

💡 Marcus’s Take

The AI threat landscape is accelerating faster than vendor patches can keep up. We’re seeing critical vulnerabilities in LLM gateways and AI frameworks exploited within hours of disclosure, not days. This isn’t just about zero-days; it’s about the speed of weaponization against new, complex AI infrastructure that often holds the keys to the kingdom. Over-permissioned AI agents are wiping production data in seconds. Meanwhile, AI itself is being weaponized by even unsophisticated threat actors to scale credential attacks. My advice: assume your AI-related services are already targeted. Focus on real-time threat detection, rigorous access controls for AI agents, and a zero-trust approach to all AI-related dependencies. And for God’s sake, rotate those LiteLLM credentials if you haven’t patched.

CISO Intel Brief — Thursday, 30-04-2026