Duna's Kiat
All editions
News

CyberNews: 01/04/2026 Edition

Today’s roundup

  • Google fixes fourth Chrome zero-day exploited in attacks in 2026
  • TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks
  • Cisco source code stolen in Trivy-linked dev environment breach
  • Attackers hijack Axios npm account to spread RAT malware
  • GIGABYTE Control Center vulnerable to arbitrary file write flaw
  • Claude AI finds Vim, Emacs RCE bugs that trigger on file open
  • Iran Threatens to Start Attacking Major US Tech Firms on April 1
  • Apple Will Push Out Rare ‘Backported’ Patches to Protect iOS 18 Users From DarkSword Hacking Tool
  • New criminal service plans to monetize data stolen by ransomware gangs
  • Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms

    • Summary

    Google released emergency Chrome updates for CVE-2026-5281, a use-after-free in Dawn, Chromium's implementation of the WebGPU standard, saying an exploit exists in the wild. It is the fourth actively exploited Chrome zero-day patched since the start of the year. Fixed versions are 146.0.7680.177/178 for Windows and macOS and 146.0.7680.177 for Linux.

    A high-severity zero-day in the TrueConf client video conferencing software, CVE-2026-3502 (CVSS 7.8), was exploited in a campaign dubbed TrueChaos targeting government entities in Southeast Asia. The flaw is a missing integrity check when fetching application update code, which lets an attacker distribute a tampered update.

    Cisco suffered a breach after threat actors used credentials stolen in the Trivy supply chain attack, via a malicious GitHub Action, to access its internal build and development environment. More than 300 GitHub repositories were reportedly cloned, including source code for AI products and some belonging to corporate customers, and multiple AWS keys were stolen and misused. Cisco isolated and reimaged affected systems and is rotating credentials.

    Attackers compromised the npm account of an Axios maintainer and published malicious versions 1.14.1 and 0.30.4 of the library, which has over 100 million weekly downloads. The rogue releases inject a dependency, plain-crypto-js, that deploys a cross-platform remote access trojan on macOS, Windows and Linux; anyone who installed them should assume their system is compromised.

    GIGABYTE Control Center 25.07.21.01 and earlier is vulnerable to CVE-2026-4415 (CVSS v4.0 9.2) when its pairing feature is enabled: unauthenticated remote attackers can write arbitrary files anywhere on the system, leading to code execution or privilege escalation. Users should upgrade to version 25.12.10.01.

    A researcher at Calif used the Claude assistant to find remote code execution flaws in Vim and GNU Emacs that trigger when a crafted file is opened. The Vim bug, in modeline handling with a sandbox bypass, affects version 9.2.0271 and earlier and is fixed in 9.2.0272; it has no CVE ID.

    Iran's Islamic Revolutionary Guard Corps said it would begin attacking more than a dozen American companies across the Middle East, including Apple, Google, IBM, Intel, Microsoft, Tesla and Boeing, after 8 pm Tehran time on April 1, accusing them of enabling US military targeting. The IRGC urged the firms' employees to evacuate.

    Apple said it would push patches to iOS 18 users, including those whose phones can run iOS 26, to protect them against DarkSword, a hacking technique that can silently take over some iOS 18 iPhones when they visit an infected website. iOS 26 users were already protected.

    Flare described Leak Bazaar, a new service advertised on criminal forums that aims to turn large datasets stolen in ransomware attacks into structured, searchable intelligence that can be sold or used for extortion, which a Flare researcher called an e-discovery service for stolen data.

    Anthropic confirmed that internal code for its Claude Code AI coding assistant was inadvertently released through an npm packaging error, saying no sensitive customer data or credentials were involved or exposed and calling it a release packaging issue caused by human error.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-5281 High
    CVE-2026-3502 High
    CVE-2026-4415 Critical