Isometric network nodes showing critical software flaws and widespread data breaches.

Daily Cybersecurity News - April 2, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

April 2, 2026 5:31 PM 6 min read

ShareFile Flaws Chained For Remote Attacks

Executive Summary

Two vulnerabilities in Progress ShareFile's Storage Zones Controller, CVE-2026-2699 and CVE-2026-2701, can be chained to allow an unauthenticated attacker to achieve remote code execution (RCE). These flaws have been patched by the vendor, and users are urged to update immediately.

Vulnerability Details

Affected Product: Progress ShareFile Storage Zones Controller (SZC) branch 5.x before version 5.12.4.
Identifier: CVE-2026-2699 (Auth Bypass), CVE-2026-2701 (RCE).
Exploitation Status: No active exploitation has been observed in the wild as of early April 2026.

Risk & Impact

Triage: Immediate patching is required due to the risk of unauthenticated remote code execution.
Attack Vector: An attacker first exploits the authentication bypass (CVE-2026-2699) to gain access to the ShareFile admin interface. From there, the attacker can exploit the second flaw (CVE-2026-2701) by abusing file upload functionality to place a malicious webshell in the application's webroot, achieving RCE.
Ease of Exploit: The attack is considered pre-authentication, meaning an attacker does not need prior access or credentials, which increases the likelihood of exploitation now that the details are public.

Action Plan

Immediate Action: Upgrade all instances of Progress ShareFile Storage Zone Controller to the patched version 5.12.4 or later.

Relevant professional terms

Remote Code Execution (RCE): An attack that allows a malicious actor to execute commands of their choice on a remote machine over a network, potentially leading to full system compromise.
Vulnerability Chaining: The practice of linking multiple, often less severe, security vulnerabilities together to create a more impactful exploit than any of the individual flaws would allow on their own.

Source: BleepingComputer

F5 Flaw Allows Total Server Takeover

Critical

Executive Summary

A critical vulnerability, identified as CVE-2025-53521, in F5 BIG-IP Access Policy Manager (APM) is being actively exploited. Initially classified as a Denial-of-Service issue, it has been upgraded to a Remote Code Execution (RCE) vulnerability that allows unauthenticated attackers to gain complete control of an affected system.

Vulnerability Details

Affected Product: F5 BIG-IP APM, versions 15.1.0-15.1.10, 16.1.0-16.1.6, and 17.1.0-17.1.2.
Identifier: CVE-2025-53521
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching and compromise assessment are required.
Attack Vector: An unauthenticated, remote attacker can send specially crafted traffic to a virtual server with an APM access policy configured. This data plane issue does not require any user interaction or valid credentials to exploit.
Ease of Exploit: The vulnerability is easy to exploit, as it allows attackers to run commands on company hardware globally without authentication.

Action Plan

Immediate Action: Upgrade to a fixed version, such as 15.1.10.8, 16.1.6.1, or 17.1.3 or later.
Workaround: If immediate patching is not possible, restrict access to APM-enabled virtual servers from untrusted networks and disable any unused access profiles.
Detection: F5 has provided Indicators of Compromise (IOCs). Administrators should review system logs, disk, and terminal history for signs of malicious activity, such as unusual file changes.

Relevant professional terms

Remote Code Execution (RCE): A class of software vulnerability that allows a malicious actor to execute arbitrary commands or code on a target machine or in a target process over a network.
BIG-IP APM (Access Policy Manager): A component of F5's product suite that provides secure, centralized access control to applications, networks, and APIs. It is widely used in large enterprises to manage user authentication and authorization.

Source: BleepingComputer

Drift Protocol Drained In Massive Heist

Executive Summary

The Solana-based DeFi platform Drift Protocol suspended deposits and withdrawals after a sophisticated attack drained approximately $285 million in various cryptocurrencies. The incident, which occurred on April 1, 2026, is the largest DeFi hack of the year and the second-largest in Solana's history.

Attack Overview

Attack Path: The attacker compromised an administrator's private keys, which provided privileged access to alter protocol controls. They exploited Solana's "durable nonces" feature to execute pre-signed transactions, taking over the Security Council's administrative powers.
Attacker: On-chain behavior and laundering methods are consistent with techniques used by state-sponsored North Korean (DPRK) threat actors.

Impact Assessment

Data Stolen: Approximately $285 million in assets, including JLP tokens, USDC, SOL, wrapped Bitcoin, and other cryptocurrencies.
Operational Impact: Drift suspended all platform deposits and withdrawals to contain the breach. The protocol's Total Value Locked (TVL) collapsed by nearly 50%.

Detection & Hunting

IOCs: Attacker-controlled wallet address: HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES.

Strategic Takeaway

This incident highlights the significant risks of centralized administrative controls and private key management, even within a decentralized finance framework.

Relevant professional terms

DeFi (Decentralized Finance): A blockchain-based form of finance that does not rely on central financial intermediaries like banks, instead utilizing smart contracts on blockchains.
Cryptocurrency Heist: A cybercrime where threat actors exploit vulnerabilities in digital currency systems, such as exchanges or wallets, to steal cryptocurrency assets.

Source: TechCrunch

Android Malware Infects Millions

Executive Summary

The NoVoice malware campaign infected at least 2.3 million Android devices through more than 50 seemingly harmless apps on the Google Play Store. The malware exploits older, known vulnerabilities to gain root access, enabling attackers to take full control of the device and steal sensitive data.

Key TTPs

Initial Access: Distributed via trojanized applications on the official Google Play Store, including cleaners, games, and gallery tools.
Execution: Exploits a range of 22 known vulnerabilities to gain a root shell, allowing the malware to disable the device's core security protections.
Defense Evasion: Uses steganography to hide encrypted payloads within PNG image files and performs checks to detect emulators, debuggers, and VPNs.

Campaign Analysis

This campaign highlights the effectiveness of using official app stores for wide-scale distribution and the significant risk posed by unpatched vulnerabilities in older Android devices. The malware's persistence, which can survive a factory reset on older systems, demonstrates a high level of sophistication.

Targeting & Infrastructure

Target Profile: Primarily users of older or unpatched Android devices, particularly those running Android 7 or lower.
Infrastructure: Utilized over 50 applications on the Google Play Store and a command-and-control (C2) server to deliver device-specific exploits.

Relevant Terms

Root Access: The highest level of administrative permissions on an Android device, allowing an application to bypass system restrictions and access all files and functions.
Steganography: The practice of concealing a file, message, image, or video within another file, message, image, or video. In this case, hiding a malicious payload inside a PNG image.

Source: BleepingComputer

Leaked Toolkit Bypasses iPhone Defenses

Executive Summary

Coruna is a sophisticated iPhone hacking toolkit containing five exploit chains capable of bypassing device defenses to silently install malicious payloads. Initially used by surveillance vendors, it has proliferated to espionage and financially motivated threat actors.

Key Features

Comprehensive Exploits: Contains five full exploit chains and 23 unique exploits targeting iOS 13 up to 17.2.1.
Device Fingerprinting: Profiles a target device to select the most effective WebKit exploit for remote code execution.
Mitigation Bypasses: Uses non-public techniques to bypass security protections like Pointer Authentication Code (PAC).

Use Case (The "So What?")

For Red Teams, Coruna's techniques provide a blueprint for emulating advanced persistent threats (APTs) targeting mobile devices. Blue Teams must analyze these multi-stage attacks, which blend browser exploitation with privilege escalation, to develop more robust detection and defense-in-depth strategies for mobile endpoints.

Availability

The toolkit is not publicly available but has been leaked and is circulating among various threat actors.

Relevant Terms

Exploit Chain: A sequence of multiple, distinct exploits used in succession to compromise a system's security.
Watering Hole Attack: A strategy where an attacker compromises a website likely to be visited by a specific target group, rather than attacking the targets directly.

Source: Schneier on Security