Isometric network nodes highlighting global cybersecurity exploits and espionage threats.

Daily Cybersecurity News - April 4, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

April 4, 2026 4:21 PM 5 min read

Apple Neutralizes Potent iOS Exploit

Executive Summary

Apple has released emergency security updates to patch the DarkSword exploit chain, a series of actively exploited vulnerabilities affecting iOS. The update, iOS 18.7.7, addresses six CVEs, including CVE-2025-31277 and CVE-2026-20700, which were used to compromise devices and steal sensitive data.

Vulnerability Details

Affected Product: Apple iOS versions 18.4 through 18.7
Identifier: Chain includes CVE-2025-31277, CVE-2025-43529, CVE-2026-20700, CVE-2025-14174, CVE-2025-43510, CVE-2025-43520
Exploitation Status: Actively Exploited

Risk & Impact

Triage:Urgent. The exploit chain has been publicly released and is being used by multiple threat actors.
Attack Vector: Remote. Users are compromised by visiting a legitimate but infected website (watering hole attack), requiring little to no user interaction.
Ease of Exploit:Easy. The full exploit kit has been published on GitHub, allowing less sophisticated actors to deploy it.

Action Plan

Immediate Action: Update all vulnerable devices to iOS 18.7.7 or higher.
Workaround: For high-risk users where immediate updates are not possible, enable Lockdown Mode, which has been confirmed to prevent the exploit from executing.
Detection: The exploit performs a "hit-and-run" data theft, exfiltrating data within minutes and cleaning up forensic traces, making detection difficult. Payloads include malware families such as GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER.

Relevant professional terms

Exploit Chain: A series of multiple, linked vulnerabilities that are used in sequence to compromise a system. An attacker uses the first exploit to gain an initial foothold, then uses subsequent exploits to escalate privileges and achieve their ultimate objective.
Watering Hole Attack: A cyberattack strategy where an attacker compromises a website that is frequently visited by a specific target group, rather than attacking the targets directly. When the targets visit the compromised site, they are infected with malware.

Source: Dark Reading

Fortinet Rushes Patch For Exploited Zero-Day

Critical

Executive Summary

A critical improper access control vulnerability, identified as CVE-2026-35616, in Fortinet's FortiClient Endpoint Management Server (EMS) is being actively exploited in the wild. Fortinet has confirmed the exploitation and released emergency hotfixes to address the issue.

Vulnerability Details

Affected Product: FortiClientEMS versions 7.4.5 and 7.4.6.
Identifier: CVE-2026-35616.
CVSS Score: 9.1 (Critical).
Exploitation Status: Actively Exploited.

Risk & Impact

Triage: Immediate patching is required due to active "in-the-wild" exploitation.
Attack Vector: An unauthenticated, remote attacker can send crafted requests to bypass API authentication and authorization, leading to unauthorized code or command execution.
Ease of Exploit: The attack does not require authentication, suggesting a low complexity for exploitation.

Action Plan

Immediate Action: Apply the emergency hotfixes provided by Fortinet for affected versions. A full fix will be included in the upcoming FortiClientEMS 7.4.7 release.
Workaround: No specific workarounds have been mentioned; applying the hotfix is the recommended course of action.
Detection: Organizations should monitor for unusual or crafted requests to the FortiClient EMS API endpoints.

Relevant professional terms

Zero-Day Vulnerability: A security flaw in software, hardware, or firmware that is known to the vendor but does not have a patch in place to fix it. Attackers can exploit these vulnerabilities before developers have a chance to release a fix.
Improper Access Control: A type of security vulnerability where restrictions on what an authenticated user is allowed to do are not properly enforced. This can allow attackers to access unauthorized functionality or data.

Source: Help Net Security

Cisco Breached Via Supply Chain Attack

Executive Summary

Attackers breached Cisco's internal development environment by leveraging credentials stolen from the Trivy vulnerability scanner supply chain attack. The incident resulted in the theft of source code and other sensitive data, highlighting significant risks in the software development lifecycle.

Attack Overview

Attack Path: Threat actors used credentials stolen via a malicious GitHub Action plugin associated with the compromised Trivy vulnerability scanner to access Cisco's build and development environment.
Attacker:TeamPCP, with some reports also linking extortion claims to ShinyHunters.

Impact Assessment

Data Stolen: Source code from over 300 GitHub repositories, including for AI products, as well as multiple AWS keys. Some stolen repositories allegedly belong to corporate and U.S. government agency customers.

Strategic Takeaway

This breach underscores the critical danger of supply chain attacks, where compromising a single widely-used development tool can cascade into numerous high-profile corporate intrusions.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets a trusted third-party vendor or software that is part of an organization's supply chain to gain access to the ultimate target's network.
CI/CD Pipeline: Continuous Integration/Continuous Deployment is a software development practice where code changes are automatically built, tested, and deployed, which, if compromised, can be a vector for attacks.

Source: WIRED

AI Vendor Breach Exposes Industry Secrets

Executive Summary

AI recruitment startup Mercor confirmed a security breach originating from a third-party software component, impacting major AI labs. The incident has led Meta to pause its work with the vendor and raises concerns over the potential exposure of proprietary AI training data and methodologies.

Attack Overview

Attack Path: The breach was a supply chain attack originating from malicious code injected into the popular open-source LiteLLM Python library, which was designed to harvest credentials.
Attacker: The Lapsus$ extortion group claimed responsibility for the data theft, while the initial LiteLLM compromise is attributed to a group known as TeamPCP.

Impact Assessment

Data Stolen: Lapsus$ claims to have exfiltrated 4 TB of data, including source code, databases, candidate records, and video interviews.

Strategic Takeaway

This incident highlights the critical risk of software supply chain vulnerabilities, where a compromise in a single, widely-used component can have cascading effects across thousands of organizations.

Relevant professional terms

Supply Chain Attack: A cyberattack that targets a trusted third-party vendor or software that provides services or components to other organizations.
Credential Harvesting: The process of illicitly collecting login credentials, such as usernames, passwords, and API keys, often through malicious code or phishing.

Source: WIRED

Chinese APT Renews European Espionage

Executive Summary

The China-aligned threat actor TA416 has resumed targeting European government and diplomatic organizations since mid-2025, following a two-year hiatus. The group's primary goal is intelligence collection, employing phishing campaigns to deploy the PlugX remote access trojan.

Key TTPs

Initial Access: Phishing emails containing links that abuse Microsoft's OAuth protocol to redirect users to malicious sites, bypassing conventional email defenses.
Execution: The PlugX malware payload is loaded using DLL side-loading, where a legitimate, signed executable is tricked into loading a malicious DLL.
Defense Evasion: The group regularly alters its infection chain, using techniques like abusing Cloudflare Turnstile pages and C# project files to avoid detection.

Campaign Analysis

TA416's return to targeting European entities signifies a renewed intelligence-gathering focus on EU and NATO-affiliated organizations, likely influenced by geopolitical events. The actor's evolving TTPs demonstrate a persistent effort to bypass modern security controls for long-term espionage.

Targeting & Infrastructure

Target Profile: European government bodies and diplomatic missions, particularly those associated with the EU and NATO.
Infrastructure: Malicious archives are hosted on legitimate services like Microsoft Azure Blob Storage and Google Drive, as well as on actor-controlled domains.

Relevant Terms

PlugX: A sophisticated Remote Access Trojan (RAT) that allows an attacker to take unauthorized remote control over a victim's computer, enabling data theft, keystroke logging, and other malicious activities.
OAuth Phishing: An attack that tricks users into granting a malicious application permissions to access their data via a legitimate service's authorization process, bypassing the need to steal a password.

Source: The Hacker News