Daily Cybersecurity News - April 7, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a critical, actively exploited vulnerability in Fortinet’s FortiClient Enterprise Management Server (EMS). Tracked as CVE-2026-35616, this improper access control flaw allows unauthenticated attackers to bypass authentication and achieve remote code execution.

A new attack method named GPUBreach uses Rowhammer-induced bit flips in GPU memory to escalate privileges, potentially leading to a full system compromise. This technique corrupts GPU page tables to gain control over GPU memory, which can then be chained with NVIDIA driver bugs to achieve CPU-level privilege escalation and gain root access.

A security researcher has publicly released proof-of-concept exploit code for an unpatched Windows zero-day vulnerability dubbed "BlueHammer". This local privilege escalation (LPE) flaw allows a local attacker to elevate their access to the highest privilege level (NT AUTHORITY\SYSTEM), but Microsoft has not yet assigned a CVE or released a patch.

The Drift Protocol, a Solana-based exchange, lost over $280 million in a sophisticated attack on April 1, 2026. The theft was the result of a meticulous six-month social engineering campaign attributed to a North Korean state-affiliated group.

This incident highlights the critical failure of operational security and insider threat detection, proving that even without direct code exploits, sophisticated social engineering can bypass multi-signature security controls.

The UK National Cyber Security Centre (NCSC), part of GCHQ, has issued a new advisory detailing how the Russian state-sponsored group APT28 is exploiting vulnerable routers to enable DNS hijacking. The actors overwrite DHCP/DNS settings on compromised devices to redirect users’ internet traffic through malicious servers under their control, allowing adversary-in-the-middle attacks and credential harvesting.

Data Stolen: Login credentials, passwords, and access tokens from personal web and email services. Operational Impact: Creates a persistent platform for espionage and further malicious operations while concealing the origin of attacks.

This latest campaign highlights how even routine edge devices can be turned into infrastructure for large-scale credential theft when left unpatched or poorly managed. Organizations must treat router security as a high priority.

Microsoft reports that Storm-1175, a China-based, financially motivated threat actor, is exploiting n-day and zero-day vulnerabilities to deploy Medusa ransomware. The group conducts high-velocity attacks, often moving from initial access to ransomware deployment within 24 hours.

Storm-1175 demonstrates a high operational tempo by weaponizing flaws between disclosure and widespread patching. Their use of zero-day exploits, sometimes a week before public disclosure, marks a significant evolution in their capability to impact enterprise environments rapidly.

Google DeepMind researchers have categorized a new class of vulnerabilities called "AI Agent Traps," where malicious web content is designed to manipulate, deceive, and exploit autonomous AI agents. These attacks weaponize the information environment against the agent itself.

This research reveals a fundamental flaw in how AI agents interact with untrusted web content. The core vulnerability is that agents often cannot distinguish between system instructions and data from the web, creating a new attack surface. Security leaders must now account for adversarial attacks targeting the AI's perception and reasoning, not just traditional network and software exploits.