Stay updated with the latest cybersecurity news! This daily roundup covers cascading supply-chain attacks hitting popular developer tools and libraries, critical zero-days in mobile device management and endpoint security platforms, actively exploited browser flaws, and the latest in defensive AI advancements to keep you informed and secure in the ever-evolving digital landscape.
1. Axios npm Supply-Chain Attack Injects Backdoor into Millions of JavaScript Projects
Published: 2026-04-12
North Korea-linked actors hijacked an Axios maintainer account to publish malicious versions 1.14.1 and 0.30.4 containing an undeclared dependency that deploys a cross-platform backdoor. The package is used by over 10 million projects worldwide.
2. Ivanti EPMM Zero-Days Allow Unauthenticated RCE on Mobile Device Management Servers
Published: 2026-04-12
Two chained zero-days in Ivanti Endpoint Manager Mobile (EPMM) enable remote code execution on internet-facing MDM servers. Security researchers warn the flaws are already being exploited to pivot into corporate networks.
3. Fortinet Emergency Patch for FortiClient EMS Zero-Day Under Active Exploitation
Published: 2026-04-12
Fortinet pushed an out-of-band fix for CVE-2026-35616, a critical improper access control flaw in FortiClient Enterprise Management Server being actively chained in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
4. Google Chrome Zero-Day CVE-2026-5281 in Dawn WebGPU Actively Exploited
Published: 2026-04-12
Google released Chrome 135.0.7049.XX to fix a use-after-free vulnerability in the Dawn WebGPU implementation already being weaponized in targeted attacks. CISA added the flaw to its KEV catalog with a tight remediation deadline.
5. Trivy Scanner and GitHub Actions Supply-Chain Compromises Hit Dev Pipelines
Published: 2026-04-11
Multiple trusted automation tools including Trivy were compromised via GitHub Actions workflows, allowing attackers to inject malicious code during CI/CD builds. Organizations using these tools are urged to rotate secrets immediately.
6. LiteLLM PyPI Package Compromised in AI Tool Supply-Chain Attack
Published: 2026-04-12
The popular LiteLLM library on PyPI was backdoored through a maintainer account compromise, targeting AI developers working with large language models. The attack installs a credential-stealing payload on affected systems.
7. Anthropic Restricts Access to Mythos AI Cybersecurity Model Over Offensive Capabilities
Published: 2026-04-11
Anthropic limited availability of its new Claude Mythos Preview model — capable of discovering thousands of previously unknown vulnerabilities — to select defensive partners only, citing risks of misuse by adversaries.
8. GIGABYTE Control Center Path Traversal Flaw Enables Remote Code Execution
Published: 2026-04-12
Researchers disclosed CVE-2026-4415 in GIGABYTE Control Center, allowing unauthenticated attackers to write arbitrary files and achieve full system compromise. Affected hardware users should disable the pairing feature pending the patch.
Stay Vigilant
Cyber threats are evolving rapidly with supply-chain attacks now targeting the very tools developers trust most and zero-days being weaponized within hours. Subscribe to our newsletter for daily updates, immediately audit and update all npm/PyPI dependencies for Axios and LiteLLM, patch Ivanti EPMM, FortiClient EMS, and Chrome across your fleet without delay, restrict use of unvetted AI coding assistants, rotate all CI/CD secrets, and monitor CISA KEV for the latest additions. Stay safe online!