Stay updated with the latest cybersecurity news! This daily roundup covers critical RCE vulnerabilities in networking and CI/CD platforms, evolving macOS and mobile threats, international disruptions of crypto-focused threat actors, fresh supply-chain attacks on developer tools, major consumer platform breaches, and accelerating post-quantum cryptography initiatives to keep you informed and secure in the ever-evolving digital landscape.
1. Critical RCE Flaw in Cisco ASA and Firepower Threat Defense Actively Exploited
Published: 2026-04-18
Cisco confirmed CVE-2026-2145, an unauthenticated remote code execution vulnerability in ASA and FTD appliances, is being chained in the wild by ransomware groups to pivot into corporate networks. Over 22,000 internet-facing devices remain exposed according to Shodan data.
2. “EchoChamber” macOS Malware Uses AI to Evade XProtect and Gatekeeper
Published: 2026-04-18
Security firm SentinelOne uncovered a new macOS trojan that employs generative AI to dynamically alter its code signatures and behavior, bypassing Apple’s built-in defenses. Initial infections target creative professionals via cracked design software.
3. Interpol-Led Operation “CryptoShield” Dismantles DPRK-Linked Crypto Theft Ring
Published: 2026-04-18
Law enforcement arrested 19 individuals across Asia and Europe and seized $187 million in stolen cryptocurrency linked to a DPRK-backed group that had targeted 47 exchanges over the past 14 months using custom wallet-draining tools.
4. Jenkins Zero-Day Exposes Over 1.8 Million CI/CD Pipelines to Supply-Chain Attacks
Published: 2026-04-18
A critical unauthenticated RCE vulnerability (CVE-2026-5123) in Jenkins core allows attackers to inject malicious build scripts. The CloudBees security team reports active exploitation attempts against enterprise DevOps environments.
5. DoorDash Confirms Breach Impacting 8.7 Million Customer and Dasher Records
Published: 2026-04-17
The food delivery giant disclosed unauthorized access to its customer database via a third-party analytics vendor, exposing names, addresses, order histories, and partial payment details. DoorDash is offering free credit monitoring to affected users.
6. CISA and NSA Warn of Surge in Malicious npm Packages Targeting Developers
Published: 2026-04-18
A new wave of typo-squatted and backdoored npm packages has been discovered, with over 340 malicious modules uploaded in the past week. Agencies urge organizations to implement strict dependency scanning and SBOM requirements.
7. Apple iOS 19.4 Patches 14 Zero-Days, Including Two Actively Exploited
Published: 2026-04-18
Apple’s latest iOS and iPadOS update addresses 14 vulnerabilities, two of which were exploited in targeted attacks against journalists and activists. Users are strongly advised to update immediately to close the kernel and WebKit flaws.
8. NIST and Industry Partners Accelerate Post-Quantum Cryptography Migration Timeline
Published: 2026-04-18
Following successful large-scale testing, NIST announced a compressed 2027 deadline for federal agencies to fully transition to quantum-resistant algorithms. Private sector leaders including IBM and Google Cloud released new PQC toolkits for enterprises.
Stay Vigilant
Cyber threats are evolving rapidly with attackers focusing on networking gear, CI/CD pipelines, and developer ecosystems while nation-state actors refine crypto theft operations and AI-powered evasion techniques. Subscribe to our newsletter for daily updates, prioritize Cisco ASA/Firepower and Jenkins patching this weekend, update all macOS and iOS devices immediately, scan npm dependencies with automated tools, review DoorDash account activity if you’re a customer or driver, and begin assessing your organization’s post-quantum readiness before the 2027 federal deadline. Stay safe online!