Stay updated with the latest cybersecurity news! This daily roundup covers actively exploited endpoint management zero-days, devastating supply-chain ransomware in healthcare, nation-state compromises of popular developer libraries, critical SQL injection flaws in enterprise planning tools, and high-profile data exposures at gaming and insurance platforms to keep you informed and secure in the ever-evolving digital landscape.
1. Fortinet Confirms Active Exploitation of Critical FortiClient EMS Flaw
Published: 2026-04-19
Fortinet disclosed CVE-2026-35616, an improper access control vulnerability in FortiClient Enterprise Management Server that allows unauthenticated attackers to bypass API protections and execute arbitrary commands. Exploitation has been observed in the wild since late March, targeting endpoint management infrastructure at scale.
2. Ivanti EPMM Zero-Day Enables Unauthenticated Remote Code Execution
Published: 2026-04-19
Ivanti patched CVE-2026-1340 in Endpoint Manager Mobile, a critical code injection flaw granting unauthenticated RCE and full server control. Threat actors are already leveraging it for persistence and lateral movement in mobile device management environments.
3. ShinyHunters Breaches Rockstar Games via Third-Party Analytics Firm Anodot
Published: 2026-04-19
The notorious data extortion group claimed responsibility for compromising Rockstar Games through a breach at Anodot, exposing internal analytics data and potentially game development assets. The incident marks the latest in ShinyHunters’ string of high-profile third-party supply-chain attacks.
4. ChipSoft Ransomware Attack Paralyzes Dutch Hospital Patient Portals
Published: 2026-04-19
A ransomware incident at ChipSoft, provider of the dominant patient record platform used by nearly all Dutch hospitals, forced the temporary shutdown of portals and mobile services. Over a dozen facilities reverted to manual processes while emergency care continued uninterrupted.
5. North Korean Actors Compromise Axios npm Package via Social Engineering
Published: 2026-04-18
UNC1069 (DPRK-linked) used fake recruiter outreach and malicious video conferencing tools to hijack the Axios maintainer account, publishing trojanized versions of the popular HTTP library. Millions of downstream JavaScript projects are at risk of credential theft and backdoor installation.
6. SAP Discloses CVSS 9.9 SQL Injection in BW and BPC Platforms
Published: 2026-04-19
A severe vulnerability (CVE-2026-27681) in SAP Business Warehouse and Business Planning and Consolidation allows low-privileged users to execute arbitrary SQL commands via file upload features. The flaw threatens core financial planning and reporting systems worldwide.
7. OneDigital Data Breach Exposes 28,414 Records via Salesforce Misconfiguration
Published: 2026-04-19
Insurance and benefits provider OneDigital confirmed unauthorized access to a Salesforce-hosted CRM instance, leaking personal and health-related data of nearly 28,500 individuals. The breach highlights persistent risks in third-party cloud customer management platforms.
8. Booking.com Admits Hackers Accessed Customer Data in Recent Incident
Published: 2026-04-19
The travel giant disclosed that attackers gained access to select customer records, including booking details and contact information. No payment data was compromised, but the company is notifying affected users and enhancing monitoring.
Stay Vigilant
Cyber threats are evolving rapidly with endpoint management servers and supply-chain dependencies emerging as prime targets for immediate exploitation and ransomware disruption, while nation-state actors refine social-engineering tactics against open-source libraries. Subscribe to our newsletter for daily updates, apply Fortinet FortiClient EMS and Ivanti EPMM patches as emergency priority items, audit all SAP BW/BPC instances for the new SQL injection flaw, enforce strict npm dependency scanning and SBOM validation, review third-party analytics and CRM integrations for misconfigurations, and monitor for ShinyHunters-style extortion claims if you rely on external data platforms. Stay safe online!