Stay updated with the latest cybersecurity news! This daily roundup covers critical zero-days in remote endpoint management platforms and popular JavaScript libraries, aggressive ransomware campaigns targeting chemical manufacturing and public transit systems, fresh supply-chain compromises in developer tools and cloud CI/CD environments, international alerts on APT activity, and emerging threats to Microsoft Defender and npm ecosystems to keep you informed and secure in the ever-evolving digital landscape.
1. Ivanti EPMM Critical Code Injection Vulnerability Actively Exploited
Published: 2026-04-30
Ivanti confirmed active in-the-wild exploitation of CVE-2026-1340, an unauthenticated remote code execution flaw in Endpoint Manager Mobile (EPMM). Attackers can achieve full server control, enabling data theft, web-shell persistence, and lateral movement. Organizations with internet-facing instances are urged to patch immediately.
2. Axios npm Supply-Chain Attack Deploys Cross-Platform Backdoor
Published: 2026-04-30
Palo Alto Networks Unit 42 reported that malicious versions of the widely used Axios HTTP client (1.14.1 and 0.30.4) were published after a maintainer account compromise. The packages install a backdoor via an undeclared dependency, targeting Windows, macOS, and Linux environments across millions of downstream projects.
3. Qilin Ransomware Claims Major Breach at Dow Inc. Chemical Giant
Published: 2026-04-30
The Qilin ransomware group has listed chemical manufacturing leader Dow Inc. on its leak site, alleging theft of sensitive operational data and intellectual property. The attack highlights the rising risk to industrial and chemical sector OT environments.
4. Three Microsoft Defender Zero-Days Under Active Exploitation
Published: 2026-04-30
Huntress Labs and researchers have observed active exploitation of BlueHammer, RedSun, and UnDefend flaws in Microsoft Defender. These privilege-escalation and DoS vulnerabilities allow attackers to gain SYSTEM-level access; two remain unpatched, forcing organizations to isolate affected endpoints.
5. CISA Adds Four Critical Flaws to Known Exploited Vulnerabilities Catalog
Published: 2026-04-29
CISA added SimpleHelp RMM flaws, Samsung MagicINFO vulnerabilities, and D-Link router issues to its KEV list, citing ransomware and botnet activity. Federal agencies must mitigate by May 8, with broader guidance for critical infrastructure operators.
6. Amtrak Discloses Breach of Up to 9.4 Million Customer Records
Published: 2026-04-29
Amtrak confirmed unauthorized access via a compromised CRM/Salesforce integration, exposing names, travel details, and contact information for millions of passengers. The rail operator is notifying affected customers and offering credit monitoring services.
7. Vercel Confirms Security Incident After Threat Actor Claims Data Theft
Published: 2026-04-30
Vercel disclosed a breach involving internal systems after a threat actor advertised stolen data for sale. The incident potentially impacts CI/CD pipelines and customer deployment configurations for thousands of web and frontend applications.
8. China-Linked Storm-1175 Accelerates Medusa Ransomware via Zero-Days
Published: 2026-04-30
Microsoft and security researchers linked Storm-1175 to rapid Medusa ransomware deployments using a mix of zero-days and recently disclosed vulnerabilities. The group achieves initial access and encryption within 24 hours in multiple sectors.
Stay Vigilant
Cyber threats are evolving rapidly with endpoint management tools, open-source JavaScript libraries, and Microsoft Defender now prime targets for both ransomware operators and nation-state actors, while supply-chain attacks continue to undermine developer trust and CI/CD pipelines. Subscribe to our newsletter for daily updates, patch Ivanti EPMM and review all internet-facing RMM tools immediately, audit npm dependencies and lock Axios versions across all projects, isolate and monitor Microsoft Defender endpoints for BlueHammer-style activity, enforce strict KEV remediation timelines per CISA guidance, notify and support affected users from the Amtrak and Vercel incidents, segment chemical and transit OT networks to limit Qilin-style extortion, and hunt for Storm-1175 indicators in high-value environments. Stay safe online!