Weekly Threat Briefing — 2026-03-31 to 2026-04-06
16 findings4 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 532 CVEs5,614 IOCs
First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
- High severityMultiple Kados R10 GreenBee SQL Injection Vulnerabilities (CVSS 8.2) (opens the source in a new tab)Section VulnerabilitiesSource: CVE
- High severitySection VulnerabilitiesSource: CVE
- High severitySection MalwareSource: abuse.ch
- High severitySection MalwareSource: abuse.ch
- High severitySection VulnerabilitiesSource: CVE
Executive summary · as of 07:00 UTC
The situation
This briefing covers the period from March 31 to April 6, 2026, revealing a significant surge in vulnerability disclosures and sustained botnet activity. CISA added two critical vulnerabilities to the Known Exploited Vulnerabilities catalog, including a zero-integrity update mechanism in TrueConf Client (CVE-2026-3502) and a use-after-free in Google Dawn (CVE-2026-5281) affecting Chromium-based browsers. The NVD disclosed 29 additional high-severity vulnerabilities spanning multiple product categories, with particular concern around legacy SQL injection flaws in Kados R10 GreenBee and a critical remote code execution vulnerability in Pegasus CMS (CVE-2019-25687).
The threat landscape shows continued Mozi botnet dominance, with 44 of 50 malware distribution URLs attributed to this P2P botnet variant, primarily targeting MIPS and ARM-based IoT devices. Additionally, Mirai variants remain active with distribution infrastructure hosting multiple architecture-specific payloads. Organizations should prioritize patching the two KEV entries immediately, assess exposure to the 29 NVD-disclosed vulnerabilities (particularly the CRITICAL-rated Pegasus CMS RCE), and implement robust IoT device segmentation to mitigate botnet infection risks.
No honeypot telemetry, enrichment alerts, or infrastructure seizure events were reported during this period, suggesting either a data collection gap or unusually quiet operational activity. Security teams should focus remediation efforts on the software update integrity issues highlighted in the TrueConf KEV entry, as these represent fundamental trust model failures that enable supply chain compromise scenarios.
Browse the full briefing
16 findings · 4 sections- 3 critical
- 11 high
- 2 medium
Critical CISA Known Exploited Vulnerabilities
Two vulnerabilities added to CISA KEV catalog requiring immediate remediation
- Critical severityCVE-2026-3502: TrueConf Client Update Integrity Bypass (opens the source in a new tab)
TrueConf Client contains a critical flaw allowing attackers controlling the update delivery path to substitute malicious payloads without integrity verification, enabling arbitrary code execution during software updates. This represents a supply chain attack vector.
- Critical severityCVE-2026-5281: Google Dawn Use-After-Free Enabling Remote Code Execution (opens the source in a new tab)
Google Dawn graphics API contains a use-after-free vulnerability exploitable via crafted HTML pages by attackers who have compromised the renderer process. Affects multiple Chromium-based browsers including Chrome and Edge.
High-Severity NVD Disclosures
29 high and critical severity vulnerabilities disclosed, dominated by SQL injection and buffer overflow flaws
- Critical severityCVE-2019-25687: Pegasus CMS Remote Code Execution (CVSS 9.8) (opens the source in a new tab)
Pegasus CMS 1.0 extra_fields.php plugin allows unauthenticated attackers to execute arbitrary PHP code via unsafe eval functionality in POST requests to submit.php. This is the highest severity disclosure in the current dataset.
- High severityCVE-2026-5604: Tenda CH22 Buffer Overflow (CVSS 8.8) (opens the source in a new tab)
Tenda CH22 1.0.0.1 formCertLocalPrecreate function contains a stack-based buffer overflow via the 'standard' parameter, enabling remote code execution. IoT device vulnerability requiring immediate patching.
- High severityCVE-2026-4272: Honeywell Handheld Scanners Missing Authentication (CVSS 8.1) (opens the source in a new tab)
Multiple Honeywell handheld scanner models lack authentication for critical functions, enabling authentication abuse attacks. Affects C1, D1, and A1/B1 base models across multiple firmware versions.
Source: CVE - High severityMultiple Kados R10 GreenBee SQL Injection Vulnerabilities (CVSS 8.2) (opens the source in a new tab)
Thirteen SQL injection vulnerabilities disclosed in Kados R10 GreenBee affecting parameters including filter_user_mail, id_project, sort_direction, id_to_delete, language_tag, user2reset, id_to_modify, mng_profile_id, and menu_lev1. Several allow unauthenticated exploitation.
- High severityCVE-2019-25685: phpBB Arbitrary File Upload via Phar Deserialization (CVSS 8.8) (opens the source in a new tab)
phpBB contains an authenticated arbitrary file upload vulnerability exploiting plupload functionality and phar:// stream wrapper to execute malicious serialized PHP objects, leading to arbitrary code execution.
Mozi and Mirai Botnet Distribution Activity
50 malware distribution URLs detected, predominantly Mozi botnet payloads targeting IoT devices
- High severityMozi Botnet Dominates IoT Malware Distribution (opens the source in a new tab)
44 URLs distributing Mozi botnet payloads detected across MIPS and ARM architectures. Distribution infrastructure spans Chinese, European, and African IP spaces with dynamic high-port binding (35000-60000 range). Mozi continues leveraging P2P architecture for resilient C2 operations.
- High severityMirai Variant Multi-Architecture Distribution Campaign (opens the source in a new tab)
Infrastructure at 176.65.139.67 hosting comprehensive Mirai distribution campaign with architecture-specific binaries (x86, ARM, MIPS, PowerPC, m68k, SuperH). Includes bins.sh dropper script suggesting automated compromise and lateral movement capabilities.
- Medium severityAmadey Dropper Delivering Secondary Payloads (opens the source in a new tab)
URL at 85.239.147.6 distributing Windows executable (KVJUXwl.exe) dropped by Amadey malware loader. Indicates active Windows-targeted infection chain separate from IoT botnet activity.
- Medium severityAdditional Mirai Distribution Infrastructure (opens the source in a new tab)
Three additional URLs at 142.248.80.144 and 45.194.92.39 distributing Mirai variants and shell scripts for x86 architectures. Infrastructure demonstrates continued investment in multi-vector IoT compromise operations.
Legacy Application Vulnerabilities
Multiple 2019-era vulnerabilities disclosed in legacy web applications and desktop software
- High severityWeb Application SQL Injection Cluster (8+ Products) (opens the source in a new tab)
SQL injection vulnerabilities disclosed in OpenDocMan, Advance Gift Shop Pro Script, C4G Basic Laboratory Information System, Ask Expert Script, eDirectory, CMSsite, PilusCart, qdPM, News Website Script, and SuiteCRM. Common pattern of unauthenticated exploitation via GET/POST parameters.
Source: CVE - High severityDesktop Application Buffer Overflow Vulnerabilities (opens the source in a new tab)
Structured exception handler buffer overflow vulnerabilities in Xlight FTP Server 3.9.1, RealTerm Serial Terminal 2.0.0.70, and River Past Video Cleaner 7.6.3 allow local privilege escalation via crafted input strings.
Source: CVE - High severityCVE-2019-25673: UniSharp Laravel File Manager Arbitrary Upload (CVSS 8.8) (opens the source in a new tab)
UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 allow authenticated attackers to upload arbitrary PHP files via multipart form data, leading to remote code execution. Affects Laravel-based web applications.
- High severityCVE-2019-25671: VA MAX Command Injection (CVSS 8.8) (opens the source in a new tab)
VA MAX 8.3.4 contains authenticated remote code execution via shell metacharacter injection in the mtu_eth0 parameter of changeip.php endpoint. Network device vulnerability enabling full system compromise.
- High severityCVE-2019-25686: Core FTP Denial of Service (CVSS 7.5) (opens the source in a new tab)
Core FTP 2.0 build 653 vulnerable to denial of service via malformed PBSZ command with oversized buffer (>211 bytes), causing service crash. Unauthenticated exploitation possible.
Source: CVE
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.