Weekly Threat Briefing — 2026-04-14 to 2026-04-20
27 findings5 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 505 CVEs10,175 IOCs
First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection Tools & TechniquesSource: CVE
- High severitySection VulnerabilitiesSource: KEV
- High severitySection VulnerabilitiesSource: KEV
- High severitySection MalwareSource: abuse.ch
Executive summary · as of 07:00 UTC
The situation
During the period of April 14-20, 2026, the threat landscape demonstrated significant malicious activity across multiple vectors. The most critical concern is the widespread distribution of SmartLoader malware through compromised GitHub repositories, with over 30 malicious ZIP files hosted on legitimate infrastructure. CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog, including critical flaws in Apache ActiveMQ and Microsoft SharePoint Server that enable code injection and spoofing attacks.
The National Vulnerability Database published 29 new CVEs during this period, with seven rated CRITICAL severity. Notable vulnerabilities include multiple expression injection bypasses in Thymeleaf (CVE-2026-40477, CVE-2026-40478), NoSQL injection flaws in FastGPT authentication (CVE-2026-40351), and command injection in radare2 (CVE-2026-40527). The abuse.ch data reveals ongoing Mozi botnet activity targeting IoT devices, alongside a sophisticated ClearFake campaign using subdomain infrastructure for malware delivery.
Organizations should prioritize patching the KEV-listed vulnerabilities immediately, implement GitHub security scanning for malicious repository content, and enhance monitoring for SmartLoader indicators. The continued presence of legacy Microsoft Office vulnerabilities (CVE-2009-0238) in the KEV catalog underscores persistent exploitation of older attack vectors.
Browse the full briefing
27 findings · 5 sections- 7 critical
- 14 high
- 2 medium
- 4 info
- Vulnerabilities8 findingsCritical Vulnerabilities Requiring Immediate Action6 critical · 2 high
- Malware4 findingsSmartLoader GitHub Distribution Campaign2 high · 2 medium
- Tools & Techniques5 findingsExploitation Techniques and Attack Vectors1 critical · 4 high
- DFIR Lab4 findingsDFIR Platform Development Updates4 info
- Vulnerabilities6 findingsAdditional High-Severity Vulnerabilities6 high
Critical Vulnerabilities Requiring Immediate Action
CISA KEV additions and critical-severity CVEs pose immediate exploitation risk
- Critical severityApache ActiveMQ Code Injection (CVE-2026-34197) (opens the source in a new tab)
Apache ActiveMQ contains an improper input validation vulnerability enabling code injection. Now listed in CISA KEV catalog, indicating active exploitation.
- Critical severityThymeleaf Expression Injection Bypass (CVE-2026-40477, CVE-2026-40478) (opens the source in a new tab)
Dual critical vulnerabilities in Thymeleaf template engine (versions ≤3.1.3) bypass expression injection protections, enabling arbitrary code execution in Java web applications.
- Critical severityFastGPT Authentication Bypass via NoSQL Injection (CVE-2026-40351) (opens the source in a new tab)
Unauthenticated attackers can bypass FastGPT login by injecting MongoDB query operators in password field due to lack of runtime validation (CVSS 9.8).
- Critical severityHot Chocolate GraphQL Parser DoS (CVE-2026-40324) (opens the source in a new tab)
Hot Chocolate GraphQL server lacks recursion depth limits, allowing attackers to crash services with deeply nested documents (CVSS 9.1).
Source: CVE - Critical severitySAIL Image Library Multiple Memory Corruption Flaws (opens the source in a new tab)
Three critical vulnerabilities in SAIL library: TGA RLE decoder bounds check bypass (CVE-2026-40494), PSD buffer allocation mismatch (CVE-2026-40493), and XWD byte-swap confusion (CVE-2026-40492). All rated CVSS 9.8.
Source: CVE - Critical severityChurchCRM Database Restore Arbitrary File Write (CVE-2026-40484) (opens the source in a new tab)
ChurchCRM backup restore extracts archive contents without file extension validation, enabling remote code execution via web-accessible PHP uploads (CVSS 9.1).
- High severityMicrosoft SharePoint Server Spoofing Vulnerability (CVE-2026-32201) (opens the source in a new tab)
Improper input validation in Microsoft SharePoint Server allows unauthorized network-based spoofing attacks. Added to CISA KEV catalog.
- High severityLegacy Microsoft Office Excel RCE (CVE-2009-0238) (opens the source in a new tab)
17-year-old Microsoft Office Excel vulnerability still being actively exploited via malformed objects in crafted files. Persistence in KEV catalog indicates ongoing campaigns.
SmartLoader GitHub Distribution Campaign
Massive SmartLoader malware distribution operation abusing GitHub infrastructure with 30+ malicious repositories
- High severitySmartLoader Campaign via Compromised GitHub Repositories (opens the source in a new tab)
Over 30 malicious ZIP files identified on GitHub/raw.githubusercontent.com domains hosting SmartLoader malware. Attackers abuse legitimate GitHub infrastructure with themed repository names (Arduino Projects, Cursor IDE Setup, OpenAI SDK, Venus Blood, etc.) to evade detection.
- High severityClearFake Subdomain Infrastructure Campaign (opens the source in a new tab)
Multiple ClearFake malware distribution domains identified using subdomain patterns (green-leaf1, flow-control6, signal-box5, deep-soil3, high-stem4, wild-root2, pure-seed5) on firs-tachycardia.in.net and artichf1atly.in.net infrastructure.
- Medium severityMozi Botnet IoT Device Targeting (opens the source in a new tab)
Active Mozi botnet infrastructure identified targeting IoT devices with multiple IP addresses serving ELF binaries for MIPS and ARM architectures. Indicators include Asian-Pacific IP ranges (China, Indonesia, South Africa).
- Medium severityMirai Variant Distribution Activity (opens the source in a new tab)
Multiple IPs distributing Mirai botnet variants via HTTP, targeting ARM and MIPS IoT devices. Overlaps with Mozi infrastructure suggesting coordinated botnet operations.
Exploitation Techniques and Attack Vectors
High-severity vulnerabilities enabling privilege escalation, command injection, and authentication bypass
- Critical severityNovumOS Ring 3 to Kernel Privilege Escalation (CVE-2026-40317, CVE-2026-40572) (opens the source in a new tab)
NovumOS contains two critical syscall vulnerabilities: Syscall 12 (JumpToUser) allows arbitrary kernel address execution, and Syscall 15 (MemoryMapRange) enables mapping of kernel memory regions without validation.
- High severityradare2 DWARF Command Injection (CVE-2026-40527) (opens the source in a new tab)
Crafted ELF binaries can embed malicious r2 commands in DWARF parameter names, executing when analyzed with radare2's afsv/afsvj commands. Enables local privilege escalation via reverse engineering tools.
- High severityEmissary OS Command Injection (CVE-2026-35582) (opens the source in a new tab)
Emissary workflow engine vulnerable to command injection via unsanitized temporary file paths interpolated into shell commands. Affects distributed processing workflows.
Source: CVE - High severityWordPress CMP Plugin Arbitrary File Upload (CVE-2026-6518) (opens the source in a new tab)
CMP Coming Soon plugin allows authenticated users with minimal privileges to upload arbitrary files and achieve RCE via cmp_theme_update_install AJAX action due to insufficient permission checks.
- High severityMultiple Privilege Escalation Flaws in Web Applications (opens the source in a new tab)
Several web applications affected by privilege escalation: Movary user management bypass (CVE-2026-40350), FastGPT password change NoSQL injection (CVE-2026-40352), wger gym config permission bypass (CVE-2026-40474), and Postiz file upload validation bypass (CVE-2026-40487).
DFIR Platform Development Updates
New security research and tooling capabilities published for incident response operations
- Info severityDFIR Investigation Methodology: Alert to Report Workflow (opens the source in a new tab)
Comprehensive guide documenting standardized investigation steps for digital forensics and incident response operations, from initial alert triage through final reporting.
Source: Blog - Info severityExternal Attack Surface Scanner API Released (opens the source in a new tab)
New API endpoint enabling automated mapping of domain exposure and attack surface enumeration through single API calls for security reconnaissance.
Source: Blog - Info severityMulti-Source IOC Enrichment Alternative to VirusTotal (opens the source in a new tab)
Cost-effective IOC enrichment solution for security teams providing multi-source threat intelligence aggregation at reduced pricing compared to commercial alternatives.
Source: Blog - Info severitySplunk Integration: Custom Search Commands for IOC Enrichment (opens the source in a new tab)
Technical implementation guide for building Splunk custom search commands integrating DFIR Platform API for real-time IOC enrichment within SPL queries. Includes Python code, packaging instructions, and example queries.
Source: Blog
Additional High-Severity Vulnerabilities
Secondary tier vulnerabilities requiring attention and remediation planning
- High severityPath Traversal and CSRF Vulnerabilities in Multiple Applications (opens the source in a new tab)
ChurchCRM family record deletion via GET without CSRF protection (CVE-2026-40581), Gramps Web API Zip Slip vulnerability (CVE-2026-40258), KodExplorer path traversal (CVE-2026-6568), and Movary SSRF via Jellyfin endpoint (CVE-2026-40348).
- High severitySecureDrop Client RCE via Compromised Server (CVE-2026-35465) (opens the source in a new tab)
SecureDrop Client vulnerable to code execution if server is compromised due to improper filename sanitization. Affects journalist workstation security model.
- High severityDNN (DotNetNuke) SVG Upload XSS (CVE-2026-40321) (opens the source in a new tab)
DNN CMS allows authenticated users to upload malicious SVG files containing scripts, affecting both authenticated and unauthenticated users when accessed.
- High severityBuffer Overflow Vulnerabilities in H3C Routers (opens the source in a new tab)
Multiple H3C Magic router models (B1, B0) affected by remote buffer overflow vulnerabilities in SetAPWifiorLedInfoById and Edit_BasicSSID functions (CVE-2026-6563, CVE-2026-6560). CVSS 8.8.
- High severitySQL Injection and Hard-Coded Credential Issues (opens the source in a new tab)
Multiple applications affected: SQL injection in muucmf search function (CVE-2026-6562), hard-coded credentials in LightPicture API (CVE-2026-6574), and improper authentication in KodExplorer fileGet endpoint (CVE-2026-6569).
- High severityWordPress Easy Appointments Information Disclosure (CVE-2026-2262) (opens the source in a new tab)
Easy Appointments plugin exposes sensitive appointment data via unauthenticated REST API endpoint due to misconfigured permission callback (CVSS 7.5).
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.