DFIRLab
All Briefings
weeklyApril 28, 2026 — May 4, 2026Published 07:00 UTC

Weekly Threat Briefing — 2026-04-28 to 2026-05-04

23 findings6 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
470 CVEs8,072 IOCs

First seen in this period: CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 19
Browse all 23 findings

Executive summary · as of 07:00 UTC

The situation

This week's threat intelligence briefing for April 28 - May 4, 2026 reveals a significant surge in critical authentication and injection vulnerabilities across enterprise platforms and WordPress plugins. CISA added four high-impact vulnerabilities to the KEV catalog, including a critical authentication bypass in WebPros cPanel/WHM (CVE-2026-41940) and a Linux kernel privilege escalation flaw (CVE-2026-31431). The NVD disclosed 30 additional high-severity vulnerabilities, with WordPress plugins representing a substantial attack surface through SQL injection, stored XSS, and remote code execution flaws.

Browse the full briefing

23 findings · 6 sections
Findings by severity
  • 5 critical
  • 14 high
  • 3 medium
  • 1 info
Vulnerabilities3 critical · 1 high

Critical Known Exploited Vulnerabilities

CISA added four critical vulnerabilities to the KEV catalog, requiring immediate remediation for federal agencies and recommended for all organizations.

Vulnerabilities1 critical · 6 high

High-Severity WordPress Plugin Vulnerabilities

Multiple critical vulnerabilities discovered in widely-deployed WordPress plugins, including SQL injection, remote code execution, and authentication bypass flaws affecting thousands of sites.

Vulnerabilities1 critical · 4 high

Enterprise Platform and IoT Device Vulnerabilities

Critical vulnerabilities identified in enterprise management systems, network devices, and IoT hardware enabling remote code execution and command injection.

Malware3 high

ClearFake Malware Distribution Infrastructure

Extensive ClearFake malware campaign utilizing rapid-cycling subdomain infrastructure across multiple domains to distribute fake browser updates and malware payloads.

Malware3 medium

IoT Botnet Activity: Mozi and Mirai Distribution

Continued IoT-targeted malware distribution focusing on MIPS and ARM architectures through compromised embedded devices and routers.

DFIR Lab1 info

Email Analysis Tools Comparison

Technical analysis comparing PhishTool and DFIR Platform for email threat investigation workflows.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.