Sunday Edition — April 12, 2026

Week of April 6–12, 2026

Institutional
Aftershock

Since the last edition: CERT-EU and the European Commission connect the europa.eu cloud compromise to the TeamPCP Trivy pipeline intrusion — with ShinyHunters publishing the exfiltrated archive. In parallel, CISA’s KEV catalog added a rapid sequence of in-the-wild flaws (Chrome Dawn, FortiClient EMS, TrueConf, Ivanti EPMM) while Cisco Talos documents industrialized React2Shell credential harvesting.

REF · CERT-EU/EC-2026-04-02 · CISA KEV APR-2026 STACK · TALOS UAT-10608 · BOD 22-01

91.7 GB Compressed exfil (CERT-EU)
766 Hosts · Talos sample set
4 KEV adds · first week April
146.x Chrome stable patch train

Intel-01 / Breach follow-up · Union institutions

When the Scanner
Becomes the Vector

EUROPEAN COMMISSION · EUROPA.EU WEB HOSTING · CERT-EU COORDINATION · APRIL 2026

Development since March 22: What began as an industry-wide CI/CD panic is now a formal Union-institution case file. CERT-EU’s April 2 publication states the Commission notified it on March 25; the investigation ties initial access to the Trivy supply-chain compromise attributed to TeamPCP, with extortion publication following on March 28.

Incident narrative — high confidence chain

The affected AWS account supported the Commission’s public web presence. CERT-EU’s timeline places credential acquisition on 2026-03-19, CSOC alerts on March 24, public disclosure March 27, and leak-site publication March 28. Internal Commission systems are assessed as not breached via this path — the drama is cloud-hosted citizen-facing infrastructure and downstream Union clients of the hosting service.

~91.7
GB compressed exfil
Mar 28
ShinyHunters publication
2026-03-27
Commission press statement IP/26/748 — cyber-attack on Europa web platform cloud; internal systems not affected per early findings.
2026-04-02
CERT-EU blog confirms Trivy supply-chain vector, ShinyHunters leak, and regulatory frame Reg (EU, Euratom) 2023/2841.
Ongoing
Client notifications and dataset analysis — defenders should treat any Europa-pipeline secret from the exposure window as rotated.

Intel-02 / CISA KEV · Binding Operational Directive 22-01

April’s KEV
Sprint

KNOWN EXPLOITED VULNERABILITIES · FEDERAL DUE DATES · APRIL 1–8, 2026

CISA added four distinct catalog entries across the first eight days of April — each with evidence of in-the-wild use. Federal civilian agencies inherit hard remediation dates; everyone else should treat the catalog as priority intelligence, not background noise.

CVE-2026-5281 · Google Dawn UAF · Added 04/01 · Due 04/15 CVE-2026-35616 · FortiClient EMS · Added 04/06 · Due 04/09 CVE-2026-3502 · TrueConf client · Added 04/02 · Due 04/16 CVE-2026-1340 · Ivanti EPMM code injection · Added 04/08 · Due 04/11

Intel-03 / Endpoint management plane

EMS & MDM:
Pre-Auth Pressure

FORTINET FG-IR-26-099 · IVANTI EPMM CVE-2026-1340 · MANAGEMENT TIER ZERO

Two parallel nightmares for desktop operations teams: Fortinet confirms FortiClient EMS improper access control under active exploitation, while Ivanti’s Endpoint Manager Mobile stack faces a fresh KEV entry for unauthenticated RCE — both products sit where attackers want to be before they touch employee laptops.

CVE-2026-35616

FortiClient EMS — crafted requests, no session

Fortinet’s PSIRT advisory documents CWE-284 (improper access control) in EMS 7.4.5–7.4.6, observed exploited in the wild, with hotfix guidance ahead of 7.4.7.

CISA KEV · FCEB due 2026-04-09

CVE-2026-1340

Ivanti EPMM — code injection to RCE

Ivanti’s security advisory covers the mobile endpoint management plane; CISA’s April 8 listing underscores active abuse. Patch cadence should outrun executive email debates.

CISA KEV · FCEB due 2026-04-11

Intel-04 / Browser zero-day

Dawn Breaks
in Chromium

CVE-2026-5281 · WEBGPU / DAWN · CHROME STABLE 146.x

Google’s April 1 stable-channel update carries an in-the-wild flag for CVE-2026-5281 — a use-after-free in Dawn affecting Chromium-derived browsers. Same-day KEV listing means enterprise patch boards and desktop SOE teams move in lockstep.

CHROME_STABLE/146.0.7680.x
CVE: CVE-2026-5281 · SEVERITY: High (Chromium)
WEAKNESS: CWE-416 use-after-free
ATTACK MODEL: Renderer compromise → crafted HTML
CISA KEV DUE: 2026-04-15 (FCEB)

Treat this as a cross-ecosystem signal: Edge and other Chromium consumers inherit the same underlying graphics stack debt. Pair browser updates with extension policy review — renderer bugs often arrive chained with social engineering rather than silent drive-bys alone.

Intel-05 / Nation-state adjacent · Video stack

Operation TrueChaos:
Updates You Trust

CVE-2026-3502 · TRUECONF CLIENT · CHECK POINT RESEARCH

Check Point’s Operation TrueChaos reporting describes targeted intrusions against Southeast Asian government environments abusing TrueConf’s update validation path — the kind of flaw that turns a legitimate on-prem video server into a software-distribution weapon.

Attack premise

Compromise or control of the on-premises TrueConf server lets an actor push malicious update packages to every connected desktop client.

Vendor response

TrueConf shipped client fixes (Check Point cites Windows client 8.5.3); CISA’s KEV entry forces federal visibility on the same weakness.

Defender takeaway

Video conferencing infrastructure is now in the same patch-critical tier as VPN concentrators — monitor updater integrity and isolate management planes.

Intel-06 / Web apps · Cloud credentials

React2Shell at
Machine Speed

CVE-2025-55182 · CISCO TALOS UAT-10608 · NEXT.JS / RSC

Talos’s early-April disclosure outlines automated post-exploitation: scan vulnerable Next.js surfaces, drop ephemeral shell scripts from /tmp, and vacuum secrets into a centralized NEXUS Listener panel — a credential marketplace architecture applied to React Server Components flaws.

766
Hosts in observed sample
CVSS 10
React2Shell severity band
24h
Compaction window cited
RSC
Flight protocol attack surface

BleepingComputer’s parallel reporting reinforces the scale of automated harvesting. If you still have internet-facing RSC builds without the December 2025 patch train, you are not competing with human red teams — you are competing with cron jobs.

IOC STRIP — VERIFY ON HOST, NOT IN BROWSER DevTools

/tmp/.<rand>.sh + nohup SNORT 65554 (vendor) port 8080 exfil chunking AWS IMDS token paths

Intel-07 / AI gateway supply chain

LiteLLM:
PyPI Poisoning

LITELLM 1.82.7 / 1.82.8 · MARCH 24, 2026 · TEAMPCP

Follow-on to the Trivy wave: Attackers published trojanized LiteLLM builds that executed on import — placing stolen LLM routing secrets and cloud tokens one pip install away from production agents.

01

Distribution

Malicious versions appeared on PyPI; vendor post-mortem documents a bounded exposure window before quarantine.

02

Execution surface

Payloads targeted gateway code paths such as proxy_server.py and abused .pth persistence in later builds per public analysis.

03

Recovery

LiteLLM maintainers published clean rebuild guidance; any host that resolved the bad versions needs full secret rotation — not just package bump.

Intel-08 / IaC scanners · GitHub Actions

KICS Wave:
Tags as Payload Rails

CHECKMARX KICS-GITHUB-ACTION · MARCH 23, 2026 · WIZ RESEARCH

Wiz documents a tight exposure window where TeamPCP force-pushed malicious commits across KICS GitHub Action tags — the same impostor-commit pattern as Trivy, but aimed at infrastructure-as-code scanning pipelines that often hold Terraform/AWS secrets.

ACTION · Audit workflows for floating tags on checkmarx/kics-github-action; compare commit SHAs against known-good; assume any runner that executed during the window is a forensics artifact.

Intel-09 / Threat campaign cartography

Unit 42:
Weaponizing Protectors

PALO ALTO NETWORKS UNIT 42 · TEAMPCP MARCH 2026

Unit 42’s consolidated analysis frames TeamPCP as a cloud-native adversary pivoting across security tooling, AI gateways, and telecom SDKs — useful for leadership briefings that need a single authoritative narrative instead of vendor tweet threads.

StageTrivy / CI
StageKICS / VSX
StageLiteLLM / PyPI
OutcomeMass secret capture

Intel-10 / Disclosure · Retail / entertainment

Hasbro:
Materiality Meets IR

FORM 8-K · ITEM 8.01 · MARCH 28 DISCOVERY

Hasbro’s April 1 SEC filing describes unauthorized network access discovered March 28, containment including selective systems offline, and continuity plans to sustain orders — a textbook modern incident cadence under the SEC’s cybersecurity disclosure regime (filed as other events under Item 8.01).

“Upon discovery, the Company promptly activated its security incident response protocols, implemented containment measures, including proactively taking certain systems offline, and launched an investigation with the assistance of third-party cybersecurity professionals.”

SOURCE · HASBRO, INC. · CURRENT REPORT ON FORM 8-K

4
CISA KEV adds · Apr 1–8
766
Talos React2Shell sample hosts
2
Malicious LiteLLM PyPI builds
35
KICS tags reported hijacked

Intel-11 / Forward intelligence

The Week Ahead:
April 13–19

PATCH TUESDAY · KEV DEADLINES · VENDOR ADVISORY WINDOWS
What is Cyber Threat Intel Brief?