DJBSEC's CyberNews 2026-04-21

Today’s daily news covers the following categories: Data Breach Vulnerability Nation-State/APT Threat Intelligence Malware

Seiko USA Website Defaced Amid Claims of Customer Data Theft

Data Breach Seiko USA’s website was defaced by a hacker who also claimed to have stolen customer data from the company’s systems. The defacement served as a public signal of the breach, a tactic often used to pressure organizations and gain attention. While the full scope of the alleged data theft has not been confirmed, the incident raises concerns about potential exposure of customer information. Website defacements are often tied to deeper compromises within an organization’s infrastructure. Seiko is reportedly investigating the incident and working to secure its systems. Read More

Critical SGLang Vulnerability Enables Remote Code Execution

Vulnerability A critical vulnerability tracked as CVE-2026-5760 in SGLang has been disclosed with a CVSS score of 9.8, allowing remote code execution. Attackers can exploit the flaw to run arbitrary code on affected systems without authentication. Given SGLang’s use in AI and development environments, the impact could be widespread. Security researchers warn that exploitation could occur quickly due to public disclosure. Organizations should apply patches immediately and restrict exposure. Read More

KelpDAO Loses $290 Million in Lazarus-Linked Crypto Heist

Nation-State/APT KelpDAO has suffered a massive $290 million cryptocurrency theft linked to the North Korean Lazarus Group. The attack highlights ongoing efforts by state-sponsored actors to target digital assets for financial gain. Such heists are often used to fund operations and evade international sanctions. The scale of the breach underscores vulnerabilities in decentralized finance platforms. Organizations in the crypto space are urged to strengthen security controls and monitoring. Read More

Protobuf.js Library Vulnerability Enables RCE Risk

Vulnerability A vulnerability in the widely used protobuf.js library, with over 52 million downloads, could allow remote code execution. The flaw involves improper handling of schema data, which attackers can exploit to execute malicious code. Given the library’s widespread use, the risk extends across many applications. Developers may unknowingly introduce vulnerabilities into their projects. Immediate updates and dependency audits are recommended. Read More

GreyNoise Detects Traffic Surge Targeting Edge Device Vulnerabilities

Threat Intelligence GreyNoise has identified a surge in internet traffic targeting vulnerabilities in network edge devices. This activity is seen as an early warning sign of potential large-scale exploitation campaigns. Attackers often scan for weaknesses before launching coordinated attacks. The trend highlights the importance of monitoring external traffic patterns. Organizations should prioritize patching and securing exposed devices. Read More

Microsoft Issues Emergency Updates for Windows Server Issues

Vulnerability Microsoft has released emergency updates to address critical issues affecting Windows Server systems. The problems caused instability and potential security risks in enterprise environments. Out-of-band updates indicate the severity of the issue. Administrators are urged to deploy patches immediately to restore stability. Keeping systems updated remains essential for maintaining security. Read More

Claude Opus AI Model Can Turn Bugs Into Exploits

Threat Intelligence Researchers have demonstrated that the Claude Opus AI model can convert software bugs into working exploits at low cost. This capability significantly lowers the barrier for attackers to weaponize vulnerabilities. The finding highlights the dual-use nature of advanced AI systems. While beneficial for security research, it also increases risk if misused. Organizations must consider AI’s role in accelerating both defense and attack capabilities. Read More

Google Gemini AI Helps Block Malicious Ads

Threat Intelligence Google is using its Gemini AI platform to detect and block malicious advertisements across its network. The system analyzes ad content and behavior to identify threats in real time. This helps prevent users from being exposed to phishing and malware campaigns. AI-driven detection improves the speed and scale of security operations. However, attackers continue to adapt, requiring ongoing innovation. Read More

Hackers Exploit DVR Vulnerability to Spread Malware

Malware Attackers are exploiting CVE-2024-3721 in TBK DVR devices to infect systems with malware. These devices are often poorly secured, making them easy targets for compromise. Once infected, they can be used in botnets or for further attacks. The campaign highlights risks associated with IoT and surveillance systems. Organizations should secure devices and apply firmware updates promptly. Read More