The author of the BlueHammer exploit, which was released earlier this month and addressed in the last Patch Tuesday, continues to be annoyed with the responses from the Microsoft security research and vulnerability response team, and has released another Windows zero-day attack against Windows Defender.
The RedSun exploit targets a logic and timing error in Windows Defender, convincing it to install the target file in the system, instead of quarantining the file and protecting the system. Not, generally, what you would hope would happen.
Since the RedSun attack requires local access in the first place, it seems unlikely Microsoft will release an out-of-sequence patch for it, however with public code available, we can probably expect to see malware leveraging it to establish higher permissions on an infected system.
Releasing exploits out of spite feels like a return to the late 1990s, and I almost don’t hate it.
University Domains Hijacked
Reported in Bleeping Computer, a group tracked as “Hazy Hawk” has been hijacking unmaintained DNS records of universities and government institutions to serve ad click spam.
The attack seems simple and doesn’t even require compromising the actual institution, using dangling DNS “CNAME” records. A “CNAME” entry in DNS acts essentially as an alias, pointing one domain name at another, which can be used to provide content from an official domain that is hosted on a cloud service where the IP address of the service might change.
A DNS “A” (or “AAAA” if you speak IPv6) record points a hostname – like “foo.example.com” – to an IP address – like “1.1.1.1”. A “CNAME” record points a hostname to another hostname, like “foo.some_cloud_host.com”. Scanning “high value” domains (like Ivy League universities) for “CNAME” records which point to expired domains (or domains on cloud hosted providers which no longer exist) lets anyone able to register that domain (or create an account with the proper naming scheme on the cloud host) to post any content they wish, and still appear to be the original name.
At least 30 educational institutions have been impacted, along with several government agencies including the CDC.
Linux Drops Old Network Drivers
A recent patch set to the Linux kernel schedules 18 legacy network drivers for removal, citing an increased maintenance burden due to bugs found by AI and fuzzing tools. This seems to be in line with other recent Linux kernel efforts to deprecate particularly old devices, migrating single-core systems to the multi-core scheduler and flagging i486 support for removal.
All of the devices slated to go are from 2002 or earlier, and are all ISA or PCMCIA Ethernet devices. Ultimately, it probably makes sense to remove problematic drivers for devices which have been out of production for 25 years or more, but it’s personally a bit painful to see the 3COM 3c59x driver going away, which was the first Ethernet card I had in a Linux system.
Bitwarden CLI Client Compromised
Following the theme the past month of supply chain hacks, the latest high-profile casualty is the Bitwarden command line client. There are indications this is the same group responsible for several of the previous weeks of supply chain attacks on NPM, GitHub, and VS Code extensions.
Bitwarden is a password manager, with the option of self-hosting, similar to LastPass or OnePassword. The trojan version of the Bitwarden CLI contains malicious code to spread the supply-chain botnet, by stealing authentication tokens , SSH keys, and AI service tokens. Whenever GitHub tokens are found, the script will also attempt to modify the GitHub Actions –automatic scripts run for code validation or package building — to embed itself in any packaged repository it has write access to.
In many ways, what could have been an astoundingly serious incident – the compromise of the password manager vault – turned into a case of the dog catching the car. (If a dog chasing cars caught one, would he even know what to do with it?) A surprising turn of events from code designed to steal credentials.
Mythos “Hacked”
Anthropic has admitted that there has been “unauthorized access” to the new Mythos model. The company has made copious announcements about the danger their new model brings for security and exploit development, humble-bragging that it is too dangerous for public use. Meanwhile it appears that enthusiasts on an AI-focused Discord were able to social engineer access from a third-party Anthropic contractor.
It is difficult to ascertain what risk Mythos will actually represent once it becomes generally available. Like any new bug discovery tool, the challenge is not only in finding a possible bug, but in validating that it can be triggered. When the concept of fuzzing — spamming programs with invalid or nearly-valid input — was popularized, thousands of bugs were found rapidly. OSS-Fuzz found almost 30,000 bugs in 360 projects, per this paper. That’s truly an intimidating quantity of issues to fix, but hardly heralded as apocalyptic.
The impact of new AI on bug finding will have to be assessed in retrospect, but it’s not exactly comforting that the same company making claims of world-changing danger in their models were still themselves victims to a social engineering campaign that exposed the model for weeks.
Nextcloud Ends Bug Bounty
Another week, another project ending their bug bounty program. This week it’s Nextcloud, a self-hostable file hosting platform – basically an open source Dropbox analogue.
Like other projects, Dropbox puts the blame on a flood of low-quality but time consuming AI generated bug reports. As of April 22, 2026, Nextcloud will no longer offer rewards for bug reports, regardless of the severity of the bug.
iOS Patches Notifications
Apple has released iOS 26.4.2 which fixes a notification issue used recently to expose Signal messages.
A recent court case demonstrated that it was possible to extract the content of Signal messages on an iPhone, even if the app and notifications had been deleted. This is not a flaw in Signal itself, or even limited to iOS devices: when Signal is configured to show the content of a message in a notification, it’s no longer under the control of the Signal app itself. For devices which have the option to show notifications on the lock screen, the content of messages is also no longer protected by user authentication!
Investigators were able to extract the notifications database from the phone, and from there, extract previous Signal notifications containing message content thought to have been deleted.
$2.5 M Stolen from Sri Lanka
Wrapping up, Newswire reports that Sri Lankan officials have confirmed that $2.5 million in funds were stolen from their Ministry of Finance by redirecting a foreign debt repayment. Few details are available, but such attacks typically take advantage of a compromised email account, using existing email threads to continue a conversation and change payment details.
Similar attacks happen on a smaller scale, often targeting real estate agencies and small banks – institutions likely to have little to no information security processes but who handle large lump sums of money. Having it occur on a national level is certainly a little unusual.
