April 4, 2026 - Red Dot Security

Header image for the Red Dot Weekly Cyber Security News https://reddotsecurity.news

Hello all,

I wish you a Happy Easter and Passover. I pray that it is a peaceful and enjoyable one. If you’ve been affected by the Iran conflict, I truly feel for you. There have been some serious cyber disruptions this past week with Iran damaging Amazon and Oracle datacenters in Bahrain and Dubai, and also threatening Dell, Intel, Nvidia, and more. Thankfully, so far, there have been no new publicized reports of massive successful Iranian cyber warfare.

Headline NEWS:

Cisco Patches critical defects in Integrated Management Controller (IMC) and Smart Software Manager On-Prem (SSM On-Prem), again. This is getting a bit old. It seems that Cisco is in the news about every week now with more patches. This newly found defect can allow for unauthenticated remote authentication and permission elevation and exists in 5000 Series Enterprise Network Compute Systems, Catalyst 8300 Series Edge uCPE, UCS C-Series M5 and M6 Rack Servers in standalone mode, UCS E-Series Servers M3, and UCS E-Series Servers M6. Thankfully, these vulnerabilities are not known to be under exploitation yet, so patch soon.
Google Chrome Zero-Day, under active exploitation. Google has released an updated version and customers are advised to update their browsers immediately to mitigate this flaw and 21 other vulnerabilities that were addressed. CISA has ordered all federal agencies to update Chrome by April 15. Expect that other chromium-based browsers will be updating soon as well. I highly recommend that you restart your browser at least once a week to keep up with the pace of updates that are being released.
Fortinet patched an actively exploited vulnerability in FortiClient EMS. This zero-day is a pre-authentication bypass using the API and can result in privilege escalation. If you use this, apply the hotfix quickly since exploitation has been ongoing since at least March 31. Didn’t we just patch this product a couple of week ago? Why can’t vendors get this right?
NASA launched the historic Artemis II mission and almost immediately Microsoft Outlook had problems onboard the spacecraft. I wonder if they put in a trouble ticket to their managed service provider? Do they charge by distance? That would have been an interesting service call if it required an onsite. “Hello Artemis, initiating docking procedures now. Please standby while Integris 3 attaches. Transferring technician now…” And I guess someone aboard needs remedial security training, because he exposed his PIN for all the world to see on a live video feed when he unlocked his handheld tablet.

In Ransomware, Malware, and Vulnerabilities News:

Anthropic accidentally leaked the source code for Claude Code. In a move that is already having some serious knock-on effects, Anthropic messed up big time when they published a JavaScript source map file to the npm registry, which was subsequently cloned thousands of times around GitHub so that it could be scrutinized by others. At least one vulnerability has already been discovered in how subcommands are processed, and dozens of fake “source code” files, that are actually malware, are now publicly available on the internet. If you’re planning to play with the source code, triple check your download or you might get a nasty surprise instead.

In Other News Events of Note and Interest:

Psychology suggests if you still write things down on paper instead of your phone you aren’t resisting progress. I am one of those seeming luddites that keeps a college ruled notebook on my desk and writes things down that I want to remember or need to do. This article about this topic was excellent validation that my method isn’t madness but instead its rooted squarely in science and makes me a better listener. As the article explains, the process of handwriting is slower, there is no way to record everything said, so you must actively listen, synthesize and summarize in order to capture what is relevant. It forces your brain to do “deep encoding, where you’re not just recording information but actively processing and reorganizing it as you write”, forcing thinking now rather than “record and think later”. So, grab a notebook and pull out a pen or pencil. It may revolutionize your world.

Musings

This Friday NASA launched a historic mission of once again sending astronauts out to the moon and back. It is amazing to think of the primitive technology that was used the first time this was done, 57 years ago when the Apollo 8 crew orbited the moon. Look where we are now. Despite the constant cyber-attacks, real-word chaos and violence, news such as the Artemis II mission remind us that humanity does have its sight set on the stars, and if we defenders continue to do our jobs well, then we can get there!

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Like this: