ZYMP IT Security — April 21, 2026
Vercel Identifies Security Incident Involving Unauthorized Access to Internal Systems
SECURITY INCIDENT
Vercel has disclosed a security incident involving unauthorized access to certain internal systems. The attack originated from a compromise of Context.ai, a third-party AI tool used by a Vercel employee, which allowed attackers to take over the employee’s Google Workspace account and gain access to Vercel environments and non-sensitive environment variables.
The company has identified a limited subset of customers whose non-sensitive environment variables that decrypt to plaintext were compromised. Vercel is actively investigating with Mandiant, other cybersecurity firms, industry peers, and law enforcement. No evidence exists that sensitive environment variables were accessed or that npm packages published by Vercel were compromised.
US Agencies Warn of Increased Cyberattacks Targeting Critical Infrastructure
CYBERSECURITY
A joint advisory from US agencies indicates that cyber activity targeting critical infrastructure has escalated amid the Middle East conflict. Hackers are exploiting internet-exposed operational technology devices across energy, water, and local government systems. These devices, connected for remote monitoring, provide attackers with opportunities to manipulate industrial control interfaces and extract sensitive system files.
The advisory notes that operational disruption and financial loss have already occurred. Organizations are urged to assume they could be targeted and to review systems for vulnerabilities, particularly where industrial devices are directly exposed to the internet. Basic mitigations include removing public-facing access, implementing multi-factor authentication, and monitoring for unusual network activity.
CISA Adds Eight Exploited Vulnerabilities to Known Exploited Vulnerabilities Catalog
VULNERABILITY
The US Cybersecurity and Infrastructure Security Agency has added eight new vulnerabilities to its Known Exploited Vulnerabilities catalog, including three flaws impacting Cisco Catalyst SD-WAN Manager, citing evidence of active exploitation. The vulnerabilities span multiple vendors including PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance, Synacor Zimbra Collaboration Suite, and Cisco products.
Federal Civilian Executive Branch agencies have been directed to address the three Cisco vulnerabilities by April 23, 2026, and the remaining vulnerabilities by May 4, 2026. Some vulnerabilities, such as CVE-2023-27351 in PaperCut, have been previously attributed to ransomware campaigns including Lace Tempest, which delivered Cl0p and LockBit ransomware families.
Attackers Abuse Apple Account Notifications to Deliver Phishing Campaigns
PHISHING
Scammers have discovered a method to abuse Apple’s email notification system to deliver phishing messages that appear legitimate because they originate from Apple’s servers. Attackers create Apple IDs and insert phishing text into the account’s personal information fields, splitting the message across first and last name fields. They then modify the account’s shipping information to trigger Apple’s security notification system.
The phishing emails pass SPF, DKIM, and DMARC authentication checks as they come from Apple infrastructure. One campaign embedded fake iPhone purchase notifications with a callback number, attempting to trick victims into calling scammers who then convince them to install remote access software or provide financial information. Previous similar campaigns have abused iCloud Calendar invites.
Microsoft’s April Patch Tuesday Addresses Two Zero-Day Vulnerabilities
VULNERABILITY
Microsoft’s April 2026 Patch Tuesday addresses 167 security vulnerabilities, including two zero-day vulnerabilities. The first, tracked as CVE-2026-32201 with a CVSS score of 6.5, is an improper input validation issue in Microsoft Office SharePoint that allows unauthorized spoofing attacks over a network. This vulnerability is actively exploited in the wild and could allow attackers to view or modify sensitive information.
The second zero-day, CVE-2026-33825 with a CVSS score of 7.8, is an elevation of privilege vulnerability in Microsoft Defender’s anti-malware platform. This publicly disclosed flaw allows a local attacker to escalate privileges to SYSTEM level, potentially disabling security tools, installing persistent malware, harvesting credentials, and moving laterally across networks. Microsoft has also fixed multiple remote code execution bugs in Office that can be triggered via the preview pane.
ZY Media Productions
IT • Music • Technology