Daily Security Briefing #233

April 23, 2026 | Read Online

GRIDTIDE disrupted, Claude Code vulnerabilities exposed, and AI training data poisoning…

Executive Summary

Cybersecurity threats continue to evolve with malicious actors adapting to disruptions. The recent GRIDTIDE campaign disruption highlights collaborative efforts between industry partners. Meanwhile, critical vulnerabilities in Claude Code have been exposed. Additionally, AI training data poisoning has become a growing concern.

The FBI’s ability to extract deleted Signal messages from an iPhone notification database showcases the importance of forensic extraction techniques. Check Point’s WAF has been recognized for its application security capabilities by Frost & Sullivan. GitLab has released emergency patches addressing 11 vulnerabilities across its Community Edition and Enterprise Edition.

UNC6692, a threat group, leveraged social engineering tactics to deploy a custom malware suite on compromised hosts. The malicious npm package js-logger-pack has evolved, turning Hugging Face into a dual-threat platform for data theft and malware delivery. Bitwarden CLI has been compromised as part of the ongoing Checkmarx supply chain campaign.

Top Articles

Exposing Social Engineering Tactics: UNC6692’s Custom Malware Suite Google Threat Intelligence Group identified a multistage intrusion campaign by UNC6692, leveraging social engineering tactics to deploy a custom malware suite on compromised hosts. The threat group impersonated IT helpdesk employees via Microsoft Teams. Google Cloud Blog

FBI Extracts Deleted Signal Messages from iPhone Notification Database The FBI was able to forensically extract copies of incoming Signal messages from a defendant’s iPhone, even after the app was deleted. This highlights the importance of forensic extraction techniques in modern cybersecurity. Schneier

Check Point WAF Leads Application Security Check Point’s WAF has been recognized for its application security capabilities by Frost & Sullivan. This recognition reflects a major shift in how application security must operate today. Checkpoint Blog

GitLab Fixes Flaws That Could Allow Attackers to Hijack User Sessions GitLab has released emergency patches addressing 11 vulnerabilities across its Community Edition and Enterprise Edition. The high-severity flaws could allow attackers to execute malicious code, forge requests, and steal user session tokens. GBHackers

Attackers Exploit LMDeploy Flaw in the Wild Within 12 Hours of Advisory A critical Server-Side Request Forgery (SSRF) vulnerability in LMDeploy’s vision-language module was exploited in active attacks just 12 hours and 31 minutes after its public disclosure. GBHackers

NPM Menace Exposes Hugging Face As Backend For Data Theft and Malware Delivery The malicious npm package js-logger-pack has evolved, turning Hugging Face into a dual-threat platform for data theft and malware delivery. JFrog Security researchers dissected the campaign, revealing cross-platform implants. CyberPress

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign Bitwarden CLI has been compromised as part of the ongoing Checkmarx supply chain campaign. The affected package version appears to be @bitwarden/[email protected], and the malicious code was published in ‘bw1.js.’ The Hacker News

DPRK Cyber Spies Infiltrate Global Companies via Fake Job Scams Cybersecurity researcher ZachXBT ignited this probe by tying the domain luckyguys[.]site to crypto payments linked to North Korean (DPRK) fake IT workers. This isn’t isolated; similar tactics have been used in the past. CyberPress

Hackers Exploit File Upload Bug in Breeze Cache WordPress Plugin Hackers are actively exploiting a critical vulnerability in the Breeze Cache plugin for WordPress that allows uploading arbitrary files on the server without authentication. Bleeping Computer

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.