Good morning. Here's everything that happened in cybersecurity yesterday — in under 5 minutes.
An Adobe zero-day quietly ran for months before anyone noticed. Rockstar Games is staring down a ransom deadline in 24 hours. And 500 million devices are being tracked right now through the ads on their screens. Yesterday was a reminder that the attack surface is everywhere — there’s nowhere to hide.
🔥 Top Stories
01 — Emergency Patch Issued: Adobe Acrobat Reader Zero-Day Exploited Since Late 2025
Vulnerabilities
Adobe has issued an emergency out-of-band patch for CVE-2026-34621, a critical memory corruption vulnerability in Acrobat Reader that has been actively exploited since at least late 2025 — meaning attackers have had a months-long head start. If your team hasn't patched Acrobat Reader yet, stop reading and do it now.
02 — Rockstar Games Issues Response After ShinyHunters Issues Ransom Ultimatum — Deadline is April 14
Data Breach
Rockstar Games has characterized the ShinyHunters breach as "non-material," but the ransom clock runs out tomorrow. The group claims access via a third-party vendor breach through Snowflake. Whether Rockstar pays or calls the bluff, expect a significant data dump or major news by Monday morning.
03 — The Shadow Stream: WebLoc Is Using Ad Tech to Track 500 Million Devices for Law Enforcement
Surveillance
A Citizen Lab investigation has exposed WebLoc, an Israeli-developed geo-surveillance system that turns the real-time bidding ad ecosystem into a passive tracking network. Every time an ad loads on your phone, location data is broadcast — and WebLoc captures it. This isn't a hypothetical threat; it's already being used by law enforcement agencies worldwide.
04 — Glassworm Campaign Deploys "ZigDropper" to Infect Developer IDEs
Supply Chain
CVS Health subsidiary Aetna has disclosed two separate, distinct security incidents involving unauthorized access to member data. The back-to-back breaches illustrate persistent vulnerabilities in healthcare data pipelines and are likely to draw regulatory attention.
05 — "Password123": Bellingcat Finds 800 Hungarian Government Accounts Circulating Online Ahead of Elections
Policy & Government
Nearly 800 Hungarian government email accounts — including national security and counter-terrorism officials — were found online using easily guessable passwords, exposed ahead of the country's April 12 parliamentary elections. A timely reminder that nation-state credential hygiene failures are not hypothetical — they are documented and widespread.
📊 By The Numberes
500M — Devices passively tracked by WebLoc via ad tech
4 Months — Adobe zero-day was actively exploited before patch was issued
Apr 14 — ShinyHunters' ransom deadline for Rockstar Games — tomorrow
⚡ The Signal
Yesterday's news has one common thread: trusted surfaces being weaponized. The PDF reader you've opened a thousand times. The ad loading silently in an app. The IDE your developers use every day. The gaming studio you thought had nothing to do with enterprise risk. Attackers aren't finding new ways in — they're turning familiar tools against you. The question isn't whether your perimeter is hardened. It's whether you've audited the things you've already decided to trust.
🔍 What You May Have Missed
Operation Atlantic — $45M crypto fraud network dismantled
The NCA, U.S. Secret Service, and Canadian authorities jointly identified over 20,000 victims of a DeFi "drainer" scheme, freezing $12M and tracing $45M in stolen crypto. You covered Operation Atlantic yesterday — worth a follow-up as more victim details emerge.
W3LLSTORE phishing market taken down
FBI Atlanta and Indonesian National Police seized the W3LLSTORE phishing platform, linked to over $20M in fraud. A significant law enforcement win that didn't get much coverage outside specialist outlets.
Signal messages persisting in iPhone notification logs
A court case revealed that FBI agents retrieved Signal message content from push notification data stored in iPhone logs — even after the app was deleted. A significant privacy story with implications for anyone relying on Signal for secure communications.
AI browser extensions flagged as major blind spot
LayerX research found AI browser extensions are 60% more likely to have vulnerabilities than average extensions, 3x more likely to access cookies, and largely invisible to DLP tools. An under-reported enterprise risk that aligns perfectly with your audience.
📅 What to Watch
Rockstar Games ransom deadline hits April 14 — either a major data dump or a resolved incident by Monday
Adobe Acrobat patch rollout — watch for enterprise compliance deadlines and follow-on exploitation reports
WebLoc fallout — expect regulatory responses from EU data protection authorities given GDPR implications
Google Chrome 146 DBSC rollout — a rare piece of good news; watch for enterprise adoption guidance
Stay sharp. Stay ahead.
Till next time,