Critical Cybersecurity Vulnerabilities and Major Hacks Report - April 28, 2026

A critical Windows Shell vulnerability identified as CVE-2026-32202 is actively exploited in the wild, potentially affecting numerous Windows systems. Microsoft has confirmed this active exploitation as of late April 2026 and recommends immediate patching to mitigate security risks.

Researchers disclosed CVE-2026-3854, a critical remote code execution flaw on GitHub with a CVSS score of 8.7. This vulnerability allows exploitation via a single Git push affecting both GitHub.com and Enterprise Server versions.

Security researchers have identified 89 vulnerabilities in XAPI, used by Citrix XenServer/Hypervisor, including three critical flaws scoring 9.9 and two scoring 9.1 on the CVSS scale. The disclosure occurred in April 2026 and highlights significant security risks for virtualization platforms.

A critical unpatched remote code execution vulnerability, CVE-2026-25874, was discovered in Hugging Face's LeRobot platform, with a CVSS score of 9.3. The flaw remains unpatched as of April 28, 2026, exposing users to significant risk.

Kaspersky disclosed PhantomRPC, a privilege escalation technique affecting all tested Windows versions, including Server 2022 and 2025. The flaw exploits a lack of server validation in Windows RPC runtime, enabling attackers with SeImpersonatePrivilege to impersonate SYSTEM-level clients.

The VECT 2.0 ransomware irreversibly destroys files larger than 131KB on Windows, Linux, and ESXi systems due to a critical encryption flaw. Reported in April 2026, this malware poses a severe threat to enterprise data security and recovery efforts.

A vulnerability in the Nessus Agent on Windows allows arbitrary code execution with SYSTEM privileges. Disclosed in late April 2026, this issue presents a significant security risk for environments using this widely employed security agent.

Xu Zewei, a Chinese national linked to the Silk Typhoon hacking group, was extradited from Italy to the U.S. on charges of cyberattacks targeting COVID-19 research. Arrested in Italy in July 2025, he is alleged to have participated in state-sponsored cyber operations.

Microsoft patched a privilege escalation flaw in Entra ID related to the Agent ID Administrator role, which previously enabled service principal takeover attacks. The vulnerability was disclosed and addressed in April 2026 based on Silverfort's research.

North Korean-linked hackers executed a cryptocurrency theft totaling $290 million, demonstrating the increased scale and sophistication of state-affiliated cybercrime groups targeting digital assets globally as of April 2026.