Daily Threat Briefing – April 11, 2026

This briefing describes multiple critical, active threats: the GlassWorm campaign deploying a Zig dropper to compromise developer IDEs and the software supply chain; a pre-auth remote code execution in Marimo (CVE-2026-39987, CVSS 9.3) exploited within 10 hours of disclosure; Iranian actors conducting reconnaissance against ~4,000 exposed Rockwell PLCs; Smart Slider 3 Pro being distributed with a backdoor via compromised updates; Russian-linked actors harvesting Microsoft Office tokens via router exploits; and exposure of healthcare PHI — the report issues urgent mitigation steps including patching, isolating affected systems, auditing plugins/extensions, and enforcing stronger authentication.