Daily Threat Briefing – April 16, 2026

Critical, actively exploited vulnerabilities and large-scale campaigns are being reported across web infrastructure, automation platforms, and enterprise software: an unauthenticated nginx-ui authentication bypass (CVE-2026-33032) enables full server takeover, Microsoft disclosed an actively exploited SharePoint zero-day amid 169 patches, n8n webhooks are being weaponized for phishing and malware delivery, a WordPress plugin supply-chain compromise and signed adware are disabling endpoint protections, and Russian state-backed actors plus the AgingFly malware are harvesting Office tokens and credentials — all affecting government, healthcare, education, and enterprise environments and requiring immediate patching, audits, and mitigations.