Daily Threat Briefing – April 12, 2026

Iranian-linked actors are actively targeting over 4,000 exposed Rockwell PLCs threatening critical infrastructure; a critical Marimo RCE (CVE-2026-39987, CVSS 9.3) was exploited within 10 hours of disclosure; Russian GRU actors are harvesting Microsoft Office authentication tokens via compromised routers; the GlassWorm campaign now uses a Zig dropper to infect developer IDEs posing supply-chain risk; and the Webloc advertising-based surveillance system has reportedly tracked ~500 million devices — urgent patching, network segmentation, credential protections, and developer environment hardening are recommended.