18/04/2026 Cyber Security Briefly News - Critical Vulnerabilities, Identity Exposure, and AI Governance Shape Evolving Cyber Threat Landscape

📋 Top Headlines at a Glance

[Webinar] Eliminate Ghost Identities Before They Expose Your Enterprise Data
Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access
Friday Squid Blogging: New Giant Squid Video
Payouts King ransomware uses QEMU VMs to bypass endpoint security
White House Chief of Staff to Meet With Anthropic CEO Over Its New AI Technology

Executive Summary: Today’s intelligence highlights a critical convergence of unmanaged non-human identities driving cloud breaches, active exploitation of zero-day vulnerabilities in endpoint security solutions, and sophisticated ransomware tactics leveraging virtualization for evasion. Concurrently, governments are intensifying focus on the security implications of advanced AI technologies, signaling a proactive stance on emerging tech governance. Organizations must prioritize robust identity hygiene, rapid vulnerability response, and advanced threat detection to counter these multifaceted risks.

🌍 Technical Intelligence Breakdown

👻 Eliminate Ghost Identities Before They Expose Your Enterprise Data

Analysis reveals that unmanaged non-human identities, such as service accounts and forgotten API keys, were a primary vector for cloud breaches in 2024, accounting for 68% of incidents.

Scale of Risk: For every human employee, there are an estimated 40 to 50 automated credentials, including service accounts, API tokens, AI agent connections, and OAuth grants.
Lifecycle Neglect: Many of these credentials are not properly deprovisioned or monitored when projects conclude or employees depart, creating “ghost identities.”
Impact: These unmanaged identities provide persistent access points that attackers can exploit to compromise enterprise data within cloud environments.

🛡️ Microsoft Defender under attack as three zero-days, two of them still unpatched, enable elevated access

Attackers are actively exploiting three zero-day vulnerabilities in Microsoft Defender, identified as BlueHammer, RedSun, and UnDefend.

Exploitation Status: All three vulnerabilities are being exploited in the wild.
Patch Status: Two of the three zero-days remain unpatched at the time of disclosure.
Disclosure: A researcher known as Chaotic Eclipse revealed these vulnerabilities.
Attack Path: Exploitation of these vulnerabilities leads to privilege escalation, allowing attackers to achieve higher access levels within a system.

💰 Payouts King ransomware uses QEMU VMs to bypass endpoint security

The Payouts King ransomware group is employing sophisticated evasion techniques by utilizing the QEMU emulator.

Virtualization for Stealth: Running malicious activities within a QEMU virtual machine helps the ransomware operate outside the direct monitoring scope of traditional endpoint security solutions.
Reverse SSH Backdoor: The use of a reverse SSH connection provides a persistent and covert channel for attackers to control the hidden VMs.
Endpoint Security Bypass: This method is specifically designed to circumvent detection mechanisms of endpoint security products.

🏛️ White House Chief of Staff to Meet With Anthropic CEO Over Its New AI Technology

A White House official is scheduled to meet with the CEO of Anthropic to discuss their new AI technology.

Government Scrutiny: Indicates increasing government interest and oversight concerning the development and deployment of advanced AI.
Focus on Security: The discussions prioritize the security aspects of AI models and software.
Proactive Engagement: The administration is taking a proactive approach to understand and potentially influence the secure development of emerging AI technologies.

📉 Threat Landscape & Trends

Identity-Centric Attacks: A significant shift towards targeting non-human identities (service accounts, API keys) as a primary breach vector, particularly in cloud environments.
Zero-Day Proliferation: Continued discovery and active exploitation of zero-day vulnerabilities, even in critical security software.
Advanced Evasion Techniques: Ransomware groups are evolving their tactics to include virtualization and covert communication channels (e.g., QEMU VMs, reverse SSH) to bypass sophisticated endpoint security solutions.
Emerging Technology Governance: Governments are actively engaging with AI developers to address the security implications and responsible development of advanced AI.

📌 Strategic Takeaway

Organizations must urgently re-evaluate and strengthen their non-human identity management programs, implement advanced endpoint detection capabilities capable of identifying virtualization-based evasion, and prioritize rapid patching for zero-day vulnerabilities. Proactive engagement with emerging technology security frameworks, particularly for AI, is also becoming critical.