Security and Windows TCO

posted by Roy Schestowitz on Apr 16, 2026

• Security Week ☛ Exploited Vulnerability Exposes Nginx Servers to Hacking

  Hackers are exploiting CVE-2026-33032, a critical remote takeover vulnerability in the Nginx UI management tool. 

• QSB-111: xfce4-screensaver login bypass

  We have published Qubes Security Bulletin (QSB) 111: xfce4-screensaver login bypass.

• GamingOnLinux ☛ X.Org X server and Xwayland security advisory released for multiple issues | GamingOnLinux

  Time to get ready to run some system upgrades, as the X.Org X server and Xwayland developers have released a security advisory due to multiple issues.

• LWN ☛ Security updates for Tuesday

  Security updates have been issued by Debian (gdk-pixbuf, gst-plugins-bad1.0, and xdg-dbus-proxy), Fedora (chromium, deepin-image-viewer, dtk6gui, dtkgui, efl, elementary-photos, entangle, flatpak, freeimage, geeqie, gegl04, gthumb, ImageMagick, kf5-kimageformats, kf5-libkdcraw, kf6-kimageformats, kstars, libkdcraw, libpasraw, LibRaw, luminance-hdr, nomacs, OpenImageIO, OpenImageIO2.5, photoqt, python-cryptography, rawtherapee, shotwell, siril, swayimg, vips, and webkitgtk), Red Hat (firefox and podman), Slackware (libarchive), SUSE (expat, glibc, GraphicsMagick, libcap-devel, libpng16, libtpms, nodejs24, openssl-1_0_0, openssl-1_1, openssl-3, openvswitch, polkit, python-requests, python311-biopython, python312, python39, and tigervnc), and Ubuntu (corosync, kvmtool, libxml-parser-perl, linux-azure, linux-azure, linux-azure-6.17, linux-azure, linux-azure-6.8, policykit-1, redis, lua5.1, lua-cjson, lua-bitop, rustc, vim, and xdg-dbus-proxy).

• Windows TCO / Windows Bot Nets

  • SANS ☛ Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)

  • India Times ☛ Majority of Indian firms hit by ransomware in 2025 pay over Rs 12 crore on average: Report

    As per the report findings, India has emerged as the Asia-Pacific epicentre of ransomware activity, with manufacturing organisations witnessing a marked rise in frequency and impact.

    "According to the Exposure Management Research report, for the full year of 2025, 65% of affected Indian organisations paid ransoms, with average pay-outs reaching $1.35 million," according to the Manufacturing Threat Landscape 2025 report released on Tuesday.

  • The Register UK ☛ Autovista blames ransomware for service disruption

    Autovista confirms that it called in outside support to help clean up a ransomware infection currently affecting systems in Europe and Australia.

    The automotive data and analytics biz issued a public statement on Wednesday confirming the incident, and said that it's working to contain the attack.

  • Cyble Inc ☛ Ukraine Warns Of Cyberattacks On Healthcare By UAC-0247

    Ukrainian cyber defenders reported a newly intensified cyber campaign that is targeting Ukraine’s healthcare system and local government agencies, with attackers deploying increasingly sophisticated malware and social engineering tactics.

    In a fresh advisory, the CERT-UA said the activity—linked to a threat cluster tracked as UAC-0247—spiked between March and April 2026, with clinical hospitals, emergency services, and municipal bodies bearing the brunt of the attacks.

  • Security Week ☛ Sweden Blames Pro-Russian Group for Cyberattack Last Year on Its Energy Infrastructure

    Sweden said Wednesday that a pro-Russian group with links to Russia’s security and intelligence services was behind a cyberattack on a heating plant last year. The announcement followed warnings from officials in Poland, Norway, Denmark and Latvia that Russia is attacking critical infrastructure across Europe.

  • The Record ☛ New ‘JanaWare’ ransomware targeting Turkish citizens as cybercriminal ecosystem fragments

    The researchers said the ransomware operation has been ongoing since 2020 and is associated with a strain of malware that enforces execution constraints based on system locale and external IP geolocation — restricting its activity to systems only in Turkey.

    The ransom demands are very low, hovering around $200 to $400, and Acronis said the [intruders] are likely opting for a low-value, high-volume approach.