ISC Stormcast For Wednesday, April 29th, 2026 https://isc.sans.edu/podcastdetail/9910, (Wed, Apr 29th)
2026-04-29T07:23:47Z•c35f13052fcc8bcc5870f286e9b2919b0db124c548bfc9dc49cd7e553b6f0b23
.wavAppleBitwardenBitwarden-CLICanisterSprawlCheckmarxPyPISANDCLOCKTeamPCPUNC6780X-Vercel-Set-Bypass-Cookieaudio-malwarecredential-harvestingcredential-thefthoneypotiOSmalwarenotification-servicenpmsupply-chainsupply-chain-compromisetdatatelegramxinference
What happened
The ISC SANS diary roundup (Apr 21–29, 2026) highlights multiple active threats and mitigations: a significant TeamPCP supply-chain campaign update reporting a 26‑day pause ending with three concurrent compromises (Checkmarx KICS, Bitwarden CLI cascade, xinference PyPI), identification of an npm worm (CanisterSprawl), and continued UNC6780/SANDCLOCK activity including credential theft and exploitation tied to CVE-2026-33634. Apple released iOS/iPadOS fixes for an exploited Notification Services vulnerability (CVE-2026-28950). Honeypot telemetry showed HTTP requests with an X-Vercel-Set-Bypass‑
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sans_isc_diary
- Record identifier
- c35f13052fcc8bcc5870f286e9b2919b0db124c548bfc9dc49cd7e553b6f0b23
- Enrichment time
- 2026-04-29T07:23:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.