n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails
2026-04-16T01:24:10Z•2f30cf8fc187f741541baf020b847ed0e557201b0c1db0c676d05fcd4e5a0c18
RATacrobat-readeractive-exploitationbrowser-extensions-malware','glassworm','ide-supplychain','ai-abchrome-extensionscisa-kevcomposercpuid-breachcritical-vulnerabilitiesjanelaratmalware-deliverymiraxn8nnginx-uiopenai-github-actionspatch-tuesdayphishingphpremote-access-trojanrokratsapshowdocsql-injectionstx-ratsupply-chain
What happened
The Hacker News roundup (April 2026) details multiple high-impact security incidents and active exploitations: threat actors abused n8n webhooks for phishing and malware delivery; a critical nginx-ui auth‑bypass (CVE-2026-33032, CVSS 9.8) is being exploited to take over Nginx; SAP, Adobe, Microsoft, Fortinet and others received critical Patch Tuesday fixes (notably SAP SQLi CVE-2026-27681); Adobe Acrobat Reader (CVE-2026-34621) and ShowDoc RCE (CVE-2025-0520) are actively exploited; PHP Composer command‑injection flaws (CVE-2026-40176) and other high‑severity CVEs were disclosed; CISA added KE
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 2f30cf8fc187f741541baf020b847ed0e557201b0c1db0c676d05fcd4e5a0c18
- Enrichment time
- 2026-04-16T01:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.