Cyber Security News

Hacking Brief – April 20, 2026

Web infrastructure platform Vercel confirmed a security breach stemming from a compromise at Context AI, an integrated development tool. The incident granted unauthorized access to Vercel's internal systems, exposing limited customer credentials including authentication tokens and environment variables. A threat actor using the ShinyHunters moniker is reportedly offering stolen data—including GitHub tokens and customer secrets—for $2 million. The breach carries particular significance for Web3 and crypto projects that deploy frontends on Vercel's platform, as non-sensitive environment variables may contain exposed secrets. Vercel has initiated credential resets for affected customers.

Microsoft Defender faces active exploitation of three zero-day vulnerabilities tracked as BlueHammer, RedSun, and UnDefend. Huntress researchers confirmed in-the-wild exploitation beginning April 16-17, 2026, after a researcher publicly disclosed the flaws. The vulnerabilities allow attackers to bypass Microsoft Defender protections on Windows systems. Separately, a major DeFi hack resulted in the theft of $293 million in rsETH tokens, triggering contagion effects across decentralized finance protocols and forcing Aave to freeze related markets. The incident underscores ongoing systemic risks in cryptocurrency infrastructure where single exploits can cascade across interconnected platforms.

Sources: The Hacker News · The Block · Help Net Security · IDN Financials