🛡️ Daily Security Research Brief

ChipSoft ransomware disrupted Dutch hospitals, with possible patient-data exposure

ChipSoft, a major Dutch healthcare software provider whose HiX platform is used by roughly 70% of hospitals in the Netherlands, was hit by ransomware on April 7. Multiple hospital-facing services were taken offline, 11 hospitals reportedly disconnected software, and ChipSoft said it could not rule out unauthorized access to patient data.

• This is the biggest disclosed operational incident in the last 24 hours because it combines healthcare disruption with potential data theft.
• Z-CERT said critical care did not stop, but hospitals had to fall back to service desks and phone-based workflows.

The Record

CPUID download portal compromise pushed trojanized CPU-Z and HWMonitor installers

Attackers compromised a CPUID side API for about six hours and changed official download links so users received a malicious HWiNFO-branded installer instead of the expected binaries. CPUID says the signed original files were not altered, but the delivery path was poisoned.

• The payload was described as a multi-stage, memory-heavy loader with EDR evasion behavior.
• This was not just a nuisance compromise, it weaponized trust in a mainstream hardware utility distribution channel.

BleepingComputer

Marimo pre-auth RCE, CVE-2026-39987, was exploited within 10 hours

Marimo, the open-source Python notebook platform, disclosed a pre-authenticated RCE in its /terminal/ws WebSocket endpoint. The bug affects versions up to 0.20.4 and was fixed in 0.23.0. Sysdig observed exploitation under 10 hours after disclosure, with attackers pulling shells, reading .env files, and searching for SSH keys.

• The story here is speed. Attackers no longer wait for exploit kits when advisories are detailed enough.
• Any internet-facing niche dev tool with a critical advisory is now fair game.

The Hacker News

Orthanc DICOM bug cluster, CVE-2026-5437 through CVE-2026-5445, can crash servers and may enable RCE

Nine vulnerabilities in Orthanc, the open-source DICOM server used in medical imaging environments, can trigger denial of service, information disclosure, and heap-based memory corruption with possible remote code execution. Affected versions are 1.12.10 and earlier, fixed in 1.12.11.

• The most dangerous bugs are heap buffer overflows in image parsing and decoding logic.
• Healthcare environments just got hit from both sides: ransomware at the provider layer and fresh imaging-stack bug risk underneath.

SecurityWeek

Chrome 147 patched 60 bugs, including two critical WebML flaws

Google’s first stable Chrome 147 release fixes 60 vulnerabilities, including two critical WebML issues: heap buffer overflow CVE-2026-5858 and integer overflow CVE-2026-5859. SecurityWeek noted both bugs earned $43,000 each and are severe enough to suggest sandbox-escape or RCE potential.

• No in-the-wild exploitation was reported yet, but browser patch latency is still a gift to attackers.

SecurityWeek

ChipSoft is the headline ransomware event because downstream disruption mattered immediately

The ransomware impact was not abstract. Hospital portals, mobile services, and inter-institution workflows were interrupted right away. That is exactly why healthcare remains such a brutal ransomware target: operational pain arrives fast, even before full impact assessment is done.

The Record

MITRE released the Fight Fraud Framework (F3)

MITRE launched the Fight Fraud Framework, an open behavior-based knowledge base for fraud tactics, techniques, and procedures. It is designed to do for cyber-enabled fraud what ATT&CK did for adversary tradecraft, while adding fraud-specific tactics and shared taxonomy.

• This matters because fraud operations keep blending identity abuse, social engineering, and cyber intrusion patterns that older defender taxonomies underspecify.
• Good release, practical use case, and free.

SecurityWeek

Google made Gmail end-to-end encryption usable on mobile

Google rolled Gmail end-to-end encryption support to Android and iOS for eligible enterprise users, so teams can compose and read encrypted mail inside the native Gmail app without extra portals or helper apps.

BleepingComputer

Trusted software distribution is still a soft target

The CPUID incident shows attackers do not need to backdoor source code if they can poison the download path. The update or installer channel remains one of the highest-leverage attack surfaces in the ecosystem.

BleepingComputer

Identity attacks are getting more executive-specific and more MFA-resistant

VENOM phishing attacks are hitting CEOs, CFOs, and VPs with highly tailored Microsoft lures, QR-to-mobile handoffs, adversary-in-the-middle proxying, and device-code abuse. This is a clean reminder that standard MFA by itself is not enough for leadership accounts.

BleepingComputer

Stealthy espionage malware is leaning on modular loaders and living-off-legit files

LucidRook, aimed at Taiwanese NGOs and universities, uses password-protected archives, decoy government documents, DLL sideloading, Lua bytecode staging, and even Gmail-based exfiltration in a related toolset. The pattern is mature tradecraft, not commodity spray-and-pray.

BleepingComputer

OT exposure remains a national-risk problem, not just an asset-management problem

Censys found 5,219 internet-exposed Rockwell Automation / Allen-Bradley PLC hosts globally, with 3,891 in the United States, after a joint US government warning on Iranian targeting of those devices. That is not a subtle signal. Internet-exposed OT keeps being the kind of mistake adversaries build campaigns around.

BleepingComputer