CISA, the UK National Cyber Security Centre, and agencies from Australia, Canada, Germany, Japan, the Netherlands, New Zealand, Spain, and Sweden published a joint advisory on April 23 titled "Defending Against China-Nexus Covert Networks of Compromised Devices." The advisory confirms that most China-nexus threat actors have shifted from using individually controlled servers to operating large botnets built from compromised SOHO routers, IoT devices, and network-attached storage equipment. The shift is deliberate. By routing operations through devices sitting in homes and small businesses worldwide, these actors make their attack traffic appear to originate from legitimate residential networks, effectively defeating traditional IP-based detection and blocklists. The advisory specifically names Volt Typhoon and Flax Typhoon as groups using this technique. One example cited involved a Chinese-linked company that infected over 260,000 devices globally to build a single proxy network. The advisory notes that multiple Chinese threat actor groups may share a single botnet simultaneously, and that these networks are continuously updated with new compromised devices to replace ones that are detected and cleaned. The attack chain typically begins with credential theft or exploitation of unpatched vulnerabilities in edge devices including routers, firewalls, and VPN gateways from Cisco, Fortinet, and Juniper. Once inside, the attacker deploys a persistent implant that establishes an encrypted tunnel blending into normal traffic. The device then serves as a relay point, obscuring the true origin of subsequent operations against enterprise and critical infrastructure targets.

Vercel published an updated statement on April 23 disclosing that its investigation, which expanded to include additional compromise indicators and a review of environment variable read events, identified a second and separate set of customer account compromises. This set is independent of and predates the Context.ai OAuth incident covered in Issue 8. Vercel attributes these earlier compromises to social engineering, malware, or other methods unconnected to the OAuth chain. Vercel says it notified affected customers in both groups and did not disclose the total number of accounts impacted across either incident.

CISA added CVE-2026-39987 to the Known Exploited Vulnerabilities catalog, confirming active exploitation of a pre-authentication remote code execution vulnerability in Marimo, an open-source reactive Python notebook developed by Cohere AI. Marimo is deployed as a Docker container and used extensively in data science, AI research, and LLM development environments for running user-submitted or AI-generated code. The flaw allows an unauthenticated attacker to escape the Python sandbox, access the host process, and execute arbitrary system commands with root privileges via JavaScript prototype chain traversal. The CVSS score is 9.3.