Daily Briefing for 04.16.26

Top stories.

1. NVD shifts strategy to deal with a CVE backlog.
2. McGraw Hill confirms data breach.
3. Two US nationals sentenced to prison for involvement in North Korean IT worker schemes.

NVD shifts strategy to deal with a CVE backlog.

The NIST-hosted National Vulnerability Database (NVD) is shifting to a risk-based prioritization model as the NVD team struggles to keep up with the number of newly reported flaws, Infosecurity Magazine reports. Harold Booth, a NIST computer scientist, said at VulnCon26 yesterday that the NVD will not be enriching vulnerability descriptions for any CVEs reported before March 1st, 2026. The NVD will prioritize enriching vulnerabilities found in software used by the US Federal government and flaws added to CISA's Known Exploited Vulnerabilities (KEV) list. Booth stated, "All submitted CVEs will still be added to the NVD. However, those that do not meet the criteria above will be categorized as ‘Not Scheduled.'"

McGraw Hill confirms data breach.

US education content giant McGraw Hill has confirmed a data breach after threat actors exploited a misconfiguration in its Salesforce environment earlier this month, BleepingComputer reports. The ShinyHunters extortion gang claimed responsibility for the breach, and has since posted data from 13.5 million McGraw Hill user accounts to its leak site. According to Have I Been Pwned, the leak includes 100 GB of data "containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address, and phone number appearing inconsistently across some records."

A McGraw Hill spokesperson told BleepingComputer, "McGraw-Hill recently identified unauthorized access to a limited set of data from a webpage hosted by Salesforce on its platform. This activity appears to be part of a broader issue involving a misconfiguration within Salesforce's environment that has impacted multiple organizations that work with Salesforce."

Two US nationals sentenced to prison for involvement in North Korean IT worker schemes.

Two US nationals have been sentenced to prison after pleading guilty to their involvement in North Korea's fraudulent employment schemes. Kejia Wang of Edison, New Jersey, received a sentence of nine years, while Zhenxing Wang of New Brunswick, New Jersey, will serve seven years and eight months. The Justice Department says the two individuals used at least eighty stolen identities to help DPRK workers obtain remote jobs at more than 100 US companies, generating over $5 million for the North Korean government.

The Justice Department stated, "Kejia Wang traveled to Shenyang and Dandong, China on two separate occasions in 2023, to meet with overseas actors about the scheme, including a former classmate that Kejia Wang knew was from North Korea. Kejia Wang went on to serve as the U.S.-based manager for the scheme, supervising at least five facilitators in the United States who collectively hosted hundreds of computers of U.S. victim companies at their residences. Zhenxing Wang was among the U.S. facilitators who received and hosted victim company laptops at his residence. He and the others also enabled overseas IT workers to access the laptops remotely by, among other things, connecting the laptops to hardware devices designed to allow for remote access."