Security Highlights Of The Week [05/26-1]

PAN-OS Zero-Day Under Active Exploitation Grants Root Access on Firewalls
Palo Alto Networks warned that CVE-2026-0300 in the PAN-OS Captive Portal is being actively exploited and allows unauthenticated remote code execution with root privileges. Because the bug affects internet exposed firewalls, it stands out as one of the highest priority issues of the week.
Source: Palo Alto Networks

cPanel Vulnerability Weaponized Against Government and MSP Networks
Threat actors were observed exploiting CVE-2026-41940 in cPanel and WHM shortly after disclosure, targeting government, military, hosting, and managed service provider environments. The flaw enables authentication bypass and gives attackers elevated control over exposed control panels.
Source: The Hacker News

DigiCert Revokes Fraudulently Issued Certificates After Support Portal Hack
DigiCert revoked certificates that were obtained after attackers compromised systems through a malicious payload delivered to its support team and pivoted into an internal support portal. The incident is notable because it involved EV Code Signing certificates and exposed weaknesses in internal trust workflows.
Source: SecurityWeek

Copy Fail Linux Root Bug Moves From Disclosure to In-The-Wild Exploitation
CVE-2026-31431, also known as Copy Fail, has already been added to CISA’s KEV catalog after limited exploitation was observed. The flaw affects Linux systems across major distributions and can allow local attackers to escalate privileges to root.
Source: SecurityWeek

DAEMON Tools Supply Chain Attack Confirmed by Vendor
DAEMON Tools Lite confirmed unauthorized interference in its infrastructure after trojanized installers were distributed from the legitimate site. The case is a classic software supply chain compromise because signed installation packages from a trusted vendor were turned into malware delivery vehicles.
Source: DAEMON Tools

Official SAP npm Packages Compromised in TeamPCP Linked Supply Chain Attack
Multiple official SAP CAP and Cloud MTA npm packages were compromised with malicious code that downloaded and executed unverified binaries. Because these packages are used in real developer and CI/CD workflows, the incident creates direct risk to credentials, tokens, and build environments.
Source: Socket

AI Supply Chain Abuse Hits Hugging Face and OpenClaw Ecosystems
Acronis reported active abuse of AI platforms including Hugging Face and OpenClaw, identifying more than 575 malicious skills in the OpenClaw ecosystem. The campaign shows how attacker controlled tools inside AI ecosystems can push malware through trusted workflows rather than through classic phishing alone.
Source: Acronis

Trellix Confirms Source Code Repository Breach
Trellix disclosed unauthorized access to part of its source code repository and said it is still investigating the intrusion with forensic support. Although the company said it has not found evidence that release or distribution systems were affected, the breach is significant because it involves a major cybersecurity vendor.
Source: Trellix

Microsoft Details Large Scale Code of Conduct Phishing Campaign Leading to AiTM Token Theft
Microsoft described a broad phishing campaign using code of conduct themed lures, multi stage delivery, and legitimate email services to steal credentials and session tokens. The campaign targeted tens of thousands of users and shows how polished enterprise style phishing continues to evolve beyond basic credential harvesting.
Source: Microsoft Security Blog

Google AppSheet Abuse Linked to 30,000 Compromised Facebook Accounts
Researchers traced a phishing operation that used Google AppSheet to send authenticated messages and compromise more than 30,000 Facebook accounts. The campaign stands out because it abused trusted Google infrastructure to improve delivery and bypass many normal email trust checks.
Source: Guardio

Breeze Cache WordPress Plugin Is Under Active Exploitation
Attackers are actively exploiting a critical arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress. With hundreds of thousands of active installations and remote code execution potential, this moved quickly from disclosure to widespread attack traffic.
Source: Wordfence

MetInfo CMS RCE Flaw Is Being Exploited in the Wild
Threat actors are exploiting CVE-2026-29014, a critical unauthenticated PHP code injection flaw in MetInfo CMS. The vulnerability enables remote code execution through crafted requests and has already attracted real world attacker activity.
Source: The Hacker News

Critical Ollama Bug Could Expose 300,000 AI Deployments to Secret Theft
A critical vulnerability in Ollama could let remote unauthenticated attackers extract prompts, messages, API keys, and other secrets from roughly 300,000 exposed deployments. Because Ollama is widely used as a self hosted inference engine, the issue directly affects real enterprise AI environments rather than a niche lab setup.
Source: SecurityWeek

Talos Exposes China Nexus APT UAT-8302 and Its Malware Arsenal
Cisco Talos disclosed UAT-8302 as a China nexus APT focused on obtaining and maintaining long term access to government and related entities. The group uses credential theft, open source tooling, and custom malware, and appears to share technical overlap with other sophisticated Chinese speaking threat clusters.
Source: Cisco Talos

Critical vm2 Sandbox Escape Bugs Enable Host Code Execution
Critical vulnerabilities in the vm2 Node.js sandbox library allow attackers to escape the sandbox and execute code on the host system. The issue is especially important because vm2 is commonly used to run untrusted JavaScript, which means the failure hits exactly the control boundary organizations expect it to enforce.
Source: GitHub Security Advisories

Security Highlights Of The Week [04/26-4]

Critical cPanel and WHM Auth Bypass Requires Emergency Manual Update
A critical cPanel and WHM flaw tracked as CVE-2026-41940 can allow attackers to access the control panel without authentication. The fix requires administrators to manually retrieve the patched build, which makes exposed hosting environments an immediate priority.
Source: BleepingComputer

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202
Microsoft revised its advisory to mark CVE-2026-32202 as actively exploited in the wild after originally shipping a patch for it earlier this month. The issue stems from an incomplete fix in a previous exploit chain and can coerce authentication and expose sensitive information through malicious LNK handling.
Source: The Hacker News

Official SAP CAP and Cloud MTA npm Packages Compromised in Supply Chain Attack
Multiple official SAP npm packages tied to CAP and Cloud MTA were compromised with a malicious preinstall routine that downloaded and executed Bun and an obfuscated payload. Because these packages sit in real developer and CI/CD workflows, the incident creates direct risk to tokens, credentials, and enterprise build pipelines.
Source: Socket

Quick Page Post Redirect WordPress Plugin Hid a Dormant Backdoor for Five Years
Researchers found that the Quick Page Post Redirect plugin had contained a hidden backdoor since 2021, affecting more than 70,000 WordPress sites. The code let the operator inject arbitrary content or code while staying invisible to logged in administrators, turning a trusted plugin into a long term supply chain compromise.
Source: BleepingComputer

Qinglong Task Scheduler RCE Flaws Are Being Exploited for Cryptomining
Attackers have been abusing authentication bypass flaws in Qinglong to obtain unauthenticated remote code execution and drop the .fullgc cryptominer on exposed servers. The case is notable because a popular developer tool with broad deployment moved from open access bug to real world abuse with limited visibility outside Chinese language communities.
Source: Snyk

Hugging Face LeRobot PolicyServer Exposed to Unauthenticated RCE
CVE-2026-25874 affects the LeRobot PolicyServer because it deserializes untrusted pickle data over gRPC. An unauthenticated attacker who reaches the service can execute arbitrary operating system commands on systems that may have GPU access, robotics connectivity, and privileged internal network reach.
Source: Resecurity

UAT-4356 Continues Targeting Cisco Firepower Devices With FIRESTARTER
Cisco Talos says UAT-4356 is still exploiting previously known flaws in Firepower FXOS devices and deploying the FIRESTARTER backdoor. The implant can run arbitrary shellcode inside the LINA process, showing again how perimeter appliances remain high value espionage footholds.
Source: Cisco Talos

China Nexus Actors Rely on Covert Networks of Compromised Edge Devices
CISA and partner agencies warned that China nexus actors are strategically using large covert networks made up of compromised routers and other edge devices. These networks support the full attack chain from reconnaissance to exfiltration and are designed to be low cost, deniable, and difficult to block with static indicators alone.
Source: CISA

GopherWhisper Uses Slack, Discord, and Outlook in China Aligned Espionage
ESET revealed a previously undocumented China aligned group called GopherWhisper that targeted a Mongolian government entity with a mostly Go based toolset. The group abused Slack, Discord, Outlook, and file sharing services for command and control and exfiltration, helping malicious traffic blend into legitimate cloud activity.
Source: ESET

Vercel Finds More Compromised Accounts in Context.ai Linked Breach
Vercel said its expanded review identified additional compromised customer accounts connected to the April incident. The company says the intrusion began with a compromise at Context.ai that let the attacker pivot through a Vercel employee account and access non sensitive environment variables.
Source: Vercel

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
The malicious @bitwarden/cli 2026.4.0 package carried credential theft and propagation behavior tied to the broader Checkmarx campaign. Even though the issue was limited to the npm CLI package, it put developer secrets, CI artifacts, and cloud credentials at risk during normal package installation.
Source: Socket

Device Code Phishing Surges With More Than 7 Million Attacks in Four Weeks
Barracuda says device code phishing has surged past 7 million attacks in four weeks, largely driven by the EvilTokens kit. The technique abuses legitimate OAuth device login flows, giving attackers persistent authorized access without relying on classic fake login pages alone.
Source: Barracuda

BlackFile Linked to Retail and Hospitality Vishing Extortion
BlackFile has been tied to data theft and extortion attacks that begin with phone calls from attackers posing as internal IT staff. The campaigns target retail and hospitality organizations, steal credentials and one time passcodes, and then escalate into seven figure extortion demands.
Source: BleepingComputer

Coinbase Cartel Builds a 100 Plus Company Extortion Campaign on Stolen Infostealer Credentials
Hudson Rock says the Coinbase Cartel has claimed more than 100 victims while relying on old infostealer credentials rather than novel exploits or custom ransomware. The group focuses on cloud environments, FTP systems, and file transfer services, using pure data theft and extortion instead of encryption.
Source: InfoStealers

GlassWorm Activates 73 Open VSX Sleeper Extensions
Socket says the GlassWorm campaign expanded with 73 impersonation extensions on Open VSX, several of which were later activated into malware delivery vehicles. The pattern matters because the extensions can look benign at first, gain trust, and then weaponize the normal update path or transitive extension relationships.
Source: Socket

Security Highlights Of The Week [04/26-3]

Vercel Finds More Compromised Accounts in Context.ai Linked Breach
Vercel said its investigation uncovered an additional set of affected customer accounts after expanding the indicators of compromise and reviewing environment variable access logs. The incident stemmed from a compromise tied to Context.ai and shows how third party identity and OAuth exposure can ripple into a cloud platform environment.
Source: Vercel

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
A malicious npm package was briefly distributed as @bitwarden/cli version 2026.4.0, carrying credential theft logic and CI pipeline propagation behavior. Bitwarden said the impact was limited to the compromised CLI release window and that there is no evidence end user vault data or production systems were affected.
Source: JFrog

China Nexus Covert Networks Built From Compromised Edge Devices
CISA and NCSC warned that China nexus actors are increasingly using botnet style covert networks made up of compromised routers and edge devices for reconnaissance, delivery, command and control, and exfiltration. The advisory highlights a low cost and deniable infrastructure model that can be reshaped quickly, reducing the value of static blocking alone.
Source: CISA

UAT 4356 Continues Targeting Cisco Firepower Devices With FIRESTARTER
Cisco Talos reported continued activity against Firepower devices running FXOS, where UAT 4356 exploits n day flaws and deploys the FIRESTARTER backdoor. The malware gives the actor remote access inside a core device process, which makes perimeter appliances a direct espionage and persistence target.
Source: Cisco Talos

Breeze Cache WordPress Plugin Actively Exploited for Arbitrary File Upload
Attackers are actively exploiting a critical Breeze Cache flaw that allows unauthenticated file uploads and can lead to remote code execution on vulnerable WordPress sites. The issue requires a specific plugin setting to be enabled, but the shift from disclosure to real world attacks makes exposed sites an immediate patching priority.
Source: BleepingComputer

Marimo RCE Added to KEV as Exploitation Continues
CISA added CVE-2026-39987 in marimo to the Known Exploited Vulnerabilities catalog after attackers moved from disclosure to exploitation within hours. The flaw enables pre authentication remote code execution on exposed notebook instances and has already been used in follow on malware activity.
Source: CISA

BRIDGE:BREAK Flaws Expose Serial to IP Converters in OT and Healthcare
Researchers disclosed 22 vulnerabilities in Lantronix and Silex serial to IP converters and identified thousands of exposed devices online. Because these bridge devices often sit between older serial systems and modern networks, compromise can enable data tampering, lateral movement, and disruption in OT and healthcare environments.
Source: Forescout

Void Dokkaebi Turns Fake Job Interviews Into Developer Supply Chain Attacks
Trend Micro said the North Korea aligned group Void Dokkaebi continues using fake recruitment workflows to lure developers into running malicious code repositories. The important development is that a single compromised developer machine can become a launch point for poisoning internal repositories and downstream software contributions.
Source: Trend Micro

GopherWhisper Abuses Slack Discord and Outlook in Attacks on Mongolia
ESET disclosed a previously undocumented China aligned group named GopherWhisper targeting Mongolian government institutions. The actors use a Go based toolset and legitimate cloud services such as Slack, Discord, Outlook, and file.io for command and control and exfiltration, which helps blend malicious traffic into normal workflows.
Source: ESET

Device Code Phishing Reaches 7 Million Attacks in Four Weeks
Barracuda said it observed more than 7 million device code phishing attacks in just four weeks, reflecting rapid growth in OAuth based account takeover activity. The technique abuses legitimate device login flows to obtain persistent authorized access without needing to steal and replay a password in the usual way.
Source: Barracuda

Critical Protobuf.js Flaw Enables JavaScript Code Execution
Proof of concept exploit code is now public for a critical protobuf.js issue that can lead to JavaScript code execution through unsafe dynamic code generation. The library is heavily used across Node.js applications and cloud environments, which makes the blast radius much larger than a niche package bug.
Source: BleepingComputer

SGLang Critical RCE Lets Malicious GGUF Models Run Code
A critical vulnerability tracked as CVE-2026-5760 can let attackers achieve remote code execution on SGLang systems by feeding crafted GGUF model files through exposed functionality. The bug matters because SGLang is a popular serving layer for LLM and multimodal workloads, putting AI infrastructure directly at risk.
Source: The Hacker News

Lotus Wiper Targets the Energy and Utilities Sector in Venezuela
Kaspersky described a destructive campaign using a previously unknown wiper called Lotus Wiper against the energy and utilities sector in Venezuela. The attack chain includes scripts that prepare the environment, weaken defenses, and coordinate the final destructive stage across the network.
Source: Kaspersky

ZionSiphon Malware Shows OT Focus on Israeli Water Systems
Darktrace analyzed ZionSiphon, an OT focused malware set built to target Israeli water treatment and desalination environments. Its mix of persistence, USB propagation, ICS scanning, and sabotage logic tied to chlorine and pressure controls makes it notable beyond typical IT malware reporting.
Source: Darktrace

Telecom Surveillance Actors Exploit Mobile Signalling Infrastructure
Citizen Lab uncovered two telecom surveillance campaigns and linked attack traffic to real mobile operator signalling infrastructure. The report shows how suspected commercial surveillance vendors can exploit telecom interconnect systems for covert location tracking that may persist for years without clear visibility from defenders or users.
Source: Citizen Lab

Security Highlights Of The Week [04/26-2]

Adobe Patches Reader Zero Day Exploited for Months
Adobe released emergency updates for CVE-2026-34621 after confirming exploitation in the wild for several months. The flaw can lead to arbitrary code execution when a victim opens a malicious PDF and affects Acrobat and Reader on Windows and macOS.
Source: SecurityWeek

Microsoft Patches SharePoint Zero Day and 168 Other New Vulnerabilities
Microsoft’s April Patch Tuesday fixed 169 vulnerabilities, including the actively exploited SharePoint flaw CVE-2026-32201. Its KEV inclusion makes it a high priority issue despite the lower severity score compared with many other Patch Tuesday entries.
Source: The Hacker News

Cisco Patches Critical ISE and Webex Flaws Requiring Immediate Action
Cisco fixed critical vulnerabilities in Identity Services Engine and Webex Services that could enable code execution or unauthenticated user impersonation. For the Webex issue, customers need to take additional remediation steps and not rely only on Cisco’s backend update.
Source: SecurityWeek

Smart Slider 3 Pro Backdoor Distributed Through Official Update Channel
Attackers compromised Nextend’s update infrastructure and pushed a trojanized Smart Slider 3 Pro build to WordPress and Joomla sites. The malicious release added backdoors, hidden administrator access, and persistence, turning a routine update into a supply chain incident.
Source: Patchstack

CPUID Site Served Malware Through CPU Z and HWMonitor Downloads
Attackers abused CPUID’s download infrastructure to redirect CPU Z and HWMonitor users to trojanized files. Because the payload was delivered from the official site, the incident shows how trusted software portals remain a high value supply chain target.
Source: BleepingComputer

Iran Linked Actors Target Internet Exposed Rockwell and Allen Bradley PLCs
A joint US advisory said Iranian affiliated actors are exploiting internet facing operational technology, especially Rockwell Automation and Allen Bradley PLCs. The activity has been tied to disruption and manipulation of industrial control environments, not just reconnaissance.
Source: CISA

Marimo Pre Auth RCE Moved from Disclosure to Exploitation Within Hours
CVE-2026-39987 in marimo was exploited within hours of public disclosure and later used to deploy NKAbuse malware from Hugging Face infrastructure. The bug gives unauthenticated remote code execution through exposed notebook instances.
Source: Sysdig

Fortinet FortiClient EMS Zero Day Added to KEV After Active Exploitation
Fortinet rushed fixes for CVE-2026-35616 after exploitation was observed in the wild. The flaw affects FortiClient EMS and can lead to remote code execution without authentication, making exposed management servers an immediate risk.
Source: SecurityWeek

AI Enabled Device Code Phishing Pushes OAuth Abuse at Scale
Microsoft observed an automated device code phishing campaign that uses dynamic code generation and workflow automation to improve success rates and extend abuse of the OAuth device flow. The campaign shows how attackers are turning a previously narrower technique into repeatable account takeover at scale.
Source: Microsoft Security Blog

Attackers Hunt High Impact Node.js Maintainers After Axios Compromise
Research following the Axios incident points to a broader campaign targeting trusted Node.js and npm maintainers through tailored social engineering. The risk extends beyond one package because a compromised maintainer account can push malicious code into widely used dependencies and developer pipelines.
Source: Socket

Security Highlights Of The Week [04/26-1]

Adobe Reader Zero Day Exploited for Months Through Malicious PDF Files
Researchers say a malicious PDF has been exploiting an Adobe Reader zero day in the wild since at least December, including against fully patched installations. The document appears to fingerprint the environment, abuse privileged Acrobat APIs to steal local data, and potentially stage follow on remote code execution or sandbox escape activity.
Source: BleepingComputer

Smart Slider 3 Pro Compromised Through the Official Update Channel
Attackers compromised Nextend’s update infrastructure and pushed a trojanized Smart Slider 3 Pro release through the official channel for WordPress and Joomla sites. Any site that updated to version 3.5.1.35 should be treated as potentially compromised because the malicious build installed multiple backdoors rather than merely exposing a software flaw.
Source: Patchstack

Fortinet Rushes Fixes for an Exploited FortiClient EMS Zero Day
Fortinet released emergency fixes for CVE-2026-35616 in FortiClient EMS after confirming in the wild exploitation. The bug is a critical unauthenticated access control issue that can lead to remote code execution through crafted requests.
Source: SecurityWeek

Iranian Actors Target Rockwell and Allen Bradley PLCs
US agencies warned that Iranian affiliated actors are actively targeting internet exposed Rockwell Automation and Allen Bradley PLCs in critical infrastructure. The activity includes unauthorized access to engineering projects and manipulation of HMI or SCADA data, with the advisory linking the intrusions to operational disruption and financial loss.
Source: Censys

Google Warns of UNC6783 Targeting BPOs for Downstream Data Theft
Google says UNC6783 is targeting business process outsourcing providers and help desks that support high value enterprises, then using that foothold to steal data from downstream customers. The campaign relies on social engineering and phishing, including theft of support tickets and identity related data that can support extortion or follow on access.
Source: SecurityWeek

Attackers Expand Social Engineering Campaign Against Node.js Maintainers
Socket reported that the social engineering operation behind the Axios compromise is also targeting other high impact Node.js and npm maintainers. The concern is not a single package incident but a scalable playbook aimed at high trust maintainers whose accounts can push malicious code into widely used dependencies.
Source: Socket

React2Shell Exploited for Large Scale Credential Harvesting in Next.js Apps
Talos described UAT-10608 as a large scale automated credential harvesting operation exploiting React2Shell in vulnerable Next.js applications. After initial access, the actors harvest credentials, SSH keys, cloud tokens, and environment secrets, turning each compromise into a map of the victim’s broader infrastructure.
Source: Cisco Talos

Device Code Phishing Surges as New Kits Spread Online
Device code phishing has surged as attackers abuse the OAuth device authorization flow to trick users into authorizing attacker controlled sessions on legitimate login pages. New kits have pushed the technique toward mainstream criminal use because stolen tokens can bypass normal password capture flows and extend account access beyond the initial phishing event.
Source: BleepingComputer

Apache ActiveMQ Patches a 13 Year Old Remote Code Execution Flaw
Apache ActiveMQ Classic patched CVE-2026-34197, an RCE issue in the Jolokia bridge that had been lurking for 13 years. In some versions it can become effectively unauthenticated when combined with a separate exposure flaw, turning a management feature into an internet facing execution path.
Source: Horizon3.ai

Storm 1175 Compresses the Window for Medusa Ransomware Attacks
Microsoft says Storm 1175 is exploiting newly disclosed web facing vulnerabilities at high speed to deploy Medusa ransomware, sometimes within 24 hours of initial access. The group’s focus on the short patch gap means exposed edge systems can move from N day exposure to exfiltration and encryption before normal response cycles catch up.
Source: Microsoft Security Blog

Security Highlights Of The Day [26/03/26]

Chinese Hackers Found Deep Within Telecom Backbone Infrastructure
Researchers uncovered a China linked state actor deploying kernel implants and passive backdoors within global telecommunications backbone infrastructure for long term persistence. The operation appears designed for high level espionage and sustained access to critical environments.
Source: SecurityWeek

ShadowPrompt Vulnerability Enables Silent Hijacking of Claude Chrome Extension
A vulnerability in the Claude Chrome extension allowed any website to inject instructions into the AI assistant without user interaction. By chaining an overly permissive origin allowlist with a DOM based XSS flaw, attackers could execute arbitrary actions with user level privileges.
Source: Koi AI

Citrix Warns of Critical NetScaler Flaw Allowing Session Token Theft
Citrix patched a critical vulnerability tracked as CVE-2026-3055 that could allow unauthenticated attackers to steal sensitive data such as session tokens. The flaw is similar to previous CitrixBleed issues and requires immediate patching.
Source: BleepingComputer

GlassWorm Malware Hides RAT Inside Malicious Chrome Extension
The GlassWorm campaign uses a multi stage infection chain to deploy a persistent RAT, including a malicious Chrome extension disguised as Google Docs Offline. The malware captures keystrokes, cookies, session tokens, and screenshots while communicating with a command and control server hidden in a blockchain.
Source: Aikido Security

Critical GitLab Flaws Enable App Impersonation and AI Token Exposure
GitLab released patches for multiple high severity vulnerabilities that could allow attackers to impersonate applications, execute unauthorized actions, and perform denial of service attacks. The flaws also pose a risk of exposing AI related tokens and compromising account integrity.
Source: SecurityOnline

Security Highlights Of The Day [24/03/26]

2025 IT Sector Cyber Threat Report Highlights Evolving Threat Landscape
The IT ISAC report outlines key cyber threat trends targeting the IT sector, emphasizing the role of collaborative intelligence sharing in identifying and mitigating attacks. The report provides insight into threat actors, techniques, and defensive strategies aimed at strengthening resilience across critical infrastructure ecosystems.
Source: IT-ISAC

Fake npm Install Logs Used to Deliver Remote Access Trojans
A campaign linked to North Korea targets developers through fake job interviews and coding tests, distributing malicious npm packages that deploy remote access trojans. The attack leverages social engineering to compromise developer environments and gain persistent access.
Source: ReversingLabs

GhostClaw Campaign Expands to GitHub and AI Workflows
The GhostClaw malware campaign has expanded beyond npm packages to include GitHub repositories and AI based workflows, delivering macOS infostealers. Researchers identified new infection vectors and infrastructure, showing increased sophistication in targeting developers.
Source: Jamf

Tycoon2FA Phishing Platform Quickly Recovers After Law Enforcement Disruption
The Tycoon2FA phishing as a service platform has resumed operations shortly after a coordinated law enforcement takedown. Despite domain seizures and disruption efforts, the service returned to normal activity levels within days, highlighting the resilience of cybercrime infrastructure.
Source: BleepingComputer

Critical Cisco Firewall Vulnerability Actively Exploited in the Wild
A critical remote code execution vulnerability in Cisco Secure Firewall Management Center, tracked as CVE-2026-20131, is being actively exploited. The flaw allows unauthenticated attackers to execute arbitrary code and gain root privileges, prompting urgent remediation actions including inclusion in CISA’s KEV catalog.
Source: Zscaler ThreatLabz

Security Highlights Of The Day [19/03/26]

Aura Discloses Data Breach Impacting 900,000 Records
Security firm Aura disclosed a data breach caused by a phone phishing attack targeting an employee, which allowed attackers to access the account for approximately one hour. The company responded by terminating access, activating its incident response plan, and engaging external experts and law enforcement.
Source: SecurityWeek

Apple Fixes WebKit Vulnerability Allowing Same Origin Policy Bypass
Apple released security updates addressing a WebKit vulnerability that could be exploited to bypass the same origin policy using specially crafted web content. The flaw affects iOS, iPadOS, and macOS and has been mitigated through improved input validation.
Source: The Hacker News

New ClickFix Scam Tricks Users Into Mapping Attacker Controlled Drives
A new ClickFix variant manipulates users into executing malicious commands through the Windows Run dialog. The attack uses fake CAPTCHA pages that instruct users to paste and run commands already copied to their clipboard, effectively granting attackers access without traditional malware.
Source: Hackread

Critical ScreenConnect Flaw Exposes Server Level Cryptographic Keys
A vulnerability tracked as CVE-2026-3564 could allow attackers to access sensitive cryptographic material on the server due to improper handling of secrets in older versions. This could lead to unauthorized control over affected systems.
Source: SecurityOnline

KVM Devices Highlighted as Overlooked Security Risk
Research shows that compromising KVM devices can give attackers full control over connected systems at a level below the operating system. This allows bypassing security controls such as EDR, disk encryption, and Secure Boot.
Source: Eclypsium

Security Highlights Of The Day [17/03/26]

NCI Warns of Increased Threats to Critical Infrastructure Amid Middle East Conflict
A joint advisory from NCI highlights that the ongoing conflict in the Middle East raises risks for critical infrastructure globally. Organizations may face increased cyberattacks from Iranian state actors, hacktivists, and aligned cybercriminal groups. There is also a risk of physical attacks targeting public spaces and critical infrastructure. Organizations are advised to increase preparedness and monitoring.
Source: NCI Advisory

Poisoned Typeface Shows How Fonts Can Compromise AI Systems
Researchers demonstrated how custom fonts and CSS can embed malicious instructions visible to users while AI systems process benign content. This technique enables prompt injection and could lead to data leakage or execution of malicious code, affecting all tested AI assistants.
Source: LayerX Security

Critical File Browser Flaw Grants Automatic Admin Privileges
A vulnerability tracked as CVE-2026-32760 with a CVSS score of 10 allows any newly registered user to gain full administrative privileges due to a logic flaw in the registration process. This could result in complete system takeover without technical complexity.
Source: SecurityOnline

LeakNet Ransomware Uses ClickFix and Deno for Stealthy Attacks
The LeakNet ransomware group uses the ClickFix technique for initial access and leverages the Deno runtime to execute malicious payloads directly in memory. This reduces forensic traces on disk and makes detection more difficult.
Source: BleepingComputer

Authlib Flaws Enable Token Forgery and Authentication Bypass
Three critical vulnerabilities in the widely used Authlib library could allow attackers to bypass authentication, forge JWT tokens, and decrypt sensitive data. Given the library’s extensive use, the impact on global web infrastructure could be significant.
Source: SecurityOnline

Security Highlights Of The Day [13/03/26]

Google Fixes Two Chrome Zero Days Exploited in the Wild
Google released security updates addressing two Chrome zero day vulnerabilities that were actively exploited in the wild. The flaws affect the Skia and V8 components of the browser. Both vulnerabilities were discovered and reported internally by Google on March 10, 2026, and technical details about their exploitation have not been disclosed to prevent further abuse by threat actors.
Source: The Hacker News

Storm 2561 Uses SEO Poisoning to Distribute Fake VPN Clients for Credential Theft
Microsoft identified a credential theft campaign distributing fake VPN clients through SEO poisoning. Users searching for legitimate enterprise software are redirected to malicious ZIP files hosted on attacker controlled websites, which deploy digitally signed trojans masquerading as trusted VPN clients while harvesting VPN credentials. Microsoft attributes the activity to the cybercriminal actor Storm 2561, active since May 2025.
Source: Microsoft Security Blog

400,000 WordPress Sites Impacted by SQL Injection in Ally Plugin
A SQL injection vulnerability affecting the Ally WordPress plugin, installed on more than 400,000 sites, could allow attackers to extract sensitive data from databases including password hashes. The vulnerability was reported through the Wordfence Bug Bounty Program only five days after the flaw was introduced into the code.
Source: Wordfence

Veeam Warns of Critical Flaws Exposing Backup Servers to RCE Attacks
Veeam released patches for multiple vulnerabilities in its Backup and Replication solution, including four critical remote code execution flaws. Three of the vulnerabilities allow low privileged domain users to execute remote code on vulnerable backup servers, creating a serious risk to systems responsible for protecting critical organizational data.
Source: BleepingComputer

Glassworm Returns With Invisible Unicode Attacks on GitHub and npm
Researchers observed a renewed wave of activity from the threat actor Glassworm, using hidden Unicode characters to compromise GitHub repositories, npm packages, and the VS Code ecosystem. The technique allows malicious code to remain visually hidden during code review while still executing in affected environments. Several notable repositories were reported as impacted.
Source: Aikido Security

Security News