Cybersecurity Brief – 2026-03-22

Sun, 22 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

The Trivy vulnerability scanner was compromised in a supply chain attack attributed to the threat group TeamPCP. The attackers distributed credential-stealing malware via official Trivy releases and GitHub Actions, leading to the compromise of at least 47 npm packages with a self-spreading worm dubbed “CanisterWorm.”
A cyberattack on a car breathalyzer firm resulted in operational disruption, leaving drivers unable to start their vehicles due to system outages.
Iranian hackers conducted cyberattacks that disrupted medical care at hospitals in Maryland.

Oracle released patches addressing CVE-2026-21992, a critical unauthenticated remote code execution vulnerability in Oracle Identity Manager and Web Services Manager.
CISA added five vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalogue, mandating patching by April 3, 2026.
A critical vulnerability in Quest KACE, tracked as CVE-2025-32975, has been identified and may have been exploited in attacks targeting the education sector.

Russian Intelligence Services-affiliated threat actors are conducting mass phishing campaigns targeting commercial messaging applications such as WhatsApp and Signal to compromise user accounts.
TeamPCP, the group behind the Trivy supply chain attack, is suspected of orchestrating follow-on attacks involving the deployment of infostealers and self-propagating malware across npm packages.
Iranian threat actors were responsible for cyberattacks that disrupted healthcare services in Maryland.

Microsoft Azure Monitor alerts are being abused in callback phishing campaigns, with attackers impersonating Microsoft Security Team notifications about unauthorized account charges to lure recipients.
The Trivy supply chain attack leveraged GitHub Actions to distribute infostealer malware, demonstrating continued threat actor interest in exploiting CI/CD pipelines and open-source distribution channels.
Google introduced “Advanced Flow” for Android, a new mechanism enabling more secure sideloading of APKs from unverified developers, aimed at enhancing security for power users.

The U.S. CISA has mandated the patching of vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire by April 3, 2026, following their addition to the KEV catalogue.