Stryker on DanSec Daily

Cybersecurity Brief – 2026-04-11

Sat, 11 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

CPUID suffered a supply chain attack where hackers altered download links for CPU-Z and HWMonitor, serving malicious executables via the official website.
Telehealth company Hims experienced a breach, exposing highly sensitive personal health information (PHI) of users.
Medical technology firm Stryker was impacted by a cyberattack.
Microsoft reported that the financially motivated threat actor Storm-2755 targeted Canadian employees in payroll hijacking attacks.
Nearly 4,000 US industrial devices, including PLCs, have been identified as exposed to Iranian-linked cyberattacks targeting critical infrastructure.
Fake websites impersonating Claude AI were found distributing PlugX malware, providing attackers remote access to victim systems.

Newly Discovered Vulnerabilities

Juniper Networks patched multiple vulnerabilities in Junos OS, including a critical flaw that allows remote, unauthenticated takeover of affected devices.
Chrome 147 addressed 60 vulnerabilities, including two critical bugs in the WebML component.
Orthanc DICOM software vulnerabilities were disclosed, leading to potential denial-of-service, information disclosure, and remote code execution.
A critical vulnerability in Marimo was exploited in the wild within nine hours of public disclosure.
ClickFix campaigns exploited a new method to infect Macs by bypassing macOS Tahoe’s Terminal warnings, using Script Editor instead.

Notable Threat Actor Activity

The “Silver Fox” threat actor is conducting tax-themed phishing campaigns targeting Japanese firms during tax season.
Ongoing GlassWorm campaign now uses a Zig dropper to infect developer integrated development environments (IDEs).
Iranian-linked hackers are actively targeting US critical infrastructure by manipulating PLCs and SCADA systems.
Storm-2755 continues payroll hijacking attacks, focusing on Canadian employees.
Recovery scammers are targeting individuals who have already been victims of fraud, leveraging so-called “sucker lists.”

Trends, Tools, or Tactics of Interest

Analysis of one billion CISA KEV remediation records indicates that most critical vulnerabilities are exploited before defenders can patch, highlighting the limitations of human-scale security operations.
Device Bound Session Credentials (DBSC) have been rolled out in Chrome 146 and above to prevent session theft by cryptographically binding authentication to devices.
Google introduced end-to-end encryption (E2EE) for Gmail on Android and iOS, now available for enterprise users.
AI browser extensions are emerging as an unmonitored channel for AI consumption, raising new security concerns.
Anthropic’s Mythos Preview AI model, capable of finding and exploiting zero-days, is drawing attention to the risks of advanced exploit-writing AI tools.
MITRE released the Fight Fraud Framework, providing a behavior-based model of fraud tactics and techniques.
ClickFix demonstrates a new macOS infection vector by using Script Editor to bypass standard paste warnings.
LayerX and other security vendors highlight the risk of browser extensions as attack vectors, particularly in the context of AI and GenAI usage.

Regulatory or Policy Developments

FINRA launched a Financial Intelligence Fusion Center to enhance response to cybersecurity and fraud threats in the financial sector.
Increased compliance oversight pressure is reported across public sector cybersecurity, with leaders now required to prove security effectiveness, not just prevent attacks.

Cybersecurity Brief – 2026-04-03

Fri, 03 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities

Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity

TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.

Trends, Tools, or Tactics of Interest

Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments

WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.

Cybersecurity Brief – 2026-03-29

Sun, 29 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Iran-linked threat actors breached the personal email account of Kash Patel, director of the U.S. Federal Bureau of Investigation (FBI), and leaked a cache of photos and other documents.
The same Iranian group conducted a wiper attack against Stryker, a medical technology company.

Newly Discovered Vulnerabilities

A critical memory overread vulnerability (CVE-2026-3055, CVSS 9.3) affecting Citrix NetScaler ADC and NetScaler Gateway is under active reconnaissance by threat actors.

Notable Threat Actor Activity

Iranian-affiliated hackers are responsible for both the breach of the FBI director’s personal email and the wiper attack on Stryker.
The TeamPCP supply chain campaign has shifted to a monetization phase, with no new compromises reported in the last 48 hours.

Trends, Tools, or Tactics of Interest

A new info-stealing malware, Infinity Stealer, is targeting macOS systems. The malware is distributed via ClickFix-themed lures, including fake Cloudflare CAPTCHA pages, and is delivered as a Python payload packaged using the Nuitka compiler.
The Infinity Stealer infection chain involves a Bash script and Nuitka loader, indicating increased sophistication in macOS malware delivery methods.

Cybersecurity Brief – 2026-03-20

Fri, 20 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Navia Benefit Solutions disclosed a data breach impacting approximately 2.7 million individuals, with sensitive information exposed to attackers.
Security firm Aura reported a breach affecting 900,000 records after an employee was targeted via phone phishing, leading to data theft from a marketing tool.
Marquis confirmed a data breach affecting 672,000 individuals, with previous estimates suggesting over 1.6 million may be impacted.
Medical technology company Stryker suffered a destructive cyberattack that wiped around 80,000 devices. The FBI subsequently seized Handala hacktivist group’s data leak sites used to publicise the breach.
Bitrefill, a crypto-powered gift card store, attributed a recent cyberattack to North Korean Lazarus (Bluenoroff) group activity.
Ex-data analyst convicted of stealing company data and attempting to extort $2.5 million from Brightly Software while still employed as a contractor.

Newly Discovered Vulnerabilities

A critical “PolyShell” vulnerability affects all Magento Open Source and Adobe Commerce stable version 2 installations, enabling unauthenticated remote code execution and account takeover.
Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw that could allow account takeover.
A critical Microsoft SharePoint vulnerability, patched in January, is now being actively exploited in the wild.
ScreenConnect issued an update to address a critical vulnerability exposing machine keys, now adding encrypted storage and management for enhanced protection.

Notable Threat Actor Activity

Russian APT28 (GRU-linked) is exploiting a Zimbra Collaboration Suite vulnerability in attacks targeting Ukrainian government entities, leveraging insufficient sanitization of CSS content in HTML emails.
Multiple threat actors have been using the DarkSword iOS exploit kit, which chains six vulnerabilities (including three zero-days), for full device takeover since at least November 2025. Apple has issued warnings to users of older, unpatched iPhones.
North Korean Lazarus (Bluenoroff) group is linked to the cyberattack on Bitrefill.
Iranian threat actors prepared cyberattack infrastructure over a six-month period, including the use of US-based shell companies, to increase their operational resilience ahead of recent kinetic events.

Trends, Tools, or Tactics of Interest

EDR killer malware continues to evolve, with 54 EDR killers leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit 35 signed vulnerable drivers and disable endpoint security solutions.
New Android malware family “Perseus” is actively targeting devices for takeover and financial fraud, monitoring user notes apps to extract sensitive data such as passwords and recovery phrases.
Speagle malware is hijacking the legitimate Cobra DocGuard program to exfiltrate data via compromised servers.
Recent DDoS botnet takedowns (Aisuru, Kimwolf, JackSkid, Mossad) highlight the continued threat from large-scale IoT botnets, with over 3 million infected devices used in record-breaking 31.4 Tbps attacks.
MCP (Model Code Provider) security issues in LLM (Large Language Model) environments are considered architectural and not easily patchable, posing ongoing risks.
Attackers are increasingly targeting password reset workflows for privilege escalation; security guidance has been issued to harden these processes.
Criminals are actively trading stolen tax records on dark web forums during tax season, with tax forms selling for as little as $20.

Regulatory or Policy Developments

The US Department of Justice, in cooperation with Canadian and German authorities, dismantled the infrastructure behind several major IoT botnets, including Aisuru, Kimwolf, JackSkid, and Mossad.
CISA issued advisories urging organisations to secure Microsoft Intune endpoint management systems, following their exploitation in the Stryker cyberattack.
Major providers are piloting quantum-safe HTTPS, reducing certificate size and improving both latency and transparency.

Cybersecurity Brief – 2026-03-19

Thu, 19 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Newly Discovered Vulnerabilities

Cisco Secure Firewall Management Center (FMC): CVE-2026-20131, a critical zero-day vulnerability, is being actively exploited by the Interlock ransomware group for remote code execution and root access.
GNU InetUtils telnetd: CVE-2026-32746, a critical unpatched flaw, allows unauthenticated remote attackers to execute arbitrary code as root.
Ubuntu Desktop: CVE-2026-3888, a high-severity vulnerability in default installations (24.04+), allows privilege escalation to root via a systemd cleanup timing exploit.
ConnectWise ScreenConnect: A cryptographic signature verification vulnerability has been patched, which could have allowed unauthorized access and privilege escalation.
Zimbra Collaboration Suite: An XSS vulnerability is being actively exploited; CISA has ordered urgent patching. Microsoft SharePoint is also under active exploitation for a separate flaw.
Claude AI: A trio of vulnerabilities, including prompt injection, exposes Claude users to potential data theft through chained attacks initiated from Google searches.
Apple WebKit: CVE-2026-20643, a vulnerability that could allow sites to access user data, has been patched via a background security update.
IP KVM Devices: Nine critical vulnerabilities across four vendors allow unauthenticated attackers to gain root access and take control of host systems.

Notable Threat Actor Activity

Interlock ransomware: Actively exploiting the Cisco FMC zero-day (CVE-2026-20131) in a campaign ongoing since January 2026.
Horabot: New campaign in Mexico identified, involving sophisticated multi-stage malware delivery and targeting financial information.
SideWinder: Espionage group, suspected to be India-linked, expanding operations across Southeast Asia targeting governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rotating infrastructure.
DPRK IT Worker Network: OFAC sanctioned six individuals and two entities for funding North Korean WMD programs through fraudulent remote IT work.
Iranian-linked Handala group: Attributed to the Stryker breach, leveraging credentials stolen via malware.
Magecart: Ongoing use of novel techniques, such as hiding payloads in EXIF data of third-party favicons, to evade repository scanners and steal payment information.
Darksword iOS Exploit Kit: Used by state-sponsored and criminal actors, this kit chains multiple iOS zero-days to compromise devices for surveillance and data theft, targeting users in Saudi Arabia, Turkey, Malaysia, Ukraine, and reportedly by Russian hackers.
SnappyClient: A new C2 implant targeting cryptocurrency wallets, supporting remote access, data theft, and spyware capabilities.
Shipping-Themed Phishing: Surge in phishing campaigns targeting Middle East and Africa, leveraging shipping themes.

Trends, Tools, or Tactics of Interest

Refund Fraud Economy: Increase in organized refund fraud exploiting major retailers and payment platforms, with methods and tutorials being commercialized.
Fake Shop Networks: Discovery of a network of over 20,000 fake online shops designed to steal payment and personal data.
Font-Rendering Evasion: Researchers demonstrated a method to hide malicious commands from AI assistants using font-rendering tricks.
Scanning Activity: Increased scans for “adminer” and “phpMyAdmin” observed in honeypots.
Shadow AI: SaaS applications are enabling unmonitored AI activity, increasing risk of data exposure and breaches.
Security Tooling: Emergence of autonomous offensive security platforms (e.g., XBOW) and new AI detection/response startups (e.g., Manifold, Native) focused on vulnerability discovery and endpoint security.

Regulatory or Policy Developments

OFAC Sanctions: The US Treasury’s OFAC sanctioned individuals and entities tied to North Korean IT worker schemes funding WMD programs.
EU Sanctions: The European Union sanctioned Chinese and Iranian companies and individuals for cyberattacks against EU member states, expanding measures already in place in the US and UK.
CISA Directives: CISA issued emergency directives for US government agencies to patch actively exploited vulnerabilities in Zimbra and SharePoint.

Cybersecurity Brief – 2026-03-17

Tue, 17 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a medical technology company, suffered a cyberattack affecting its internal Microsoft environment. The attack remotely wiped tens of thousands of employee devices without deploying malware.
Companies House, the UK’s company registry, confirmed a security flaw in its WebFiling service that exposed business data. The service was temporarily taken offline to address the issue.
Hundreds of Python repositories were compromised in the GlassWorm campaign using stolen GitHub tokens, allowing attackers to inject malware into projects. The attack leveraged access to developer accounts obtained via previous campaigns.
Hacked WordPress sites are delivering Vidar infostealer to Windows users via fake “verify you are human” prompts.
A hacking attempt was reported at Poland’s nuclear research center, with initial evidence suggesting possible Iranian involvement, though attribution is unconfirmed.

Newly Discovered Vulnerabilities

CISA added a medium-severity Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which leaks server paths, is being actively exploited and may be chained for remote code execution.
Researchers detailed the “Zombie ZIP” method, which can bypass antivirus detection during a first scan by manipulating ZIP file structures. There is debate over whether this constitutes a vulnerability.
Companies House addressed a security flaw that exposed business data through its WebFiling service.

Notable Threat Actor Activity

The GoPix banking Trojan, originating from Brazil, was analyzed for its complex memory-only operation, use of Proxy AutoConfig (PAC) files for man-in-the-middle attacks, and malvertising distribution tactics.
Russian-linked threat actors deployed the DRILLAPP backdoor against Ukrainian targets, abusing Microsoft Edge debugging features for stealth and persistence.
China-nexus threat actors have maintained long-term access to Southeast Asian military organizations using custom backdoors and evasion techniques, staying dormant for extended periods.
Storm-2561 is targeting VPN users by distributing fake VPN clients through SEO poisoning, resulting in credential theft via trojans.
Attackers are abusing LiveChat platforms to phish for credit card and personal data by impersonating PayPal and Amazon customer support.
Sophisticated phishing attacks have targeted security firm executives using DKIM-signed emails, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages.

Trends, Tools, or Tactics of Interest

An emerging obfuscation technique is being used to evade email security solutions that rely on Natural Language Processing (NLP), making malicious emails harder to detect.
GlassWorm malware is evolving to hide in dependencies and extensions, increasing persistence and evasion capabilities within supply chain attacks.
ClickFix campaigns are distributing the MacSync macOS infostealer via fake AI tool installers, representing a shift from exploit-based to social engineering-based delivery methods.
Shadow AI adoption is proliferating in SaaS environments as employees use unapproved AI tools, increasing organizational risk and complicating security monitoring.
Attackers are scanning for proxy servers using /proxy/ URLs with IP addresses, a technique frequently detected by honeypots.
Models are being recruited via Telegram channels to serve as faces for AI scams, enabling more convincing social engineering campaigns.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued guidance for US government agencies to secure Wing FTP Server instances against active exploitation.
Companies House in the UK temporarily suspended its WebFiling service to remediate a security flaw, impacting public access to company registry services.

Cybersecurity Brief – 2026-03-14

Sat, 14 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Starbucks disclosed a data breach affecting hundreds of employees after threat actors gained access to Starbucks Partner Central accounts via phishing attacks targeting the employee portal.
Poland’s National Centre for Nuclear Research (NCBJ) reported an attempted cyberattack targeting its IT infrastructure; the attack was detected and blocked with no reported impact.
The FBI is investigating eight malicious games uploaded to the Steam platform, which were used to spread malware. The agency is seeking information from affected users.
An Iran-linked hacker group attacked Stryker, disrupting manufacturing and shipping operations. The attackers used legitimate endpoint management software to wipe devices rather than deploying malware.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two high-severity zero-day vulnerabilities (CVE-2026-1234 and CVE-2026-2345) affecting Skia and V8 components, both exploited in the wild to potentially allow code execution and security bypass.
Nine vulnerabilities (“CrackArmor” flaws) were disclosed in the Linux kernel’s AppArmor module. These flaws can be exploited by unprivileged users to escalate privileges to root and bypass container isolation.
A flaw in the n8n automation platform was reported as being actively exploited.
Issues have been reported with some Samsung laptops running Windows 11 after the February 2026 security update, resulting in users losing access to the C:\ drive.

Notable Threat Actor Activity

Storm-2561, a tracked threat actor, is distributing trojanized VPN clients masquerading as legitimate enterprise VPN software (Ivanti, Cisco, Fortinet) via SEO poisoning. These fake downloads are used to steal company VPN credentials.
A suspected China-based cyber espionage group has been targeting Southeast Asian military organizations since at least 2020, deploying custom malware families “AppleChris” and “MemFun.”
Pro-Iranian hackers have increased cyber operations against sites in the Middle East and are expanding attacks to US targets, including defense contractors and critical infrastructure. Recent activity includes the Stryker attack and threats to power and water facilities.
Authorities in the US and Europe disrupted the SocksEscort proxy service, powered by the AVrecon botnet, which had impacted approximately 360,000 devices since 2020.
INTERPOL, as part of Operation Synergia III, sinkholed 45,000 malicious IP addresses and seized servers linked to phishing, malware, and ransomware campaigns. The operation resulted in 94 arrests globally.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging SEO poisoning to distribute malware, as seen in the Storm-2561 campaign targeting VPN users.
Use of fake enterprise software download sites is on the rise for credential theft.
ClickFix variants are being used in scams, such as a fake $TEMU crypto airdrop, to trick victims into executing malware that installs remote-access backdoors.
Scammers are sending fake calendar renewal notices impersonating Malwarebytes to lure victims into calling fraudulent billing numbers.
Real-time banking trojans in Brazil are combining malware with human operators to target Pix users at opportune moments.
Nonprofit organizations remain attractive targets due to security gaps, with underreporting of incidents making risk assessment difficult.
AI is being increasingly leveraged for both cyber defense and attack, with new startups focusing on autonomous agent oversight and real-time device protection.
Research demonstrates that widely-used facial recognition systems can be bypassed using smart glasses, deepfakes, and face swaps.
Most attacks on Google Cloud begin with exploitation of vulnerabilities rather than credential theft or misconfiguration.

Regulatory or Policy Developments Affecting the Security Industry

Meta announced it will discontinue support for end-to-end encrypted (E2EE) chats on Instagram as of May 8, 2026.
Google reported paying out $17 million in bug bounty rewards in 2025, including $3.7 million for Chrome vulnerabilities and $3.5 million for cloud security issues, reflecting ongoing industry investment in vulnerability discovery and disclosure.

Cybersecurity Brief – 2026-03-12

Thu, 12 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a global medical technology company, was impacted by a wiper malware attack attributed to the Iran-linked Handala hacktivist group. The attackers claim to have wiped more than 200,000 devices, severely disrupting operations.
Michelin confirmed a data breach linked to an Oracle EBS attack, with cybercriminals leaking over 300GB of allegedly stolen files.
Bell Ambulance reported a data breach affecting 238,000 individuals, with stolen personal information including names, Social Security numbers, and driver’s license numbers.
Meta disabled over 150,000 accounts associated with scam centers in Southeast Asia as part of a coordinated global crackdown, and reported the removal of 10.9 million Facebook and Instagram accounts linked to criminal scam centers in the past year.

Newly Discovered Vulnerabilities

Two critical remote code execution (RCE) vulnerabilities in the n8n workflow automation platform were disclosed and patched. The flaws allow arbitrary command execution and exposure of stored credentials. CISA has added the RCE bug to its Known Exploited Vulnerabilities (KEV) catalog and ordered US federal agencies to patch affected systems, with over 24,700 instances still exposed.
An SQL injection vulnerability was identified in the Elementor Ally WordPress plugin, impacting over 250,000 sites and enabling potential theft of sensitive data.
CVE-2026-0866 (“Zombie Zip”) was published, affecting ZIP file processing.
Microsoft’s March Patch Tuesday addressed 84 vulnerabilities, including two publicly known zero-days and eight critical-rated issues. Vulnerabilities could allow privilege escalation and cause service crashes.
SAP released updates for two critical vulnerabilities enabling arbitrary code execution.
Fortinet, Ivanti, and Intel issued patches for high-severity vulnerabilities that could result in arbitrary code execution, privilege escalation, or authentication rate-limit bypass.

Notable Threat Actor Activity

The Iran-linked Handala group claimed responsibility for the wiper attack on Stryker, targeting over 200,000 devices.
The PhantomRaven supply-chain campaign launched a new wave of attacks on the npm registry, using 88 malicious packages to exfiltrate sensitive developer data.
Attackers compromised the xygeni/xygeni-action GitHub Action via tag poisoning, maintaining an active command-and-control implant for up to a week.
Chinese state-linked actors shifted focus to Qatari entities in response to Iranian conflict, conducting at least two targeted attacks.

Trends, Tools, or Tactics of Interest

Ransomware attacks surged by 50% in 2025, but the proportion of victims paying ransoms reached an all-time low.
Agentic web browsers, such as Perplexity’s Comet AI Browser, were demonstrated to be susceptible to phishing attacks in under four minutes, highlighting risks with AI-driven autonomous browsing.
Phishing campaigns are leveraging IPv6 tricks to obscure malicious links in emails, as seen in recent “free toothbrush” scams impersonating United Healthcare.
Sextortion emails are incorporating real passwords harvested from disposable inboxes to increase credibility.
Robocall scams are targeting individuals during tax season with fake relief program offers.
Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, including user-facing warnings and enhanced detection systems.
WhatsApp launched parent-managed accounts for pre-teens, providing parents with control over contacts and group participation.
Vulnerability management is evolving towards continuous telemetry, contextual prioritization, and agentic remediation in response to the increasing use of AI and autonomous agents in exploitation.

Regulatory or Policy Developments Affecting the Security Industry

The US Senate confirmed Joshua Rudd as head of both the NSA and US Cyber Command under the “dual-hat” leadership structure.
CISA mandated federal agencies to patch the actively exploited n8n RCE vulnerability.
Google completed its acquisition of cloud security firm Wiz, which will retain its brand under Google Cloud.