CSO Online
Dark Reading
Dark Web Informer
Europol
Krebs on Security
NSA
Reuters
Security Affairs
The Hacker News
Wired
ZDNET
U.S. CISA adds Microsoft SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog
Wed Mar 18 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added ([1, 2]) SharePoint and Zimbra flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: The first vulnerability added to the catalog, tracked […]
Security Affairs
Cloud Access Security Broker – ein Kaufratgeber
Thu Mar 19 2026
Lesen Sie, worauf es bei der Wahl eines Cloud Access Security Broker ankommt – und welche Anbieter was genau zu bieten haben.
CSO Online
OFAC Sanctions DPRK IT Worker Network Funding WMD Programs Through Fake Remote Jobs
Wed Mar 18 2026
The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned six individuals and two entities for their involvement in the Democratic People's Republic of Korea (DPRK) information technology (IT) worker scheme with an aim to defraud U.S. businesses and generate illicit revenue for the regime to fund its weapons of mass destruction (WMD) programs. "The North Korean...
The Hacker News
Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access
Wed Mar 18 2026
Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability in question is CVE-2026-20131 (CVSS score: 10.0), a case of insecure deserialization of user-supplied Java byte stream, which could allow an unauthenticated, remote attacker to...
The Hacker News
Researchers warn of unpatched, critical Telnetd flaw affecting all versions
Wed Mar 18 2026
CVE-2026-32746 is a critical flaw in GNU InetUtils telnetd that allows remote attackers to execute code with elevated privileges Cybersecurity company Dream disclosed a critical flaw, tracked as CVE-2026-32746 (CVSS score of 9.8), in GNU InetUtils telnetd that lets unauthenticated remote attackers execute code with elevated privileges. The issue stems from an out-of-bounds write in […]
Security Affairs
Hundreds of Millions of iPhones Can Be Hacked With a New Tool Found in the Wild
Wed Mar 18 2026
A powerful iPhone-hacking technique known as DarkSword has been discovered in use by Russian hackers. It can take over devices running iOS 18 that simply visit infected websites.
Wired
Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE
Wed Mar 18 2026
Cybersecurity researchers have disclosed a critical security flaw impacting the GNU InetUtils telnet daemon (telnetd) that could be exploited by an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability, tracked as CVE-2026-32746, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of out-of-bounds write in the LINEMODE Set...
The Hacker News
Reco targets AI agent blind spots with new security capability
Wed Mar 18 2026
SaaS security platform Reco has decided to address the “agent sprawl” challenge from the increased adoption of AI-driven tools by enterprises.
CSO Online
CVE-2026-3888: Ubuntu Desktop 24.04+ vulnerable to Root exploit
Wed Mar 18 2026
Ubuntu flaw CVE-2026-3888 lets attackers gain root via a systemd timing exploit, affecting Desktop 24.04+ with high severity. Qualys researchers found a high-severity flaw, tracked as CVE-2026-3888 (CVSS score of 7.8), in Ubuntu Desktop 24.04+, which allows attackers to exploit a systemd cleanup timing issue to escalate privileges to root and potentially take full control […]
Security Affairs
Claude Code Security and Magecart: Getting the Threat Model Right
Wed Mar 18 2026
When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI code scanning stops and client-side runtime execution begins. A detailed analysis of where Claude...
The Hacker News
9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors
Wed Mar 18 2026
Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hosts. The nine vulnerabilities, discovered by Eclypsium, span four different products from GL-iNet Comet RM-1, Angeet/Yeeso ES3 KVM, Sipeed NanoKVM, and JetKVM. The most severe of them allow...
The Hacker News
BSI moniert Software-Sicherheit im Gesundheitswesen
Wed Mar 18 2026
Schwachstellen bei Praxisverwaltungssystemen hätten zu Cyberangriffen führen können.
CSO Online
Join Our Next Livestream: The War Machine
Wed Mar 18 2026
On March 26, a panel of WIRED experts will dissect the defense tech industry’s impact on modern warfare. Submit your questions now.
Wired
Product Walkthrough: How Mesh CSMA Reveals and Breaks Attack Paths to Crown Jewels
Wed Mar 18 2026
Security teams today are not short on tools or data. They are overwhelmed by both. Yet within the terabytes of alerts, exposures, and misconfigurations – security teams still struggle to understand context: Q: Which exposures, misconfigurations, and vulnerabilities chain together to create viable attack paths to crown jewels? Even the most mature security teams can’t answer that...
The Hacker News
Can you prove the person on the other side is real?
Wed Mar 18 2026
In my role, I spend a lot of time thinking about what “trust” means when money, grief and identity collide.
CSO Online
Robotic surgery firm Intuitive reports data breach after targeted phishing attack
Wed Mar 18 2026
Intuitive suffered a phishing attack leading to a data breach exposing customer, employee, and corporate information. Intuitive is an American company that designs, manufactures, and sells robotic systems for minimally invasive surgery. Its most well-known products include the da Vinci Surgical System for general surgery and the Ion endoluminal system for precise procedures inside the […]
Security Affairs
Tracking the Iran War: A Month of Escalation and Regional Impact
Wed Mar 18 2026
Iran war likely prolonged, increasing cyber threats, energy disruption, and instability, with companies in the Middle East facing higher risk. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Iran)
Security Affairs
ClickFix treibt neue Infostealer-Kampagnen an
Wed Mar 18 2026
ClickFix-Kampagnen werden immer raffinierter und zielen verstärkt auf WordPress-Webseiten.
CSO Online
Cybersecurity and privacy priorities for 2026: The legal risk map
Wed Mar 18 2026
Escalating cybersecurity threats and growing privacy concerns lurk around every corner these days.
CSO Online
Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit
Wed Mar 18 2026
A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS score: 7.8), the issue could allow an attacker to seize control of a susceptible system. "This flaw (CVE-2026-3888) allows an unprivileged local attacker to escalate privileges to full root access...
The Hacker News
CISOs rethink their data protection strategies
Wed Mar 18 2026
Scott Kopcha witnessed what CISOs everywhere are seeing: employees eager to use artificial intelligence, whether through public models or custom AI tools, accessing company data at a breathtaking rate
CSO Online
Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS
Wed Mar 18 2026
Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), has been described as a cross-origin issue in WebKit's Navigation API that could be exploited to bypass the same-origin policy when processing maliciously crafted web content. The...
The Hacker News
Die besten Hacker-Filme
Wed Mar 18 2026
Vorsicht, dieses Film-Listicle kann zu Prokrastination verführen!Nomad Soul | shutterstock.
CSO Online
EU sanctions Chinese and Iranian actors over cyberattacks on critical infrastructure
Tue Mar 17 2026
EU sanctions Chinese and Iranian firms and individuals for cyberattacks targeting critical infrastructure and over 65,000 devices across member states. The Council of the European Union has imposed sanctions on three companies and two individuals linked to cyberattacks against EU countries and partners. “The Council adopted today restrictive measures against three entities and two individuals responsible for cyber-attacks carried […]
Security Affairs
RondoDox botnet expands arsenal targeting 174 flaws, and hits 15,000 daily exploit attempts
Tue Mar 17 2026
RondoDox botnet targets 174 flaws, reaching 15,000 daily exploit attempts in a more focused and strategic campaign. RondoDox botnet is ramping up attacks, targeting 174 vulnerabilities with up to 15,000 daily exploitation attempts in a more focused and strategic campaign, Bitsight reported. “We gathered all these exploit attempts (identifiable by indicators like the User-Agent and […]
Security Affairs
Nvidia NemoClaw promises to run OpenClaw agents securely
Tue Mar 17 2026
In the few short weeks since OpenClaw became the biggest story in agentic AI, it has been dogged by concerns that it is not secure enough to be safely let loose in enterprises.
CSO Online
AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
Tue Mar 17 2026
Cybersecurity researchers have disclosed details of a new method for exfiltrating sensitive data from artificial intelligence (AI) code execution environments using domain name system (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter's sandbox mode permits outbound DNS queries that an attacker can exploit to enable interactive shells...
The Hacker News
LeakNet Ransomware Uses ClickFix via Hacked Sites, Deploys Deno In-Memory Loader
Tue Mar 17 2026
The ransomware operation known as LeakNet has adopted the ClickFix social engineering tactic delivered through compromised websites as an initial access method. The use of ClickFix, where users are tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods for obtaining initial access, such as through stolen credentials...
The Hacker News
CL-STA-1087 targets military capabilities since 2020
Tue Mar 17 2026
China-linked APT group CL-STA-1087 has targeted Southeast Asian militaries since 2020 using AppleChris and MemFun. A suspected China-linked espionage campaign, tracked as CL-STA-1087, has targeted Southeast Asian military organizations since at least 2020, using AppleChris and MemFun malware. “The activity demonstrated strategic operational patience and a focus on highly targeted intelligence collection, rather than bulk […]
Security Affairs
Cyber-Attacken fluten Eon-Netz: Angriffe verzehnfacht
Tue Mar 17 2026
Eon trägt eine große Verantwortung für die Energieversorgung in Deutschland.
CSO Online
AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds
Tue Mar 17 2026
A majority of security leaders are struggling to defend AI systems with tools and skills that are not fit for the challenge, according to the AI and Adversarial Testing Benchmark Report 2026 from Pentera. The report, based on a survey of 300 US CISOs and senior security leaders, examines how organizations are securing AI infrastructure and highlights critical gaps tied to skills shortages and...
The Hacker News
AWS Bedrock’s ‘isolated’ sandbox comes with a DNS escape hatch
Tue Mar 17 2026
AWS’ promise of “complete isolation” for agentic AI workflows on Bedrock is facing scrutiny after researchers found its sandbox mode isn’t as sealed as advertised.
CSO Online
From Windows to macOS: ClickFix attacks shift tactics with ChatGPT-based lures
Tue Mar 17 2026
ClickFix campaigns are evolving, with attackers increasingly targeting macOS users and deploying more advanced infostealers, according to Sophos researchers. ClickFix is a growing social engineering technique that tricks users into manually executing malicious commands, bypassing traditional protections. Once mainly targeting Windows, it is now increasingly affecting macOS, with recent campaigns deploying infostealers like AMOS and […]
Security Affairs
Attack on Stryker’s Microsoft environment wiped employee devices without malware
Tue Mar 17 2026
The recent cyberattack on Stryker wiped tens of thousands of employee devices through its Microsoft environment, and systems are still offline. A recent cyberattack on medical technology giant Stryker targeted its internal Microsoft environment and remotely wiped tens of thousands of employee devices without using malware. The company confirmed that its medical devices were not […]
Security Affairs
Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web
Tue Mar 17 2026
Customer conversations with chatbots can include contact information and personal details that make it easier for scammers to launch phishing attacks and commit fraud.
Wired
Konni Deploys EndRAT Through Phishing, Uses KakaoTalk to Propagate Malware
Tue Mar 17 2026
North Korean threat actors have been observed sending phishing to compromise targets and obtain access to a victim's KakaoTalk desktop application to distribute malicious payloads to certain contacts. The activity has been attributed by South Korean threat intelligence firm Genians to a hacking group referred to as Konni. "Initial access was achieved through a spear-phishing email disguised as a...
The Hacker News
Runtime: The new frontier of AI agent security
Tue Mar 17 2026
AI agents are already operating inside enterprise networks, quietly doing some of the work employees once handled themselves — writing code, drafting emails, retrieving files, and connecting to intern
CSO Online
6 Risk-Assessment-Frameworks im Vergleich
Tue Mar 17 2026
Mit dem richtigen Framework lassen sich Risiken besser ergründen.
CSO Online
U.S. CISA adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog
Mon Mar 16 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in Wing FTP Server to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Wing FTP Server flaw, tracked as CVE-2025-47813 (CVSS score of 4.3), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2025-47813 is an information disclosure vulnerability affecting Wing FTP […]
Security Affairs
Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets
Mon Mar 16 2026
Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to previous Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family […]
Security Affairs
CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths
Tue Mar 17 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that leaks the installation path of the application under certain conditions...
The Hacker News
Was ist ein Keylogger?
Tue Mar 17 2026
Keylogger sind Malware der alten Schule.
CSO Online
GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
Mon Mar 16 2026
The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages the stolen GitHub tokens to inject malware into hundreds of Python repositories. "The attack targets Python projects — including Django apps, ML research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files like setup.py, main.py, and app.py," StepSecurity said. "Anyone who runs...
The Hacker News
FBI launches inquiry into Steam games spreading malware
Mon Mar 16 2026
The FBI is asking gamers who installed malware-infected Steam games between May 2024 and January 2026 to come forward as part of an ongoing investigation. The FBI is seeking gamers who downloaded Steam games later found to contain malware. According to a notice from the FBI’s Seattle Division, investigators are trying to identify victims who […]
Security Affairs
Former Germany’s foreign intelligence VP hit in Signal account takeover campaign
Mon Mar 16 2026
Former BND VP Arndt Freytag von Loringhoven was targeted in a Signal cyberattack, part of a wave hitting officials and politicians in Germany. A cyberattack targeting Signal and WhatsApp users has hit high-ranking German officials, including former BND Vice President Arndt Freytag von Loringhoven. The official reported being contacted by someone posing as Signal support […]
Security Affairs
⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More
Mon Mar 16 2026
Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too close to real life, too. There’s a good mix here: weird abuse of trusted stuff, quiet infrastructure ugliness,...
The Hacker News
Why Security Validation Is Becoming Agentic
Mon Mar 16 2026
If you run security at any reasonably complex organization, your validation stack probably looks something like this: a BAS tool in one corner. A pentest engagement, or maybe an automated pentesting product, in another. A vulnerability scanner feeding an attack surface management platform somewhere else. Each tool gives you a slice of the picture. None of them talks to each other in any...
The Hacker News
ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
Mon Mar 16 2026
Three different ClickFix campaigns have been found to act as a delivery vector for the deployment of a macOS information stealer called MacSync. "Unlike traditional exploit-based attacks, this method relies entirely on user interaction – usually in the form of copying and executing commands – making it particularly effective against users who may not appreciate the implications of running...
The Hacker News
Advanced Protection Mode in Android 17 prevents apps from misusing Accessibility Services
Mon Mar 16 2026
Android 17 will block non-accessibility apps from using the Accessibility API under Advanced Protection Mode to reduce malware abuse. Android 17 introduces a new security feature in Advanced Protection Mode (AAPM) that blocks apps without accessibility functions from accessing the Accessibility API. The change, first reported by Android Authority and included in Android 17 Beta […]
Security Affairs
Open VSX extensions hijacked: GlassWorm malware spreads via dependency abuse
Mon Mar 16 2026
Threat actors are abusing extension dependency relationships in the Open VSX registry to indirectly deliver malware in a new phase of the GlassWorm supply-chain campaign.
CSO Online
Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk
Mon Mar 16 2026
Security researchers at Qualys have disclosed nine vulnerabilities in AppArmor, the Linux Security Module that ships enabled by default across Ubuntu, Debian, and SUSE distributions.
CSO Online
DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage
Mon Mar 16 2026
Ukrainian entities have emerged as the target of a new campaign likely orchestrated by threat actors linked to Russia, according to a report from S2 Grupo's LAB52 threat intelligence team. The campaign, observed in February 2026, has been assessed to share overlaps with a prior campaign mounted by Laundry Bear (aka UAC-0190 or Void Blizzard) aimed at Ukrainian defense forces with a malware...
The Hacker News
Unprivileged users could exploit AppArmor bugs to gain root access
Mon Mar 16 2026
Researchers found nine “CrackArmor” flaws in Linux AppArmor that could let unprivileged users bypass protections, gain root privileges, and weaken container isolation. Qualys researchers disclosed nine vulnerabilities, collectively tracked as CrackArmor, in the Linux kernel’s AppArmor module. The flaws have existed since 2017 and could allow unprivileged users to bypass protections, escalate privileges to root, […]
Security Affairs
Models Are Applying to Be the Face of AI Scams
Mon Mar 16 2026
Dozens of Telegram channels reviewed by WIRED include job listings for “AI face models.” The (mostly) women who land these gigs are likely being used to dupe victims out of their money.
Wired
What it takes to win that CSO role
Mon Mar 16 2026
CSO and CISO roles are among the hardest to fill in IT.
CSO Online
ClickFix techniques evolve in new infostealer campaigns
Mon Mar 16 2026
Cybercriminals are combining compromised websites with increasingly sophisticated ClickFix social engineering lures to deliver new infostealer malware, with one campaign alone weaponizing more than 25
CSO Online
Payload Ransomware claims the hack of Royal Bahrain Hospital
Sun Mar 15 2026
The Payload Ransomware group claims to have breached the Royal Bahrain Hospital (RBH), a leading healthcare facility in Bahrain. The Payload Ransomware group claims to have hacked the Royal Bahrain Hospital (RBH) and stolen 110 GB of data. The ransomware gang added the healthcare facility to its Tor data leak site and published the images […]
Security Affairs
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 88
Sun Mar 15 2026
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages Inside Coruna: Reverse Engineering a Nation-State iOS Exploit Kit From JavaScript ClipXDaemon: Autonomous X11 Clipboard Hijacker Delivered via Bincrypter-Based Loader New A0Backdoor Linked to […]
Security Affairs
Security Affairs newsletter Round 567 by Pierluigi Paganini – INTERNATIONAL EDITION
Sun Mar 15 2026
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Starbucks data breach impacts 889 employees Storm-2561 lures victims to spoofed VPN sites to harvest corporate […]
Security Affairs
Starbucks data breach impacts 889 employees
Sat Mar 14 2026
Starbucks disclosed a breach after phishing attacks on its employee portal led to unauthorized access to Partner Central accounts, exposing staff data. Starbucks reported a data breach affecting hundreds of employees after phishing attacks targeted its Partner Central employee portal. The security breach was detected on February 6, the incident involved unauthorized access to staff […]
Security Affairs
Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse
Mon Mar 16 2026
Google is testing a new security feature as part of Android Advanced Protection Mode (AAPM) that prevents certain kinds of apps from using the accessibility services API. The change, incorporated in Android 17 Beta 2, was first reported by Android Authority last week. AAPM was introduced by Google in Android 16, released last year. When enabled, it causes the device to enter a heightened...
The Hacker News
GenAI-Security als Checkliste
Mon Mar 16 2026
Das Open Web Application Security Project (OWASP) gibt Unternehmen eine Checkliste für (mehr) GenAI-Sicherheit an die Hand.
CSO Online
OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration
Sat Mar 14 2026
China's National Computer Network Emergency Response Technical Team (CNCERT) has issued a warning about the security stemming from the use of OpenClaw (formerly Clawdbot and Moltbot), an open-source and self-hosted autonomous artificial intelligence (AI) agent. In a post shared on WeChat, CNCERT noted that the platform's "inherently weak default security configurations," coupled with its...
The Hacker News
Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins
Sat Mar 14 2026
Attackers linked to Storm-2561 use SEO-poisoned search results to lure users to fake Ivanti, Cisco, and Fortinet VPN sites that steal corporate login credentials. In mid-January 2026, Microsoft Defender Experts uncovered a credential-theft campaign attributed to Storm-2561. Threat actor is spreading fake enterprise VPN clients impersonating Ivanti, Cisco, and Fortinet software. By poisoning search engine […]
Security Affairs
Interpol – Operation Synergia III leads to 45,000 malicious IPs dismantled and 94 arrests worldwide
Sat Mar 14 2026
INTERPOL dismantled 45,000 malicious IPs and servers and arrested 94 suspects in a global cybercrime operation. INTERPOL announced a global cybercrime operation (codenamed Operation Synergia III) involving 72 countries that dismantled 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware. The international law enforcement operation led to 94 arrests, 110 ongoing investigations, […]
Security Affairs
U.S. CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog
Fri Mar 13 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Google Chrome flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the flaws added to the catalog: This week, Google released security updates to address two high-severity vulnerabilities, […]
Security Affairs
GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers
Sat Mar 14 2026
Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing extensionPack and extensionDependencies to turn initially standalone-looking extensions into transitive...
The Hacker News
A Hacker Accidentally Broke Into the FBI’s Epstein Files
Sat Mar 14 2026
Plus: A porn-quitting app exposed the masturbation habits of hundreds of thousands of users, Russian hackers are trying to take over people’s Signal accounts, and more.
Wired
Google warns of two actively exploited Chrome zero days
Fri Mar 13 2026
Threat actors are exploiting two high severity zero day vulnerabilities in the Chrome browser that experts say IT teams must patch immediately.
CSO Online
Hackers targeted Poland’s National Centre for Nuclear Research
Fri Mar 13 2026
Hackers targeted Poland’s National Centre for Nuclear Research, but security systems detected and blocked the attack before any damage. The National Centre for Nuclear Research in Poland reported a cyberattack on its IT infrastructure. The intrusion attempt was quickly detected by security systems, allowing staff to secure the targeted systems and prevent any operational impact. […]
Security Affairs
Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware
Fri Mar 13 2026
A suspected China-based cyber espionage operation has targeted Southeast Asian military organizations as part of a state-sponsored campaign that dates back to at least 2020. Palo Alto Networks Unit 42 is tracking the threat activity under the moniker CL-STA-1087, where CL refers to cluster, and STA stands for state-backed motivation. "The activity demonstrated strategic operational patience and...
The Hacker News
Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026
Fri Mar 13 2026
Meta has announced plans to discontinue support for end-to-end encryption (E2EE) for chats on Instagram after May 8, 2026. "If you have chats that are impacted by this change, you will see instructions on how you can download any media or messages you may want to keep," the social media giant said in a help document. "If you're on an older version of Instagram, you may also need to update the...
The Hacker News
Cyber criminals too are working from home… your home
Fri Mar 13 2026
The FBI is so concerned about the threat of residential proxy attacks and the dangers posed by cyber criminals using the technique that it has posted guidance on its website.
CSO Online
US and European authorities disrupt socksEscort proxy service tied to AVrecon botnet
Fri Mar 13 2026
Authorities in the US and Europe disrupted the SocksEscort proxy service, which used the AVrecon botnet and infected about 360,000 devices since 2020. Law enforcement agencies in the US and Europe have disrupted SocksEscort, a malicious proxy service powered by the AVrecon botnet. Active since 2020, the service hijacked roughly 360,000 devices and allowed cybercriminals […]
Security Affairs
INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime
Fri Mar 13 2026
INTERPOL on Friday announced the takedown of 45,000 malicious IP addresses and servers used in connection with phishing, malware, and ransomware campaigns, as part of the agency's ongoing efforts to dismantle criminal networks, disrupt emerging threats, and safeguard victims from scams. The effort is part of an international law enforcement operation that involved 72 countries and territories....
The Hacker News
Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials
Fri Mar 13 2026
Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques. "The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients...
The Hacker News
Investigating a New Click-Fix Variant
Fri Mar 13 2026
Disclaimer: This report has been prepared by the Threat Research Center to enhance cybersecurity awareness and support the strengthening of defense capabilities. It is based on independent research and observations of the current threat landscape available at the time of publication. The content is intended for informational and preparedness purposes only. Read more blogs around threat...
The Hacker News
AI-assisted Slopoly malware powers Hive0163’s ransomware campaigns
Fri Mar 13 2026
The Hive0163 group used AI-assisted malware called Slopoly to maintain persistent access in ransomware attacks. IBM X-Force researchers report that the financially motivated group Hive0163 is using AI-assisted malware named Slopoly to maintain persistent access during ransomware attacks, showing how threat actors can quickly build new malware frameworks using AI. Hive0163 is a threat actor […]
Security Affairs
Google fixed two new actively exploited flaws in the Chrome browser
Fri Mar 13 2026
Google addressed two high-severity vulnerabilities in the Chrome browser that have been exploited in attacks in the wild. Google has released security updates to address two high-severity vulnerabilities, tracked as CVE-2026-3909 and CVE-2026-3910, in the Chrome browser. The company is aware of attacks in the wild exploiting both flaws. “Google is aware that exploits for […]
Security Affairs
Beyond File Servers: Securing Unstructured Data in the Era of AI
Fri Mar 13 2026
File servers still exist for legacy storage and governance, but most modern workflows now happen in collaboration tools, code platforms, chats, and AI systems. File servers remain, but they are no longer central to operations. They still appear important on paper: legacy project shares with strict permissions, legal drives with structured folders, and network areas […]
Security Affairs
Veeam warns admins to patch now as critical RCE flaws hit Backup & Replication
Fri Mar 13 2026
Backup vendor Veeam has released security updates to patch multiple vulnerabilities in its widely used Backup and Replication platform, including three critical flaws that could allow authenticated us
CSO Online
Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8
Fri Mar 13 2026
Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The list of vulnerabilities is as follows - CVE-2026-3909 (CVSS score: 8.8) - An out-of-bounds write vulnerability in the Skia 2D graphics library that allows a remote attacker to perform out-of-bounds memory access via a crafted HTML...
The Hacker News
Hybrid resilience: Designing incident response across on-prem, cloud and SaaS without losing your mind
Fri Mar 13 2026
I used to think hybrid incidents would get easier once we standardized on “one tool”: one monitoring platform, one ticketing system, one on-call process.
CSO Online
Storm-2561 targets enterprise VPN users with SEO poisoning, fake clients
Fri Mar 13 2026
Microsoft has warned enterprises that cybercriminal group Storm-2561 is hijacking search engine results to serve trojanized VPN clients, stealing corporate credentials, and then covering its tracks be
CSO Online
Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation
Fri Mar 13 2026
Cybersecurity researchers have disclosed multiple security vulnerabilities within the Linux kernel's AppArmor module that could be exploited by unprivileged users to circumvent kernel protections, escalate to root, and undermine container isolation guarantees. The nine confused deputy vulnerabilities have been collectively codenamed CrackArmor by the Qualys Threat Research Unit (TRU). The...
The Hacker News
The cyber perimeter was never dead. We just abandoned it.
Fri Mar 13 2026
Industry has comforted itself with the idea that the perimeter is dead.
CSO Online
Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries
Fri Mar 13 2026
A court-authorized international law enforcement operation has dismantled a criminal proxy service named SocksEscort that enslaved thousands of residential routers worldwide into a botnet for committing large-scale fraud. "SocksEscort infected home and small business internet routers with malware," the U.S. Department of Justice (DoJ) said. "The malware allowed SocksEscort to direct internet...
The Hacker News
Veeam Patches 7 Critical Backup & Replication Flaws Allowing Remote Code Execution
Fri Mar 13 2026
Veeam has released security updates to address multiple critical vulnerabilities in its Backup & Replication software that, if successfully exploited, could result in remote code execution. The vulnerabilities are as follows - CVE-2026-21666 (CVSS score: 9.9) - A vulnerability that allows an authenticated domain user to perform remote code execution on the Backup Server. CVE-2026-21667 (...
The Hacker News
10 Kennzahlen, die CISOs weiterbringen
Fri Mar 13 2026
Geht es um Security-Kennzahlen, sollten CISOs sich auf das Wesentliche fokussieren.
CSO Online
Telus Digital hit with massive data breach
Fri Mar 13 2026
Telus Digital, which provides business process outsourcing (BPO) services to a range of organizations worldwide, has been hit with a massive cyberattack conducted by extortion group ShinyHunters The g
CSO Online
Medical giant Stryker crippled after Iranian hackers remotely wipe computers
Thu Mar 12 2026
A major cyberattack on US medical supplies giant Stryker has resulted in thousands of devices being remotely wiped, after a pro-Iranian hacking group may have compromised the company’s Microsoft Intun
CSO Online
US Lawmakers Move to Kill the FBI’s Warrantless Wiretap Access
Thu Mar 12 2026
A bipartisan bill would force the FBI to get a warrant to read Americans’ messages and ban the federal purchase of commercial data on US residents ahead of a critical April deadline.
Wired
Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays
Thu Mar 12 2026
Cybersecurity researchers have disclosed details of a new banking malware targeting Brazilian users that's written in Rust, marking a significant departure from other known Delphi-based malware families associated with the Latin American cybercrime ecosystem. The malware, which is designed to infect Windows systems and was first discovered last month, has been codenamed VENON by Brazilian...
The Hacker News
Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks
Thu Mar 12 2026
Cybersecurity researchers have disclosed details of a suspected artificial intelligence (AI)-generated malware codenamed Slopoly put to use by a financially motivated threat actor named Hive0163. "Although still relatively unspectacular, AI-generated malware such as Slopoly shows how easily threat actors can weaponize AI to develop new malware frameworks in a fraction of the time it used to take...
The Hacker News
How ‘Handala’ Became the Face of Iran’s Hacker Counterattacks
Thu Mar 12 2026
Amid a paralyzing breach of medical tech firm Stryker, the group has come to represent Iran's use of “hacktivism” as cover for chaotic, retaliatory state-sponsored cyberattacks.
Wired
Apple issues emergency fixes for Coruna flaws in older iOS versions
Thu Mar 12 2026
Apple released iOS 16.7.15 and 15.8.7 updates for older iPhones and iPads to patch vulnerabilities linked to the Coruna exploits. Apple has released security updates for legacy devices, rolling out iOS and iPadOS 16.7.15 and 15.8.7 to address vulnerabilities tied to the recently disclosed Coruna exploits. The patches aim to protect older iPhone and iPad […]
Security Affairs
Critical SQL Injection bug in Ally plugin threatens 400,000+ WordPress sites
Thu Mar 12 2026
An unauthenticated SQL injection flaw (CVE-2026-2413) in the Ally WordPress plugin, used on 400K+ sites, could allow attackers to steal sensitive data. An unauthenticated SQL injection flaw, tracked as CVE-2026-2413 (CVSS score 7.5), in Ally plugin could allow attackers to steal sensitive data. The offensive security engineer Drew Webber at Acquia discovered the vulnerability on […]
Security Affairs
How to Scale Phishing Detection in Your SOC: 3 Steps for CISOs
Thu Mar 12 2026
Phishing has quietly turned into one of the hardest enterprise threats to expose early. Instead of crude lures and obvious payloads, modern campaigns rely on trusted infrastructure, legitimate-looking authentication flows, and encrypted traffic that conceals malicious behavior from traditional detection layers. For CISOs, the priority is now clear: scale phishing detection in a way that helps...
The Hacker News
ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More
Thu Mar 12 2026
Another Thursday, another pile of weird security stuff that somehow happened in just seven days. Some of it is clever. Some of it is lazy. A few bits fall into that uncomfortable category of “yeah… this is probably going to show up in real incidents sooner than we’d like.” The pattern this week feels familiar in a slightly annoying way. Old tricks are getting polished. New research shows how...
The Hacker News
PhantomRaven returns to npm with 88 bad packages
Thu Mar 12 2026
Last year’s “PhantomRaven” supply-chain campaign is back, with security researchers uncovering 88 new malicious packages in what they describe as the second, third, and fourth waves of the operation.
CSO Online