The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert urging organizations to harden their endpoint management system configurations following a cyberattack on Stryker Corporation, a U.S.-based medical technology firm, on March 11, 2026. The attack targeted…
Category: Cyber Security News
CISA Warns of Zimbra Collaboration Suite Vulnerability Exploited in Attacks
CISA has added a high-severity vulnerability affecting the Zimbra Collaboration Suite (ZCS) to its Known Exploited Vulnerabilities (KEV) catalog. Tracked as CVE-2025-66376, this security flaw is currently facing active exploitation in the wild. Organizations utilizing Zimbra must urgently prioritize remediation…
Horabot Banking Trojan Resurfaces in Mexico With Multi-Stage Phishing and Email Worm Tactics
A well-known banking trojan called Horabot has resurfaced in an active campaign targeting users across Mexico, combining a multi-stage infection chain with an email worm that turns every compromised machine into a phishing relay. The threat bundles a Delphi-based banking…
Claude Vulnerabilities Allow Data Exfiltration and User Redirection to Malicious Sites
Three chained vulnerabilities in Claude.ai, Anthropic’s widely used AI assistant, that together allow attackers to silently exfiltrate sensitive conversation data and redirect unsuspecting users to malicious websites, all without requiring any integrations, tools, or MCP server configurations. The vulnerability chain,…
Malicious ‘Pyronut’ Package Backdoors Telegram Bots With Remote Code Execution
A malicious Python package named pyronut has been discovered on the Python Package Index (PyPI), targeting developers who build Telegram bots by impersonating the popular pyrogram framework. Rather than relying on typosquatting — where a name resembles a legitimate one — the threat actor…
‘Vibe-Coded’ Malware Campaign Uses Fake Tools, CDNs and File Hosts to Infect Users
The rise of AI-assisted coding has brought real value to developers around the world, but it has also opened a new door for cybercriminals to exploit. A concept known as “vibe coding” — where users simply describe what they want…
Backdoored Open VSX Extension Used GitHub Downloader to Deploy RAT and Stealer
A popular code editor extension listed on the Open VSX registry was discovered carrying hidden malware that silently fetches and runs a remote access trojan (RAT) and a full infostealer directly onto developer machines without any visible warning sign. The…
CISA Warns of Microsoft SharePoint Vulnerability Exploited in Attacks
A critical security flaw in Microsoft SharePoint has been identified as actively exploited, and on March 18, 2026, the vulnerability was officially added to the Known Exploited Vulnerabilities (KEV) catalog. This addition confirms that threat actors are actively exploiting the…
WaterPlum Deploys New ‘StoatWaffle’ Malware in VSCode-Based Supply Chain Campaign
A North Korea-linked hacking group known as WaterPlum has introduced a dangerous new malware called StoatWaffle, deploying it through compromised Visual Studio Code (VSCode) repositories disguised as legitimate blockchain development projects to silently infiltrate developer machines. WaterPlum has been running…
New SnappyClient Implant Combines Remote Access, Data Theft and Advanced Evasion
A dangerous new malware implant called SnappyClient has quietly emerged as a serious threat to Windows users, combining remote access, data theft, and sophisticated evasion techniques in one compact C++ package. First spotted in December 2025, this command-and-control (C2) framework…
The High Cost of Slow Triage: How to Make Tier 1 the Fastest Layer in Your SOC
Why do so many SOCs still struggle to move quickly even with strong detection tools in place? In many cases, the real bottleneck is Tier 1 triage. When alerts take too long to validate, resources are wasted on noise, senior teams…
New iOS Exploit With Advanced iPhone Hacking Tools Attacking Users to Steal Personal Data
A sophisticated full-chain iOS exploit kit dubbed DarkSword, actively deployed by multiple commercial surveillance vendors and state-sponsored threat actors since at least November 2025 to steal sensitive personal data from iPhone users across four countries. DarkSword is a full-chain iOS exploit…
Cisco Firewall 0-day Vulnerability Exploited in the Wild to Deploy Interlock Ransomware
An active campaign by the Interlock ransomware group is exploiting a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) Software. Cisco disclosed the flaw on March 4, 2026; it allows unauthenticated remote attackers to execute arbitrary Java…
Apple WebKit Vulnerability Enables Malicious Web Content Bypass on iOS and macOS
Apple has released critical security patches to address a high-severity WebKit vulnerability that allows maliciously crafted web content to bypass the Same Origin Policy. Released on March 17, 2026, these updates apply to the latest versions of Apple’s mobile and…
UIDAI Launches Bug Bounty Programme to Strengthen Aadhaar Security
The Unique Identification Authority of India (UIDAI) has officially launched its first structured Bug Bounty Programme. This initiative aims to enhance the security posture of the Aadhaar ecosystem, which serves as the foundational digital identity platform for over a billion…
OpenAI Launches GPT-5.4 Mini and Nano to Provide Answers 2X Faster
OpenAI has officially launched GPT-5.4 mini and GPT-5.4 nano, releasing its most capable small models designed to handle high-volume, latency-sensitive workloads. The new mini iteration offers a significant performance upgrade over the previous GPT-5 mini across reasoning, coding, tool use,…
LeakNet Scales Ransomware Operations With ClickFix Lures and Stealthy Deno Loader
A ransomware group known as LeakNet has been quietly building a more dangerous attack strategy. Until recently, the group averaged about three victims per month — but new evidence shows it is scaling up fast, adding new tools that most…
ScreenConnect Vulnerability Allows Hackers to Extract Unique Machine Keys and Hijack Sessions
ConnectWise has issued an urgent security advisory for its ScreenConnect remote desktop software, disclosing a critical cryptographic vulnerability that could allow unauthenticated attackers to extract server-level machine keys and hijack session authentication. The flaw, tracked as CVE-2026-3564, affects all ScreenConnect…
FancyBear Server Exposure Reveals Stolen Credentials, 2FA Secrets and NATO-Linked Targets
A serious operational security failure by Russian state-linked hacking group FancyBear has given security researchers an unusually clear view into an active espionage campaign targeting government and military organizations across Europe. On March 11, 2026, threat intelligence firm Hunt.io published…
New Malware Campaigns Turn Network Devices Into DDoS Nodes and Crypto-Mining Bots
Network security has taken another hard hit. Two previously unknown malware strains have emerged, quietly turning routers, IoT devices, and enterprise network equipment into weapons for large-scale distributed denial-of-service (DDoS) attacks and cryptocurrency mining operations. These campaigns mark a clear…