CyberPulse

Scattered LAPSUS$ Hunters — the cybercrime supergroup behind over 1.5 billion stolen records and the Jaguar Land Rover ransomware attack — is now recruiting women for voice phishing campaigns targeting IT help desks, paying $500-$1,000 per call with scripts provided. CISA simultaneously issued an emergency directive giving federal agencies 48 hours to patch actively exploited Cisco SD-WAN vulnerab...

State-linked actors are actively targeting internet-exposed Rockwell/Allen-Bradley PLCs on critical infrastructure networks, moving the threat from IT management planes into the operational technology layer. A second AI workflow platform — Flowise (CVE-2025-59528, max severity) — is under active exploitation for arbitrary code execution, two weeks after Langflow. Docker Engine CVE-2026-34040 (CVSS...

Amazon Threat Intelligence confirmed that the Interlock ransomware group exploited CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center as a zero-day for 36 days before Cisco's March 4 patch — gaining unauthenticated root access on enterprise firewalls. Amazon's MadPot honeypot network caught the exploitation and a misconfigured server exposed Interlock's complete attack toolkit....

A state intelligence-linked threat actor is conducting an active password-spraying campaign against Microsoft 365 environments across the Gulf, impacting 300+ organizations in three distinct attack waves on March 3, 13, and 23 — each separated by exactly 10 days. Targets include government, municipalities, technology, transportation, and energy. A state-sponsored actor deployed BRICKSTORM kernel i...

Mandiant's M-Trends 2026 reports adversary handoff times have collapsed to 22 seconds. CrowdStrike's Global Threat Report puts average eCrime breakout at 29 minutes. Six new KEV additions today include FortiClient EMS CVE-2026-21643, Adobe Acrobat Reader, Microsoft Exchange, and Windows CLFS — all under active exploitation with an April 27 patch deadline. A major AI company rotated macOS certifica...

Google released emergency Chrome updates for two actively exploited zero-days — CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 arbitrary code execution), both CVSS 8.8. The GlassWorm supply chain campaign escalated with 72+ malicious Open VSX extensions discovered targeting developers and AI coding assistants using transitive dependency poisoning. The medical technology wiper incid...

TeamPCP struck Checkmarx for the second time in a month, poisoning official Docker Hub images (KICS), VS Code extensions, and GitHub Actions — then reaching Bitwarden CLI v2026.4.0 through the compromised pipeline. The attack is a self-propagating worm using stolen GitHub credentials to inject malicious workflows across repositories. Blast radius spans Docker Hub, VS Code, Open VSX, GitHub Actions...

A board-level strategic briefing synthesizing the three defining risk patterns of March 2026. First: cyber operations are inseparable from geopolitical conflict — the medical technology wiper that destroyed 80,000 devices through weaponized endpoint management demonstrated that trusted infrastructure can become the attack vector. Second: the developer supply chain is the new critical infrastructur...

Google released Chrome updates fixing 21 vulnerabilities including CVE-2026-5281, a zero-day in the WebGPU Dawn component already exploited in the wild and added to the KEV catalog — the third Chrome zero-day cycle in three weeks. Google attributed the Axios npm supply chain compromise to a state-linked threat cluster, confirming that the developer supply chain is now a battleground for both crimi...

Today is the KEV remediation deadline for the F5 BIG-IP APM vulnerability CVE-2025-53521 (CVSS 9.3), reclassified from DoS to RCE after confirmed exploitation. A critical flaw in Open VSX's pre-publish scanning pipeline was disclosed — scanner failures were silently interpreted as "no scanners configured," allowing malicious extensions to bypass all vetting and explaining how the GlassWorm campaig...

IBM's 2026 X-Force Threat Intelligence Index reveals that 56% of the nearly 40,000 vulnerabilities tracked in 2025 required no authentication to exploit — explaining why unauthenticated flaws like the Cisco SD-WAN bypass, the MSHTML zero-day, and the Coruna iOS exploit kit all converged in the same week. Exploitation of public-facing applications surged 44% to become the leading initial access vec...

The TeamPCP supply chain campaign has triggered a law enforcement high-priority alert and the Trivy vulnerability (CVE-2026-33634) has been added to the KEV catalog. The cascade now spans six platforms — GitHub Actions, Docker Hub, PyPI, npm, VS Code extensions, and cloud communications SDKs — after the Telnyx Python package was compromised using audio steganography to conceal malware in a .WAV fi...

A stolen civil servant credential gave an attacker weeks of unrestricted access to FICOBA — France's national bank account registry containing every bank account opened in the country. 1.2 million accounts were browsed, exposing IBANs, names, addresses, and tax IDs. No MFA, no anomaly detection, no rate limiting. The breach creates immediate SEPA direct debit fraud risk across the EU. Phishing cam...

Palo Alto Unit 42 published a live threat brief confirming sixty hacktivist groups are now active in coordinated cyber operations, with allied foreign collectives joining the fight. An Electronic Operations Room was established within hours of the strikes to synchronize targeting across the coalition. Check Point Research confirmed that Handala Hack is routing attacks through Starlink IP ranges fr...

The mean time from CVE publication to working exploit has collapsed to approximately 10 hours in 2026 — down from 56 days in 2024 and 23 days in 2025, across 3,532 CVE-exploit pairs. Google's Threat Intelligence Group confirmed it thwarted a hacker group using AI to discover a zero-day and plan a mass vulnerability exploitation operation — the first confirmed case of AI-powered coordinated mass ex...

The 17 Billion Warning Sign

The AI You Learned in January No Longer Exists

The Agent Internet Is Already Leaking

Board-level strategic briefing on the defining risk of 2026: AI agents are being deployed across enterprises as autonomous actors with credentials, permissions, and action authority — but without the identity governance applied to human employees. Gartner projects 40% of enterprise applications will embed AI agents by year-end 2026 (up from 5% in 2025). 92% of security leaders are concerned about...

North Korea's ScarCruft built Ruby Jumper, a five-component toolchain that breaches air-gapped networks by installing a disguised Ruby runtime, weaponizing USB drives as bidirectional command channels, and deploying full-spectrum surveillance including keylogging, audio, and video capture inside physically isolated environments. Separately, Aeternum C2 is a new botnet that writes encrypted command...

A rival AI company officially launched GPT-5.4-Cyber, a frontier model optimized for defensive cybersecurity, days after Project Glasswing — making the AI cyber arms race live with two competing frontier models now shipping for enterprise security. A critical authentication bypass (CVE-2026-33032, CVSS 9.8) was discovered in the Model Context Protocol (MCP) integration for nginx-ui, allowing any n...

Check Point Research disclosed critical vulnerabilities in Anthropic's Claude Code where simply opening an untrusted repository could silently execute commands on a developer's machine, steal API credentials, and compromise an entire team's workspace — all through configuration files treated as harmless metadata. Separately, Google and Mandiant dismantled GRIDTIDE, a China-linked espionage campaig...

The Criminal Marketplace Youre Not Monitoring

The Death of Human Error