CyberPulse

Attackers hijacked the update infrastructure for Smart Slider 3 Pro (800K+ WordPress installations) and pushed a fully weaponized remote access toolkit through the official update channel for approximately six hours. Adobe released an emergency patch for CVE-2026-34621 (CVSS 8.6), a prototype pollution flaw in Acrobat Reader under active exploitation via malicious PDFs. The GlassWorm campaign evol...

Google Threat Intelligence Group and iVerify published simultaneous research on Coruna, a nation-state-grade iOS exploit kit containing 23 exploits across five full attack chains targeting iOS 13 through 17.2.1. The kit proliferated from a commercial surveillance vendor to state-linked espionage operations to mass criminal deployment in under twelve months — marking the first observed mass exploit...

This week revealed pre-positioned access across every infrastructure layer simultaneously. Google and iVerify exposed Coruna, a nation-state iOS exploit kit with 23 exploits that proliferated from surveillance to espionage to mass criminal deployment in twelve months. Cisco disclosed a CVSS 10.0 SD-WAN zero-day exploited since 2023 with a three-year dwell time. Akamai traced APT28's exploitation o...

A state intelligence-linked hacktivist group deployed wiper malware against a $25 billion medical technology and defense industrial base supplier, causing a global network disruption that sent over 5,000 workers home, triggered an SEC filing, and temporarily disrupted emergency medical communications in at least one state. The group claims to have erased data from 200,000+ devices and exfiltrated...

Cisco confirmed active exploitation of two additional SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) — bringing the total to four exploited Cisco SD-WAN flaws in eight days. The company also patched two maximum-severity (CVSS 10.0) Secure Firewall Management Center flaws enabling unauthenticated remote code execution as root. Hikvision and Rockwell Automation legacy vulnerabili...

Fortinet released an emergency out-of-band patch for CVE-2026-35616 (CVSS 9.1), a pre-authentication API access bypass in FortiClient EMS exploited as a zero-day — the second critical FortiClient EMS vulnerability in weeks after CVE-2026-21643. The bloc's cybersecurity service attributed a major continental government cloud breach to TeamPCP, exposing data from 29 additional institutional entities...

CyberPulse — February 24, 2026: "They Poisoned the Bot That Guards the Code" A supply chain attack on the Cline AI coding assistant used prompt injection against an AI triage bot to steal npm publishing credentials and silently install the OpenClaw autonomous agent on ~4,000 developer machines in an 8-hour window. The first real-world case of prompt injection weaponized into a software supply chai...

Broadcom's Symantec and Carbon Black confirmed that a state intelligence-linked threat group compromised a bank, an airport, nonprofits, and a defense aerospace software supplier starting in early February 2026 — weeks before the kinetic strikes began on February 28. The group deployed the previously unknown Dindoor backdoor using the Deno JavaScript runtime and attempted data exfiltration via Rcl...

Scattered LAPSUS$ Hunters — the cybercrime supergroup behind over 1.5 billion stolen records and the Jaguar Land Rover ransomware attack — is now recruiting women for voice phishing campaigns targeting IT help desks, paying $500-$1,000 per call with scripts provided. CISA simultaneously issued an emergency directive giving federal agencies 48 hours to patch actively exploited Cisco SD-WAN vulnerab...

State-linked actors are actively targeting internet-exposed Rockwell/Allen-Bradley PLCs on critical infrastructure networks, moving the threat from IT management planes into the operational technology layer. A second AI workflow platform — Flowise (CVE-2025-59528, max severity) — is under active exploitation for arbitrary code execution, two weeks after Langflow. Docker Engine CVE-2026-34040 (CVSS...

Amazon Threat Intelligence confirmed that the Interlock ransomware group exploited CVE-2026-20131 (CVSS 10.0) in Cisco Secure Firewall Management Center as a zero-day for 36 days before Cisco's March 4 patch — gaining unauthenticated root access on enterprise firewalls. Amazon's MadPot honeypot network caught the exploitation and a misconfigured server exposed Interlock's complete attack toolkit....

A state intelligence-linked threat actor is conducting an active password-spraying campaign against Microsoft 365 environments across the Gulf, impacting 300+ organizations in three distinct attack waves on March 3, 13, and 23 — each separated by exactly 10 days. Targets include government, municipalities, technology, transportation, and energy. A state-sponsored actor deployed BRICKSTORM kernel i...

Mandiant's M-Trends 2026 reports adversary handoff times have collapsed to 22 seconds. CrowdStrike's Global Threat Report puts average eCrime breakout at 29 minutes. Six new KEV additions today include FortiClient EMS CVE-2026-21643, Adobe Acrobat Reader, Microsoft Exchange, and Windows CLFS — all under active exploitation with an April 27 patch deadline. A major AI company rotated macOS certifica...

Google released emergency Chrome updates for two actively exploited zero-days — CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 arbitrary code execution), both CVSS 8.8. The GlassWorm supply chain campaign escalated with 72+ malicious Open VSX extensions discovered targeting developers and AI coding assistants using transitive dependency poisoning. The medical technology wiper incid...

TeamPCP struck Checkmarx for the second time in a month, poisoning official Docker Hub images (KICS), VS Code extensions, and GitHub Actions — then reaching Bitwarden CLI v2026.4.0 through the compromised pipeline. The attack is a self-propagating worm using stolen GitHub credentials to inject malicious workflows across repositories. Blast radius spans Docker Hub, VS Code, Open VSX, GitHub Actions...

A board-level strategic briefing synthesizing the three defining risk patterns of March 2026. First: cyber operations are inseparable from geopolitical conflict — the medical technology wiper that destroyed 80,000 devices through weaponized endpoint management demonstrated that trusted infrastructure can become the attack vector. Second: the developer supply chain is the new critical infrastructur...

Google released Chrome updates fixing 21 vulnerabilities including CVE-2026-5281, a zero-day in the WebGPU Dawn component already exploited in the wild and added to the KEV catalog — the third Chrome zero-day cycle in three weeks. Google attributed the Axios npm supply chain compromise to a state-linked threat cluster, confirming that the developer supply chain is now a battleground for both crimi...

Today is the KEV remediation deadline for the F5 BIG-IP APM vulnerability CVE-2025-53521 (CVSS 9.3), reclassified from DoS to RCE after confirmed exploitation. A critical flaw in Open VSX's pre-publish scanning pipeline was disclosed — scanner failures were silently interpreted as "no scanners configured," allowing malicious extensions to bypass all vetting and explaining how the GlassWorm campaig...

IBM's 2026 X-Force Threat Intelligence Index reveals that 56% of the nearly 40,000 vulnerabilities tracked in 2025 required no authentication to exploit — explaining why unauthenticated flaws like the Cisco SD-WAN bypass, the MSHTML zero-day, and the Coruna iOS exploit kit all converged in the same week. Exploitation of public-facing applications surged 44% to become the leading initial access vec...

The TeamPCP supply chain campaign has triggered a law enforcement high-priority alert and the Trivy vulnerability (CVE-2026-33634) has been added to the KEV catalog. The cascade now spans six platforms — GitHub Actions, Docker Hub, PyPI, npm, VS Code extensions, and cloud communications SDKs — after the Telnyx Python package was compromised using audio steganography to conceal malware in a .WAV fi...

A stolen civil servant credential gave an attacker weeks of unrestricted access to FICOBA — France's national bank account registry containing every bank account opened in the country. 1.2 million accounts were browsed, exposing IBANs, names, addresses, and tax IDs. No MFA, no anomaly detection, no rate limiting. The breach creates immediate SEPA direct debit fraud risk across the EU. Phishing cam...

Palo Alto Unit 42 published a live threat brief confirming sixty hacktivist groups are now active in coordinated cyber operations, with allied foreign collectives joining the fight. An Electronic Operations Room was established within hours of the strikes to synchronize targeting across the coalition. Check Point Research confirmed that Handala Hack is routing attacks through Starlink IP ranges fr...

The mean time from CVE publication to working exploit has collapsed to approximately 10 hours in 2026 — down from 56 days in 2024 and 23 days in 2025, across 3,532 CVE-exploit pairs. Google's Threat Intelligence Group confirmed it thwarted a hacker group using AI to discover a zero-day and plan a mass vulnerability exploitation operation — the first confirmed case of AI-powered coordinated mass ex...

The 17 Billion Warning Sign

The AI You Learned in January No Longer Exists