Cybersecurity briefing, 2026-03-22

Here's your PlainSec briefing for Sunday, March 22nd.

• CISA orders federal patch for Zimbra XSS flaw
• Internet-exposed KACE appliances suffer administrative takeover
• Iran deploys cyber Chaos campaign to pressure rivals
• Oracle patches critical unauthenticated RCE in Fusion Middleware
• Attackers backdoor Trivy GitHub Actions to steal secrets
• Musician pleads guilty to millions in streaming royalty fraud using AI

Recent editions

• Saturday, March 21, 2026: Interlock ransomware uses zero-day to compromise firewalls · 9 stories
• Friday, March 20, 2026: Russian APT breaches Ukrainian maritime agency through Zimbra flaw · 10 stories
• Thursday, March 19, 2026: Critical ScreenConnect flaw and SILENTCONNECT loader observed · 9 stories
• Wednesday, March 18, 2026: Boggy Serpens escalates attacks on maritime and energy · 10 stories
• Tuesday, March 17, 2026: Wing FTP Server flaw added to federal KEV list · 10 stories
• Monday, March 16, 2026: Attackers weaponize 250+ WordPress sites to steal credentials · 3 stories
• Sunday, March 15, 2026: Iran-aligned actors escalate cyber attacks on US, allies · 5 stories