Cybersecurity briefing, 2026-03-25

Here's your PlainSec briefing for Wednesday, March 25th.

• Trivy GitHub Actions compromise exposes CI/CD secrets
• Oracle patches critical unauthenticated RCE in Fusion Middleware
• Voice phishing drives 11% of intrusions in 2025
• Iran-related cyber campaigns spike with wipers and ransomware
• TeamPCP uses stolen CI credentials to compromise Checkmarx Actions
• Citrix NetScaler flaws risk memory disclosure and session mix‑up
• Aleksei Olegovich Volkov campaign update
• Crunchyroll customer service data stolen for 6.8M users
• Chrome 146 fixes eight high‑severity memory bugs
• Russian hackers seize messaging accounts of US officials
• Unauthenticated SharePoint RCE Added to CISA KEV
• TeamPCP backdoors LiteLLM PyPI package, steals credentials

Recent editions

• Tuesday, March 24, 2026: Interlock ransomware uses zero-day to compromise firewalls · 9 stories
• Monday, March 23, 2026: Critical SharePoint flaw being actively exploited · 8 stories
• Sunday, March 22, 2026: CISA orders federal patch for Zimbra XSS flaw · 6 stories
• Saturday, March 21, 2026: Interlock ransomware uses zero-day to compromise firewalls · 9 stories
• Friday, March 20, 2026: Russian APT breaches Ukrainian maritime agency through Zimbra flaw · 10 stories
• Thursday, March 19, 2026: Critical ScreenConnect flaw and SILENTCONNECT loader observed · 9 stories
• Wednesday, March 18, 2026: Boggy Serpens escalates attacks on maritime and energy · 10 stories