Cybersecurity briefing, 2026-03-26

Here's your PlainSec briefing for Thursday, March 26th.

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days
• Iran-Related Cyber Campaigns Spike with Wipers and Ransomware
• Langflow Flaw Enables Unauthenticated Remote Code Execution
• Russian Hackers Seize Messaging Accounts of US Officials
• Cisco Patches a Dozen IOS and IOS XE Flaws
• Critical SharePoint RCE Requires Immediate Patch
• TeamPCP Steals CI Secrets from Checkmarx GitHub Actions
• Magento Stores Hit by WebRTC Payment Skimmer Exploiting PolyShell
• Russia Arrests Alleged Administrator of LeakBase Marketplace
• Iran-linked Pay2Key Encrypts U.S. Healthcare Provider Systems
• Google Research Shrinks LLM Working Memory Up to 6x
• Trivy GitHub Actions Compromise Exposes CI/CD Secrets
• BIND Updates Patch Two High-Severity DNSSEC DoS Flaws
• Xinbi campaign update
• Aleksei Olegovich Volkov campaign update
• Anthropic Claude Chrome extension security update
• Iranian State Hackers Target Journalists via Telegram
• Unauthenticated RCE in Secure Firewall Management Center
• SmartApeSG Campaign Deploys Multiple RATs and Data Stealer

Recent editions

• Wednesday, March 25, 2026: Trivy GitHub Actions Compromise Exposes CI/CD Secrets · 12 stories
• Tuesday, March 24, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 9 stories
• Monday, March 23, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 8 stories
• Sunday, March 22, 2026: CISA Orders Federal Patch for Zimbra XSS Flaw · 6 stories
• Saturday, March 21, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 9 stories
• Friday, March 20, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 10 stories
• Thursday, March 19, 2026: Interlock Compromises Enterprise Firewalls via Cisco FMC Zero-Day · 9 stories