Cybersecurity briefing, 2026-03-26

Here's your PlainSec briefing for Thursday, March 26th.

• Coruna exploit kit recycles Triangulation iOS zero‑days
• Iran-related cyber campaigns spike with wipers and ransomware
• Langflow flaw enables unauthenticated remote code execution
• Russian hackers seize messaging accounts of US officials
• Cisco patches a dozen IOS and IOS XE flaws
• Critical SharePoint RCE requires immediate patch
• TeamPCP steals CI secrets from Checkmarx GitHub Actions
• Magento stores hit by WebRTC payment skimmer exploiting PolyShell
• Russia arrests alleged administrator of LeakBase marketplace
• Iran-linked Pay2Key encrypts U.S. healthcare provider systems
• Google Research shrinks LLM working memory up to 6x
• Trivy GitHub Actions compromise exposes CI/CD secrets
• BIND updates patch two high-severity DNSSEC DoS flaws
• Xinbi campaign update
• Aleksei Olegovich Volkov campaign update
• Anthropic Claude Chrome extension security update
• Iranian state hackers target journalists via Telegram
• Unauthenticated RCE in Secure Firewall Management Center
• SmartApeSG campaign deploys multiple RATs and data stealer

Recent editions

• Wednesday, March 25, 2026: Trivy GitHub Actions compromise exposes CI/CD secrets · 12 stories
• Tuesday, March 24, 2026: Interlock ransomware uses zero-day to compromise firewalls · 9 stories
• Monday, March 23, 2026: Critical SharePoint flaw being actively exploited · 8 stories
• Sunday, March 22, 2026: CISA orders federal patch for Zimbra XSS flaw · 6 stories
• Saturday, March 21, 2026: Interlock ransomware uses zero-day to compromise firewalls · 9 stories
• Friday, March 20, 2026: Russian APT breaches Ukrainian maritime agency through Zimbra flaw · 10 stories
• Thursday, March 19, 2026: Critical ScreenConnect flaw and SILENTCONNECT loader observed · 9 stories