Cybersecurity briefing, 2026-03-29

Here's your PlainSec briefing for Saturday, March 29th.

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days
• TeamPCP Injects Credential-Stealer into LiteLLM Package
• CISA Adds BIG‑IP APM RCE to Known Exploited Vulnerabilities
• Debian Issues Security Updates for Node.js and Incus
• China‑Linked Red Menshen Embeds Stealthy Implants in Telecom Cores
• TeamPCP Pauses New Supply-Chain Compromises, Monetizes Haul
• Iranian Handala Breaches FBI Director's Gmail; Targets Journalists
• Xinbi campaign update
• Pay2Key Re-emerges; Bearlyfy Escalates Ransomware Campaign
• Smart Slider Vulnerability Lets Subscribers Read Server Files
• Cloudflare-Themed Lures Install Python Infostealer on macOS
• Citrix NetScaler Flaws Risk Memory Disclosure and Session Mix‑up

Recent editions

• Saturday, March 28, 2026: TeamPCP Pauses New Supply-Chain Compromises, Monetizes Haul · 14 stories
• Friday, March 27, 2026: Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days · 31 stories
• Thursday, March 26, 2026: Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days · 19 stories
• Wednesday, March 25, 2026: Trivy GitHub Actions Compromise Exposes CI/CD Secrets · 12 stories
• Tuesday, March 24, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 9 stories
• Monday, March 23, 2026: Interlock Ransomware Uses Zero-Day to Compromise Firewalls · 8 stories
• Sunday, March 22, 2026: CISA Orders Federal Patch for Zimbra XSS Flaw · 6 stories