Full Daily Digest

A modular iOS exploit framework dubbed 'Coruna,' initially linked to the sophisticated Operation Triangulation APT campaign, is now being repurposed by a broader range of threat actors, including cybercriminals. Analysis reveals the kit leverages a combination of older, patched vulnerabilities and specific zero-days like CVE-2023-32434 and CVE-2023-38606, with its codebase updated to target newer

Kaspersky Securelist · 2026-03-26 · Vulnerability: A modular iOS exploit framework dubbed 'Coruna,' initially linked to the sophisticated Operation Triangulation APT campaign, is now being repurposed by a broader range of threat actors, including…

A sophisticated supply chain attack has compromised the popular Python AI gateway library, LiteLLM, with trojanized versions distributed via PyPI in March 2026. The injected malware was engineered to exfiltrate high-value credentials and configurations from victim systems, specifically targeting AWS, Kubernetes, NPM, and various database services like MySQL and PostgreSQL. Beyond data theft, the m

Kaspersky Securelist · 2026-03-26 · Incidents: A sophisticated supply chain attack has compromised the popular Python AI gateway library, LiteLLM, with trojanized versions distributed via PyPI in March 2026.

The professionalization of ransomware-as-a-service (RaaS) operations, coupled with the persistent exploitation of decade-old vulnerabilities, defines the current threat landscape according to a synthesis of Cisco Talos and Splunk's latest annual reports. This convergence means adversaries are leveraging both sophisticated, franchise-like criminal business models and shockingly basic security gaps

Cisco Talos · 2026-03-26 · Vulnerability: The professionalization of ransomware-as-a-service (RaaS) operations, coupled with the persistent exploitation of decade-old vulnerabilities, defines the current threat landscape according to a…

A significant and ongoing cyber campaign is exploiting geopolitical tensions in the Middle East, with threat actors leveraging conflict-themed lures to conduct widespread financial fraud and credential theft. Analysis reveals over 7,300 phishing URLs across nearly 1,900 hostnames, impersonating trusted regional entities like telecommunications providers, airlines, and energy corporations. The infr

Palo Alto Unit 42 · 2026-03-26 · Incidents: A significant and ongoing cyber campaign is exploiting geopolitical tensions in the Middle East, with threat actors leveraging conflict-themed lures to conduct widespread financial fraud and credential theft.

A coordinated cyberespionage campaign is actively targeting a Southeast Asian government, with evidence suggesting at least three distinct but potentially aligned threat clusters converging on the same victim. Unit 42's research links the known group Stately Taurus to USB-propagated malware (USBFect/PUBLOAD), while two newly identified clusters, CL-STA-1048 and CL-STA-1049, deploy separate espiona

Palo Alto Unit 42 · 2026-03-26 · Incidents: A coordinated cyberespionage campaign is actively targeting a Southeast Asian government, with evidence suggesting at least three distinct but potentially aligned threat clusters converging on the same victim.

The FCC's proposed regulations represent a significant escalation in the fight against illegal robocalls by targeting the foundational vulnerabilities in phone number allocation and call center operations. By mandating stricter certification, disclosure, and identity verification for all telecom providers and resellers, the rules aim to dismantle the infrastructure that enables spammers to exploit

CyberScoop · 2026-03-26 · Policy: The FCC's proposed regulations represent a significant escalation in the fight against illegal robocalls by targeting the foundational vulnerabilities in phone number allocation and call center operations.

A consensus is emerging among former U.S. cyber leadership that the nation's strategic advantage in cyberspace is eroding due to systemic inertia and a failure to adapt. At RSAC 2026, four former NSA and Cyber Command directors highlighted a dangerous complacency, noting that while technical capabilities remain strong, the collective response is hampered by political division, the absence of a fed

CyberScoop · 2026-03-26 · Incidents: A consensus is emerging among former U.S. cyber leadership that the nation's strategic advantage in cyberspace is eroding due to systemic inertia and a failure to adapt.

New research exposes a severe firmware-level vulnerability in Dell systems where direct patching of UEFI images can silently disable critical security features like kernel DMA protection. By modifying specific firmware offsets and reflashing the SPI chip, attackers can bypass BitLocker encryption—whether TPM-only or TPM+PIN—enabling DMA-based attacks to gain SYSTEM-level privileges without credent

MDSec Research · 2026-03-26 · Vulnerability: New research exposes a severe firmware-level vulnerability in Dell systems where direct patching of UEFI images can silently disable critical security features like kernel DMA protection.

A default Kubernetes security setting, fsGroupChangePolicy set to 'Always', was causing severe performance degradation by recursively checking permissions on large persistent volumes during pod restarts. This led to 30-minute delays for Atlantis—a Terraform automation tool—blocking over 50 hours of engineering time monthly and triggering false on-call alerts. By auditing the configuration and swit

Cloudflare Blog · 2026-03-26 · Case Studies: A default Kubernetes security setting, fsGroupChangePolicy set to 'Always', was causing severe performance degradation by recursively checking permissions on large persistent volumes during pod restarts.

The U.S. intelligence community is undergoing a significant cybersecurity overhaul, with the ODNI implementing AI policy frameworks to standardize and accelerate defensive AI adoption, alongside a shared repository for app security reviews to reduce redundancy. Automation of threat hunting across networks and a shift to data-centric zero-trust architectures are central to this effort, aligning wit

CyberScoop · 2026-03-26 · Policy: The U.S. intelligence community is undergoing a significant cybersecurity overhaul, with the ODNI implementing AI policy frameworks to standardize and accelerate defensive AI adoption, alongside a shared…

GraphQL's adoption in modern web apps has outpaced traditional security tools, leaving critical vulnerabilities like circular dependencies and deep nesting undetected. Detectify's new API scanning capability addresses this gap by combining hacker-led research with AI-driven analysis to autonomously test GraphQL environments with 99.7% accuracy, delivering verified findings in under 20 minutes. It

Detectify Blog · 2026-03-26 · Incidents: GraphQL's adoption in modern web apps has outpaced traditional security tools, leaving critical vulnerabilities like circular dependencies and deep nesting undetected.

A recent Cisco Talos advisory highlights active malware campaigns distributing cryptocurrency miners and droppers, leveraging obfuscated executables and script files. The indicators of compromise (IOCs) provided include multiple SHA256 and MD5 hashes associated with threats like Win.Worm.Coinminer and W32.Injector variants. These payloads often masquerade with generic filenames, such as random str

Cisco Talos · 2026-03-26 · Incidents: A recent Cisco Talos advisory highlights active malware campaigns distributing cryptocurrency miners and droppers, leveraging obfuscated executables and script files.