Cybersecurity briefing — March 24, 2026.

Mandiant’s latest report finds the median time between initial access and a secondary actor taking over has collapsed to just 22 seconds, driving faster ransomware and data theft operations. Exploits remained the top initial vector for the sixth straight year, while highly interactive voice phishing surged, and attackers increasingly target backup and virtualization control planes to deny recovery.

Source: Help Net Security

Oracle issued an emergency patch for a critical vulnerability in Oracle Identity Manager and Oracle Web Services Manager caused by missing authentication on a critical function. While Oracle did not confirm in-the-wild exploitation, customers are urged to patch or apply mitigations immediately given the ease of exploitation and the component’s central role in enterprise identity.

Source: Help Net Security

Citrix disclosed a critical unauthenticated out-of-bounds read (CVSS 9.3) in NetScaler ADC and Gateway that can expose sensitive memory on appliances configured as a SAML Identity Provider. Fixed in 14.1-66.59 and 13.1-62.23 (and 13.1-37.262 for FIPS/NDcPP), Rapid7 warns exploitation is likely once PoC code appears; admins should urgently upgrade and check configs for SAML IdP profiles.

Source: Rapid7

Attackers published a malicious Trivy release and retagged images on Docker Hub to deliver information-stealing malware to developer environments. Teams relying on Trivy should verify they’re using clean versions, audit pipelines for suspicious image tags, and rotate any credentials that may have been exposed during scans.

Source: SecurityWeek

US agencies warn that threat actors are compromising accounts on secure messaging platforms—especially Signal—by luring targets (journalists, officials, and others with sensitive access) into phishing flows. The alert stresses that “secure app” branding can create a false sense of safety; users should enable registration locks, verify contacts out-of-band, and be wary of unsolicited “support” messages.

Source: Help Net Security

A financially motivated extortion group is attempting to exploit the Iran conflict by unleashing a worm that propagates through poorly secured cloud services and wipes data on systems using Iran’s time zone or set to Farsi. The campaign underscores the need to harden cloud identities and storage, enforce least privilege, and monitor for destructive behaviors tied to locale-based triggers.

Source: KrebsOnSecurity

US regulators moved to bar new foreign-made home routers from entering the market amid concerns about China-linked cyber threats to critical infrastructure. While existing devices can remain in use, the policy signals a tighter supply chain posture that could affect SOHO gear used by remote and hybrid workers.

Source: CyberNews

You May Also Be Interested In...