CyberPulse

Cisco confirmed active exploitation of two additional SD-WAN Manager vulnerabilities (CVE-2026-20122 and CVE-2026-20128) — bringing the total to four exploited Cisco SD-WAN flaws in eight days. The company also patched two maximum-severity (CVSS 10.0) Secure Firewall Management Center flaws enabling unauthenticated remote code execution as root. Hikvision and Rockwell Automation legacy vulnerabilities were added to the KEV catalog as actively exploited. The network management and OT layer is under simultaneous pressure across SD-WAN, firewall management, IP cameras, and industrial controllers.

• https://thehackernews.com/2026/03/cisco-confirms-active-exploitation-of.html
• https://www.securityweek.com/cisco-warns-of-more-catalyst-sd-wan-flaws-exploited-in-the-wild/
• https://www.helpnetsecurity.com/2026/03/05/cisco-cve-2026-20128-cve-2026-20122-exploited/
• https://www.bleepingcomputer.com/news/security/cisco-flags-more-sd-wan-flaws-as-actively-exploited-in-attacks/
• https://securityaffairs.com/189056/security/cisco-flags-ongoing-exploitation-of-two-recently-patched-catalyst-sd-wan-flaws.html
• https://socradar.io/blog/cisco-catalyst-sd-wan-manager-cve-2026-20122/
• https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html

TeamPCP struck Checkmarx for the second time in a month, poisoning official Docker Hub images (KICS), VS Code extensions, and GitHub Actions — then reaching Bitwarden CLI v2026.4.0 through the compromised pipeline. The attack is a self-propagating worm using stolen GitHub credentials to inject malicious workflows across repositories. Blast radius spans Docker Hub, VS Code, Open VSX, GitHub Actions, npm, and a major password manager. LMDeploy, an AI LLM deployment toolkit, was exploited within 13 hours of disclosure (CVE-2026-33626, CVSS 7.5) — the fourth AI platform exploitation tracked after Langflow, Flowise, and Marimo. A newly documented threat group uses Discord, Slack, and M365 Outlook as covert C2 channels via the Microsoft Graph API. Commercial shipping vessels were seized in the Strait of Hormuz, escalating physical supply chain risk for Gulf enterprises.

• https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html
• https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html
• https://www.docker.com/blog/trivy-kics-and-the-shape-of-supply-chain-attacks-so-far-in-2026/
• https://www.bleepingcomputer.com/news/security/new-checkmarx-supply-chain-breach-affects-kics-analysis-tool/
• https://socket.dev/blog/checkmarx-supply-chain-compromise
• https://thehackernews.com/2026/04/lmdeploy-ssrf-cve-2026-33626-exploited.html
• https://thehackernews.com/2026/04/gopherwhisper-apt-discord-slack-outlook-c2.html
• https://cybernews.com/security/checkmarx-popular-tools-spread-credential-stealing-malware/

Broadcom's Symantec and Carbon Black confirmed that a state intelligence-linked threat group compromised a bank, an airport, nonprofits, and a defense aerospace software supplier starting in early February 2026 — weeks before the kinetic strikes began on February 28. The group deployed the previously unknown Dindoor backdoor using the Deno JavaScript runtime and attempted data exfiltration via Rclone to cloud storage. Intel 471, Nozomi Networks, CrowdStrike, Flashpoint, and CSIS all documented the broader surge in state-aligned cyber operations targeting financial services, aviation, defense, industrial control systems, and government infrastructure across the conflict zone. The pre-positioning phase is over. The question is whether defenders find the implants before the operators activate them.

• https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html
• https://www.theregister.com/2026/03/05/mudywater_backdoor_us_networks/
• https://www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/
• https://www.securityweek.com/iranian-apt-hacks-us-airport-bank-software-company/
• https://www.infosecurity-magazine.com/news/iran-muddywater-hackers-us-firms/
• https://industrialcyber.co/reports/cyber-retaliation-surges-after-us-israel-strikes-on-iran-as-hacktivists-hit-governments-defense-critical-sectors/
• https://www.csis.org/analysis/how-will-cyber-warfare-shape-us-israel-conflict-iran
• https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/

Fortinet released an emergency out-of-band patch for CVE-2026-35616 (CVSS 9.1), a pre-authentication API access bypass in FortiClient EMS exploited as a zero-day — the second critical FortiClient EMS vulnerability in weeks after CVE-2026-21643. The bloc's cybersecurity service attributed a major continental government cloud breach to TeamPCP, exposing data from 29 additional institutional entities. The $285M Drift Protocol heist was attributed to a state-linked financial theft group after a six-month social engineering operation. Device code phishing exploiting the OAuth 2.0 Device Authorization Grant flow has surged 37x this year, targeting 340+ organizations across five countries.

• ttps://thehackernews.com/2026/04/fortinet-forticlient-ems-cve-2026-35616-zero-day.html
• https://www.bleepingcomputer.com/news/security/teampcp-european-commission-cloud-breach-29-entities/
• https://thehackernews.com/2026/04/drift-protocol-285m-heist-state-linked.html
• https://www.bleepingcomputer.com/news/security/device-code-phishing-oauth-surge-37x/
• https://thehackernews.com/2026/04/cisco-imc-authentication-bypass-cve-2026-20093.html
• https://www.bleepingcomputer.com/news/security/axios-post-mortem-social-engineering-north-korea/
• https://dev.to/mrcomputerscience/breaking-cybersecurity-news-for-20260404-pithy-cyborg-threats-breaches-intel-bok
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

A state intelligence-linked hacktivist group deployed wiper malware against a $25 billion medical technology and defense industrial base supplier, causing a global network disruption that sent over 5,000 workers home, triggered an SEC filing, and temporarily disrupted emergency medical communications in at least one state. The group claims to have erased data from 200,000+ devices and exfiltrated 50TB of data, though these claims remain unverified. Multiple threat intelligence firms assess this as the first confirmed significant destructive cyber operation against a major corporation since the conflict began — marking a transition from hacktivist noise to operational destruction targeting healthcare and defense supply chains.

• https://www.cnn.com/2026/03/11/politics/pro-iran-hackers-cyberattack-medical-device-maker
• https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
• https://www.securityweek.com/medtech-giant-stryker-crippled-by-iran-linked-hacker-attack/
• https://www.nextgov.com/cybersecurity/2026/03/cisa-launches-investigation-stryker-cyberattack/412079/
• https://cyberscoop.com/stryker-cyberattack-iranian-hackers-handala/
• https://www.insurancejournal.com/news/national/2026/03/12/861563.htm
• https://www.stryker.com/us/en/about/news/2026/a-message-to-our-customers-03-2026.html
• https://nationalcioreview.com/articles-insights/extra-bytes/breaking-suspected-iranian-linked-malware-hits-medical-tech-giant/

DarkSword, a second nation-state-grade iOS exploit kit, has been disclosed — this one targeting current iOS versions (18.4–18.7) with six vulnerabilities including four zero-days, deployed by three separate operators since November 2025. Unlike Coruna which targeted legacy iOS, DarkSword compromises fully patched modern devices. A critical SharePoint deserialization flaw (CVE-2026-20963) patched in January is now confirmed actively exploited. Formal guidance was issued to harden Microsoft Intune after the medical technology wiper, with the confirmed device count revised to ~80,000. The GlassWorm supply chain campaign escalated across npm, Open VSX, and GitHub simultaneously, now using Solana blockchain for C2 and in-memory-only execution.

• https://www.cybersecbrief.com/news/cybersec/cybersec-2026-03-19
• https://www.cybernewscentre.com/20th-march-2026-cyber-update-headlines-of-the-week/
• https://www.bleepingcomputer.com/news/security/sharepoint-vulnerability-now-exploited-in-attacks/
• https://www.hendryadrian.com/cybersecurity-news-daily-recap-19-mar-2026/
• https://thehackernews.com/2026/03/interlock-ransomware-exploits-cisco-fmc.html
• https://www.bleepingcomputer.com/news/security/glassworm-supply-chain-attack-targets-github-npm-vscode-extensions/
• https://www.scworld.com/news/no-restoration-timeline-for-medical-device-maker-stryker-after-cyberattack
• https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

State-linked actors are actively targeting internet-exposed Rockwell/Allen-Bradley PLCs on critical infrastructure networks, moving the threat from IT management planes into the operational technology layer. A second AI workflow platform — Flowise (CVE-2025-59528, max severity) — is under active exploitation for arbitrary code execution, two weeks after Langflow. Docker Engine CVE-2026-34040 (CVSS 8.8) bypasses authorization plugins via an incomplete fix from 2024. Ponemon Institute research reveals hundreds of "dark matter" applications disconnected from centralized identity in the typical enterprise, creating an unmanaged attack surface now exploited by AI agents. A law enforcement operation disrupted a state-linked campaign hijacking home routers to steal cloud credentials. The FortiClient EMS zero-day KEV deadline is tomorrow.

• https://www.bleepingcomputer.com/news/security/iranian-hackers-targeting-rockwell-plcs-critical-infrastructure/
• https://www.bleepingcomputer.com/news/security/flowise-ai-platform-max-severity-rce-exploited/
• https://thehackernews.com/2026/04/docker-engine-authz-bypass-cve-2026-34040.html
• https://thehackernews.com/2026/04/ponemon-dark-matter-applications-identity.html
• https://www.bleepingcomputer.com/news/security/frostarmada-apt28-router-hijack-disrupted/
• https://www.bleepingcomputer.com/news/security/cisa-forticlient-ems-patch-deadline-friday/
• https://thehackernews.com/2026/04/iran-nexus-password-spraying-m365-israel-uae.html
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

The Malware That Thinks

CyberPulse — February 24, 2026: "They Poisoned the Bot That Guards the Code"

• https://snyk.io/blog/cline-supply-chain-attack-prompt-injection-github-actions/
• https://thehackernews.com/2026/02/cline-cli-230-supply-chain-attack.html
• https://www.darkreading.com/application-security/supply-chain-attack-openclaw-cline-users
• https://www.theregister.com/2026/02/20/openclaw_snuck_into_cline_package
• https://www.endorlabs.com/learn/supply-chain-attack-targeting-cline-installs-openclaw
• https://www.rescana.com/post/cline-cli-2-3-0-supply-chain-attack-openclaw-unauthorized-installation-on-developer-and-ci-cd-syste
• https://cybersecuritynews.com/cybersecurity-news-weekly/

This week revealed pre-positioned access across every infrastructure layer simultaneously. Google and iVerify exposed Coruna, a nation-state iOS exploit kit with 23 exploits that proliferated from surveillance to espionage to mass criminal deployment in twelve months. Cisco disclosed a CVSS 10.0 SD-WAN zero-day exploited since 2023 with a three-year dwell time. Akamai traced APT28's exploitation of an MSHTML zero-day a month before Microsoft patched it. Google's Android update addressed 129 CVEs including a Qualcomm zero-day under active exploitation. Radware quantified 149 hacktivist DDoS attacks from 12 groups across 16 nations in 72 hours. VMware Aria Operations was added to the KEV catalog. The connecting pattern: the gap between capability creation and mass deployment is collapsing while the gap between compromise and detection continues to widen.

• https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit
• https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking
• https://cyberscoop.com/coruna-ios-exploit-kit-leaked-us-framework/
• https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html
• https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis
• https://thehackernews.com/2026/03/google-confirms-cve-2026-21385-in.html
• https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html
• https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html