Information Security News

No confirmed exploitation, but six flaws tagged Exploitation More Likely. Microsoft's March 2026 Patch Tuesday fixes 83 CVEs, two zero-days in SQL Server and .NET, and critical Office RCEs exploitable through the Preview Pane.

Two Spanish government agencies lost employee data in 48 hours. The Ministerio de Hacienda leak includes IBANs, national IDs, and government emails offered for free. The same actor hit the tax agency a day earlier.

For $1-4 per person, an automated LLM pipeline matched 67% of anonymous Hacker News users to their real LinkedIn profiles. ETH Zurich and Anthropic researchers say pseudonymity no longer provides reliable privacy protection online.

A nother ingress-nginx annotation injection (CVSS 8.8) continues a year-long chain of Kubernetes controller flaws that started with IngressNightmare. Seven Unisoc NR modem bugs can crash Android phones remotely. Budibase leaks shell commands through its PostgreSQL integration.

An open-source tool that tracks body poses through walls using $54 in Wi-Fi hardware has 31,700 GitHub stars. RuView builds on Carnegie Mellon research and runs on ESP32-S3 chips, but independent reviewers question whether the code is fully functional.

A phishing campaign is hijacking Signal and WhatsApp accounts of officials and journalists by tricking them into sharing verification codes. Dutch intelligence confirmed victims among its own government employees and published detection indicators for compromised accounts.

March 9 brought 117 new CVEs but no critical-severity entries. The two worth tracking are an unpatched UltraVNC DLL hijack with a public exploit, and two Tiandy surveillance flaws from a vendor that has ignored disclosures since 2017.

A five-year ransomware affiliate that cycled through Ryuk, Conti, BlackCat, and RansomHub now uses ClickFix to stage Termite ransomware intrusions via CastleRAT. MalBeacon tracked 12 days of hands-on-keyboard activity in a U.S. environment.

Sponsored Google results for "Claude Code install" lead to pixel-perfect clones of Anthropic's documentation that deliver Amatera Stealer. Push Security found at least 17 fake domains. Both macOS and Windows are targeted.

Over 221 CVEs dropped in two days — headlined by a CVSS 9.9 RCE in Tencent's WeKnora LLM framework, a Parse Server authentication bypass at 9.3, and a WooCommerce CSRF that put 4.5 million online stores at risk. Patches are …

A fake CleanMyMac website tricks macOS users into running a Terminal command that installs SHub Stealer — an infostealer targeting 14 browsers and 102 crypto extensions. Worse, it silently backdoors Exodus, Ledger, Atomic, and Trezor wallets to harvest seed phrases …

Proton Mail shared payment data with Swiss authorities, who forwarded it to the FBI. A bank card tied to the Stop Cop City protest account revealed the holder's identity.

Six critical RustDesk Client vulnerabilities (CVSS 9.1–9.3) affect all platforms. Nginx UI CVE-2026-27944 (CVSS 9.8) leaks full server backups without authentication. No RustDesk patch yet.

A self-propagating JavaScript worm vandalized Wikimedia's Meta-Wiki on March 5, 2026, modifying 3,996 pages and overwriting 85 users' scripts in 23 minutes before engineers contained it.

Threat actor "korea" published OptimizerAI's full database: 118,000 user records linking Google and Discord profiles, plus 1.1 million AI-generated sound effects.