Originally reported by The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates
TL;DR
CISA flagged three actively exploited vulnerabilities for immediate patching while APT28 continues surveillance operations against Ukrainian forces. Meanwhile, the cybersecurity community grapples with new attack vectors in AI agents and supply chain compromises.
CISA added three vulnerabilities to the Known Exploited Vulnerabilities catalog with evidence of active exploitation, including SolarWinds, Ivanti, and Workspace One flaws requiring immediate patching.
CISA added three security flaws to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation in the wild. The additions include:
CVE-2021-22054 (CVSS 7.5): Server-side request forgery vulnerability in Omnissa Workspace One UEMFederal agencies must patch these vulnerabilities by the CISA-mandated deadline, while private sector organizations should prioritize these fixes given confirmed active exploitation.
ESET researchers documented a sustained surveillance campaign by Russian state-sponsored group APT28 (Fancy Bear) targeting Ukrainian military personnel since April 2024. The operation employs two distinct malware families:
The campaign represents continued Russian cyber operations against Ukrainian defense infrastructure, with APT28 maintaining access for extended intelligence collection.
Salesforce warned of increased threat activity exploiting misconfigurations in publicly accessible Experience Cloud sites. Attackers are using a modified version of the open-source AuraInspector tool to:
Organizations using Salesforce Experience Cloud should review guest user permissions and implement principle of least privilege.
Cybersecurity researchers identified a malicious npm package masquerading as an OpenClaw installer. The package "@openclaw-ai/openclawai" was uploaded March 3, 2026, and has been downloaded 178 times. The malware:
Developers should verify package authenticity and implement supply chain security measures when installing dependencies.
Mandiant attributed a sophisticated cryptocurrency theft to North Korean group UNC4899 (Jade Sleet). The attack vector involved:
The incident highlights risks of personal device usage in corporate environments and the need for strict BYOD policies.
Multiple sources addressed growing security concerns around agentic AI systems. These autonomous AI agents can:
Microsoft announced security features for Agent 365 and Microsoft 365 E7 to address these challenges, while security researchers called for comprehensive auditing of AI agent workflows.
Microsoft Security Response Center published details for two additional vulnerabilities:
CVE-2026-28419: Heap-based buffer underflow in Vim's Emacs tags parsingCVE-2025-10966: Missing SFTP host verification in wolfSSHBoth vulnerabilities require assessment and potential patching based on organizational usage of affected components.
Security practitioners emphasized the importance of attack surface reduction as time-to-exploit continues shrinking. Organizations should:
The approach shifts focus from reactive patching to proactive exposure management.
Originally reported by The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates