Cybersecurity Newsfeed - 03/09/26
Daily cybersecurity news covering vulnerabilities, adversaries, trends, breaches, and other notable security developments.
Cybersecurity Newsfeed
📅 03/09/26
🛡️ Vulnerabilities
SonicWall SMA 1000 Zero-Days (CVE-2026-83548 & CVE-2026-83549): Attackers are actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 series appliances. Chaining the unauthenticated SSRF (CVE-2026-83548, CVSS 10.0) and post-authentication OS command injection (CVE-2026-83549, CVSS 7.8) allows remote unauthenticated actors to execute arbitrary code on targeted gateways. Hotfixes are available. More info
Sangoma Switchvox Flaw (CVE-2026-9586): Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform’s
/paHTTP endpoint to deploy reverse shells and gather system data. Administrators are urged to update to version 8.4.0.2 or later. More infoWordPress Backup Plugin Flaw (CVE-2026-19949): A high-severity second-order SQL injection in the All-in-One WP Migration and Backup plugin threatens over 3.25 million WordPress sites. Unauthenticated attackers can plant payloads via trackbacks to expose secret keys and achieve remote code execution. ServMask resolved the issue in version 7.110. More info
CISA Adds 7 Vulnerabilities to KEV Catalog: CISA added seven flaws to its Known Exploited Vulnerabilities catalog following active exploitation, including vulnerabilities in Sangoma Switchvox, Kludex Starlette, Kestra OSS, BerriAI LiteLLM, JFrog Artifactory, and SonicWall SMA 1000. Federal agencies must patch under BOD 26-04. More info
GitSpawn Flaws in AI Coding Agents: Researchers identified eight vulnerabilities across command-line AI coding agents (including Claude Code, Cursor, and Codex). Malicious
.git/configfiles can execute repository-defined commands likecore.fsmonitoroutside the sandbox when opening a repository, bypassing workspace trust controls. More infoMicrosoft Exchange Authentication Bypass (CVE-2026-62911): Nearly 22,000 Microsoft Exchange servers remain exposed to a critical authentication bypass flaw (CVSS 8.0) that enables capture-replay attacks and privilege escalation. With public PoC code available, organizations are advised to apply August 2026 patches immediately. More info
🎯 Adversaries
Silver Fox Campaign Delivers Fake Software Installers: Chinese threat actor Silver Fox is using clone websites to distribute fake software installers. The malware establishes persistence, modifies ACLs, disables Microsoft Defender via PowerShell, deletes shadow copies, and connects to C2 servers. More info
“Spring Ring” Vishing Targets Microsoft Teams: A voice phishing campaign is targeting enterprise Microsoft Teams users. Attackers pose as IT help desk staff to trick employees into installing RMM tools or executing scripts, with advanced variants using PetitPotam NTLM relay operations against domain controllers. More info
Pegasus and NoviSpy Used Against Serbian Activists: Forensic analysis confirmed zero-click Pegasus and NoviSpy infections on devices belonging to Serbian student activists and civil society members. NoviSpy infections were linked to police detentions, while Pegasus targeted iOS devices ahead of local elections. More info
Gambling Goblin Hijacks Brazilian Web Servers: Cybercrime cluster Gambling Goblin has compromised Brazilian government (
.gov.br) and judicial (.jus.br) web servers using tools like DownPro and AlphaAgent. Rogue Apache modules strip security headers and redirect visitors to unauthorized betting platforms for SEO manipulation. More infoExtradited Russian Hacker Faces US Charges: Russian national Searzhudin Tamirlanovich Aktulaev was extradited from Cyprus to face US charges. He is accused of using 255 fake freelancing accounts to send malware-laden Excel macros to 80,000 users, deploying TVRAT and DarkVNC malware to harvest credentials. More info More info
📈 Trends
Evolution of Tech Support Scams: Tech support scams have moved beyond pop-ups to leverage search engine ads, hijacked search results, fake business listings, and fraudulent renewal notices. Scammers impersonate security vendors to gain remote device access, steal data, or install persistent backdoors. More info
Ransomware Protection Checklist for MSPs: A comprehensive framework outlines six operational practices for MSPs to counter double-extortion ransomware: exposure reduction, continuous behavioral detection, 24/7 IR, immutable recovery storage, clean restoration procedures, and multi-tenant management. More info
💥 Breaches & Leaks
Lenovo Email Verification Flaw Impacts Dropbox Accounts: A flaw in Lenovo’s email verification process allowed attackers to create fake Lenovo IDs with victim email addresses. Because Dropbox trusted Lenovo’s authentication, attackers accessed approximately 5,000 Dropbox accounts. Active Lenovo SSO sessions were terminated. More info
Dark Web Marketplace Nexus Sells 153M ID Scans: Dark web marketplace Nexus is selling over 153 million driver’s license scans alongside passport and medical records. The FBI opened an investigation into third-party verification provider IDScan.net regarding the potential exposure. More info
📚 Others
Revolut Phone Scam Wave in Jersey: Law enforcement in Jersey warned of a surge in phone scams targeting local Revolut users, accounting for 75% of fraud cases and £180,000 in losses over four weeks. Scammers posed as bank fraud agents to trick victims into revealing credentials. More info
Microsoft Defender False Positives on Google Links: Microsoft Defender for Office 365 (Safe Links) mistakenly flagged legitimate Google search URLs as malicious (incident MO1465962). Engineers are correcting the security classification to restore proper routing. More info