📰 DAILY THREAT BRIEFING
Sunday, March 22, 2026
12 News Items
HN · BleepingComputer · Krebs · Dark Reading · SANS · THN Intel · Unit 42 · Security.com

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of March 22, 2026.

  1. Trivy vulnerability scanner breach pushed infostealer via GitHub Actions
    — Bleeping Computer

    The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed credential-ste…
  2. Google adds ‘Advanced Flow’ for safe APK sideloading on Android
    — Bleeping Computer

    Google has announced a new mechanism in Android called Advanced Flow that will allow sideloading APKs from unverified developers for power u…
  3. Microsoft Azure Monitor alerts abused for callback phishing attacks
    — Bleeping Computer

    Microsoft Azure Monitor alerts are being abused to send callback phishing emails that impersonate warnings from the Microsoft Security Team …
  4. FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks
    — The Hacker News

    Threat actors affiliated with Russian Intelligence Services are conducting phishing campaigns to compromise commercial messaging application…
  5. Oracle Patches Critical CVE-2026-21992 Enabling Unauthenticated RCE in Identity Manager
    — The Hacker News

    Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be e…
  6. Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages
    — The Hacker News

    The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that h…
  7. Who’s Really Shopping? Retail Fraud in the Age of Agentic AI
    — Unit 42

    Note: We do not recommend ingesting this page using an AI agent. The information provided herein is for defensive and ethical security purpo…
  8. Patch Now: Oracle's Fusion Middleware Has Critical RCE Flaw
    — Dark Reading

    Attackers can execute arbitrary code without authentication if Oracle's Identity or Web Services Managers are exposed to the Web.
  9. Cyber OpSec Fail: Beast Gang Exposes Ransomware Server
    — Dark Reading

    Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP.
  10. Interlock Ransomware Targets Cisco Enterprise Firewalls
    — Dark Reading

    The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly …
  11. GSocket Backdoor Delivered Through Bash Script, (Fri, Mar 20th)
    — SANS ISC

    Yesterday, I discovered a malicious Bash script that installs a GSocket backdoor on the victim&#x27s computer. I don&#x27t know the source o…
  12. ISC Stormcast For Friday, March 20th, 2026 https://isc.sans.edu/podcastdetail/9858, (Fri, Mar 20th)
    — SANS ISC

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Generated by CryptXNet.ai Threat Intelligence Platform · March 22, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com