Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

What smart factories keep getting wrong about cybersecurity
In this Help Net Security interview, Packsize CSO Troy Rydman breaks down the biggest vulnerabilities in smart factory environments today, from IoT devices and legacy systems to human error. He explains how unmanaged devices, from sensors to robotic components, often go unpatched and become entry points for attackers.

Certificate lifespans are shrinking and most organizations aren’t ready
The push for shorter TLS certificate lifespans has grown for years. Google first promoted 90-day certificates, and Apple later proposed 47-day ones, prompting the CA/Browser Forum to set a formal timeline. That plan cuts validity from one year to 200 days, then 100, and finally 47, forcing organizations to rethink certificate purchasing and management.

Stop building security goals around controls
In this Help Net Security interview, Devin Rudnicki, CISO at Fitch Group, argues that security strategy fails when it loses its connection to business outcomes. Rudnicki walks through how to align security goals with corporate priorities, why CISOs must present risk in terms leadership can act on, and how to balance innovation speed with measured risk.

AI got it wrong with high confidence. Now what?
In this Help Net Security interview, Christian Debes, Head of Data Analytics & AI at SPRYFOX, talks about the growing gap between what AI models do and what their operators can explain. He argues this gap is already a liability, particularly when decisions affect people or money and no one can say why a model produced a certain output.

Field workers don’t need more access, they need better security
In this Help Net Security interview, Chris Thompson, CISO at West Shore Home, discusses least privilege and credential hygiene for a field-based workforce. He covers access management, authentication practices, and data risk processes that support employees in the field. Thompson also outlines security awareness efforts and how field teams are integrated into an organization’s security posture.

CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)
CVE-2026-20963, a remote code execution (RCE) SharePoint vulnerability Microsoft fixed in January 2026, is being exploited by attackers. The confirmation comes from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday.

DarkSword: Researchers uncover another iOS exploit kit
A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared. Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in a commercial surveillance operation, by state-linked threat actors engaged in cyber espionage, and cybercriminals.

Unpatched ScreenConnect servers open to attack (CVE-2026-3564)
ConnectWise has patched a critical vulnerability (CVE-2026-3564) that could enable attackers to hijack ScreenConnect sessions by abusing ASP.NET machine keys to forge trusted authentication. The ScreenConnect remote access platform is popular with managed service providers, IT departments, and technology solution providers. They can opt for the cloud-hosted version or can deploy it on their own servers or in their private cloud.

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131)
A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed.

What to do in the first 24 hours of a breach
In this Help Net Security video, Arvind Parthasarathi, CEO of CYGNVS, walks through a 10-step process for handling a cybersecurity breach. The first five steps cover preparation, while the next five address what to do once a breach is underway.

Cloud misconfiguration has evolved and your controls haven’t
In this Help Net Security video, Kat Traxler, Principal Security Researcher – Public Cloud at Vectra AI, walks through two AWS misconfigurations that go beyond the basics of bucket visibility. The first is bucket name squatting, and the second is the cross-service confused deputy problem.

Fake scandal clips on Facebook bait victims into investment scams
Bitdefender researchers uncovered hundreds of scam campaigns promoted through Facebook ads that use fake news stories, celebrity impersonation, and redirect chains to funnel victims into investment fraud schemes. The activity ran through 310 malvertising campaigns distributed on Meta platforms from February 9 to March 5, 2026. The campaigns generated more than 26,000 ad sightings with localized content in more than 15 languages.

45,000 malicious IP addresses taken down, 94 suspects arrested
An international law enforcement operation has taken down more than 45,000 malicious IP addresses and servers linked to phishing, malware, and ransomware activity. The action was carried out as part of Operation Synergia III, an investigation that ran from July 18, 2025 to January 31, 2026.

Hackers tried to breach Poland’s nuclear research centre
Poland’s National Centre for Nuclear Research (NCBJ) thwarted a cyberattack targeting its IT infrastructure. The attempted intrusion was detected and blocked before attackers could compromise systems or disrupt operations.

Meta ditches end-to-end encrypted messaging on Instagram
End-to-end encrypted messaging on Instagram will no longer be supported after May 8, 2026. Meta justified the move by saying the feature was rarely used, with only a small fraction of Instagram users enabling encryption. The company advised users seeking end-to-end encryption to switch to WhatsApp, where it is enabled by default.

Hidden instructions in README files can make AI agents leak data
Developers rely on AI coding agents to set up projects, install dependencies, and run commands by following instructions in repository README files, which provide setup guidance for software projects. New research identifies a security risk when attackers hide malicious instructions in those documents.

Millions of UK firms on alert after Companies House data exposure
Companies House, the UK’s official company registry, said its WebFiling service is back online after being shut down on Friday to fix a security issue that may have exposed the personal data of millions of firms. An investigation indicates the flaw was likely introduced during an October 2025 update.

EU sanctions Chinese company behind 65,000-device hack
The EU Council has sanctioned companies from China and Iran, along with two individuals, over cyberattacks targeting its member states and partners. With the latest listings, the EU cyber sanctions regime applies to 19 individuals and 7 entities.

Global fraud losses climb to $442 billion
Online fraud is reaching more victims and generating larger losses, driven by digital tools and organized networks operating across borders. In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud sits among the top five global crime threats, with a 54% rise in fraud related Notices and Diffusions from 2024 to 2025.

Big tech companies step in to support the open source security ecosystem
Backed by new funding commitments from major technology players, open source security efforts are moving beyond threat identification toward practical solutions for defenders. The Linux Foundation announced $12.5 million in grant funding backed by Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen open source security.

Apple starts issuing lightweight security updates between software releases
Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1. Apple describes Background Security Improvements as lightweight security releases for components such as Safari, the WebKit framework, and other system libraries, delivered through ongoing patches between software updates.

Firefox is getting a free built-in VPN
Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past. Privacy concerns often follow free VPN services, especially when unclear data practices put user information at risk. Mozilla says its version is grounded in its data principles and focus on trust, aiming to avoid the kinds of arrangements that have raised questions in the past.

Elite members of North Korean society fake their way into Western paychecks
Increased federal activity, including indictments over the past year, has drawn attention to a pattern that has been unfolding inside corporate hiring pipelines. North Korean nationals are securing roles as remote IT contractors and full-time staff within organizations across North America and Western Europe, using standard hiring channels to get in.

Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults
Samba 4.24.0 arrived carrying a set of Kerberos security changes aimed at Active Directory deployments. The release fixes a vulnerability, extends audit coverage for sensitive AD attributes, and introduces configuration options to counter two related Kerberos impersonation techniques.

900,000 contact records exposed in Aura data breach
Aura, the online safety service, confirmed that an unauthorized party accessed about 900,000 records, mostly names and email addresses from a marketing tool linked to a company it acquired in 2021. The incident occurred as a result of a targeted phone phishing attack that tricked one of the employees.

Secure endpoint management systems immediately, CISA urges
The US Cybersecurity and Infrastructure Security Agency (CISA) warns that the cyberattack on Stryker Corporation serves as a signal to U.S. organizations that foreign cyber activity tied to Middle East conflicts may be spilling into their operations. Attackers breached Stryker’s internal Microsoft environment and reportedly wiped 200,000 systems, servers, and mobile devices, while extracting 50 terabytes of data.

4chan shrugs off UK regulator, refuses to pay £520,000 in fines over online safety violations
The U.K.’s media regulator Ofcom fined 4chan £450,000 under the Online Safety Act for failing to introduce age checks to stop children from accessing pornographic content on its platform. 4chan is an online forum notorious for its extreme right-wing content, gory videos, and non-consensual pornography.

Authorities disrupt four IoT botnets behind record DDoS attacks
The U.S. Justice Department and international partners have disrupted four IoT botnets linked to DDoS attacks that reached 30 terabits per second, among the largest ever recorded. The four botnets targeted in the operation—Aisuru, KimWolf, JackSkid and Mossad—infected millions of devices worldwide, primarily IoT systems such as digital video recorders, web cameras and WiFi routers.

Terminated contract led to $2.5 million cyber extortion scheme
A federal jury convicted Cameron Curry, 27, a Charlotte resident, of carrying out an extensive cyber extortion scheme targeting a Washington, D.C.-based international technology company. He faces up to two years in prison on each of the six charges.

VulHunt: Open-source vulnerability detection framework
Binarly has published VulHunt Community Edition, making the core scanning engine from Binarly’s commercial Transparency Platform available to independent researchers and practitioners. VulHunt Community Edition is a framework for detecting vulnerabilities in compiled software. It operates against multiple binary representations simultaneously, working across disassembly, an intermediate representation layer, and decompiled code. Targets include POSIX executables and UEFI firmware modules.

Microsoft Edge 146 adds IP privacy and local network access controls
Microsoft Edge version 146 (Stable) became available on March 13, 2026, bringing updates to tracking protection, IP privacy, and enterprise network security policies.

Microsoft zeroes in on AI-driven data risks in Fabric
New Microsoft Purview innovations for Microsoft Fabric help organizations secure data and accelerate AI adoption. The updates focus on identifying risks, preventing data oversharing, and strengthening governance and data quality across the data estate.

Your APIs are under siege, and attackers are just getting warmed up
Internet-facing systems are handling sustained levels of malicious traffic across APIs, web applications, and DDoS channels. Akamai’s State of the Internet security report places these patterns within the same operating environment, with activity increasing across each area through 2025.

Betterleaks: Open-source secrets scanner
Secrets scanning has become standard practice across engineering organizations, and Gitleaks has been one of the most widely used tools in that space. The author of that project has now released a new tool called Betterleaks, which is designed to scan git repositories, directories, and standard input for leaked credentials, API keys, tokens, and passwords.

Java 26 ships with new cryptography API and HTTP/3 support
Oracle released JDK 26, the 17th consecutive feature release delivered under the six-month cadence the project adopted in 2018. The release includes ten JDK Enhancement Proposals spanning language changes, garbage collection improvements, cryptographic tooling, and network protocol support.

EDR killers are now standard equipment in ransomware attacks
Ransomware attackers routinely deploy tools designed to disable endpoint detection and response software before launching encryptors. These tools, known as EDR killers, have become a standard component of ransomware intrusions. ESET Research tracked nearly 90 EDR killers actively used in the wild.

Google limits Android accessibility API to curb malware abuse
Google is restricting how Android apps can use accessibility features after years of abuse by banking Trojans and mobile malware. The changes, introduced in Android 17.2, limit access to the accessibility API when Advanced Protection Mode (APM) is enabled. Apps that do not serve a core accessibility function can no longer use these services, closing off a common attack vector.

Llamafile, Mozilla’s portable LLM runner, gets GPU support and a rebuilt core
Running a large language model on a single machine without cloud access or a container runtime remains a priority for practitioners working in air-gapped or resource-constrained environments. Llamafile, Mozilla-AI’s project for packaging and running LLMs as self-contained executables, has received its most significant architectural overhaul to date with version 0.10.0.

Fake AI songs streamed billions of times, netting fraudster $10 million
Michael Smith, 54, of Cornelius, North Carolina, has pleaded guilty in federal court to running a scheme that exploited music streaming platforms and diverted royalty payments from artists. He admitted to one count of conspiracy to commit wire fraud, which carries a maximum sentence of five years in prison, and agreed to forfeit $8,091,843.64.

Google slows Android sideloading to trip up scammers
Google’s advanced flow for Android changes how apps from unverified developers are installed, adding steps to reduce scam-driven sideloading. The feature is aimed at experienced users and allows sideloading through a controlled, one-time setup. It addresses scam scenarios where attackers pressure individuals to install malicious software.

Cybersecurity jobs available right now: March 17, 2026
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now.

New infosec products of the week: March 20, 2026
Here’s a look at the most interesting products from the past week, featuring releases from Intel 471, Kore.ai, NinjaOne, Pindrop, Secure Code Warrior, Token Security, and Xona Systems.

from Help Net Security https://ift.tt/AF4ZzrU

While Google has plans to severely restrict Android users' ability to download apps from sources other than the Google Play Store, the company is introducing a new process that will allow sideloading after a mandatory 24-hour waiting period. This new "advanced flow" setting is meant to prevent users from installing malware distributed by bad actors through unverified sources, while still allowing them to sideload from legitimate developers.

Sideloading restrictions are coming to Android

Last year, Google announced that sideloading on Android would eventually be limited to verified third-party app stores and developers. This change has a clear goal: cracking down on malicious apps impersonating real ones found on the Google Play Store. These restrictions—which go into effect for Brazil, Indonesia, Singapore, and Thailand later this year, and apply globally in 2027—will eventually require developers to register specific details with Google in order to distribute their apps, as well as pay a fee. (Students and hobbyists will be still able to share apps with up to 20 devices without registering or requiring users to go through the new workaround.)

This move was met with significant criticism from both developers and users, with concerns ranging from privacy infringement (developers now need to share details they didn't previously have to) to increased difficulty accessing modified or downgraded versions of apps. As such, Google is rolling out a compromise it feels will protect most users from malware, while allowing power users to sideload when they wish to.

Google is introducing a sideloading workaround

The new advanced flow setting will add multiple points of friction to unverified app installation, cutting into the sense of urgency scammers frequently use to distribute malware. Users will go through a one-time process to disable security protections—meaning you won't need to repeat it every time you want to sideload—but you'll still see a warning when you attempt to install an app from an unverified developer.

If you're interested in this workaround, you will first need to enable developer mode in your device's Settings app and confirm you are not being coerced into disabling security protections on your device (a common scam tactic). Next, you'll need to restart your phone, which shuts down calls and remote access tools scammers may use to communicate with you or control your device. From here, you'll have to wait 24 hours before you can return and authenticate the settings change using biometrics or your device PIN. Finally, you'll confirm you understand the risks, which then allows you to install apps from unverified developers for seven days, or indefinitely.

This workaround will be available starting in August—before developer registration requirements kick in.

from Lifehacker https://ift.tt/oAbrM3N

You might think that Chrome for mobile is just a mini version of Google's desktop browser, designed for quickly browsing the web, while all your serious work can only happen on your computer. While Chrome for desktop will likely always be more capable, Chrome for mobile has its own share of powerful features that you should explore. Once you customize its cluttered home screen, you'll find a browser where organizing and pinning tabs is intuitive, blocking notifications is easy, and every website opens in dark mode.

Use pinned tabs to keep track of important pages

Option to pin tabs in overflow menu. Below: Pinned tabs section. Credit: Khamosh Pathak

On desktop, you might be used to pinning tabs to gain quick access to important pages. For example, I always keep Gmail and Trello pinned in my default browser. This keeps the bookmarks bar and bookmark folders free for link organization. But Chrome for Android and iOS lacked this feature until fairly recently. If you didn't know you could do it, it might be time to start pinning tabs on your device, especially when it comes to tablets.

Pinning tabs in Chrome for mobile is slightly different than on desktop, though. After opening a page, you'll have to open the Tabs menu. Then, tap and hold on a page and tap the Pin Tab button. Pinned tabs show up in a special pill-shaped "Pinned Tabs" section at the bottom of the tab switcher. Tapping on one will instantly take you to the pinned page. One added advantage? When you close all tabs because of tab overload, pinned tabs won't disappear.

Prevent tab overload by closing old inactive tabs

Credit: Khamosh Pathak

Safari on iPhone automatically closes tabs that are older than 30 days. Chrome has something similar for Chrome for Android, but the feature on the iOS version is surprisingly limited.

By default, any tab that you don't use for 21 days automatically gets moved to "Inactive Tabs." You'll find this section at the top of the Tabs page. This means that when you open the main Tabs screen, you'll only see tabs that you've used recently. But just because the inactive tabs are tucked away, that doesn't mean they're gone. If you have hundreds of inactive tabs cluttering things up, it's time to close them manually. Go to the Inactive Tabs section, tap the Close all inactive tabs button, and confirm from the popup. Every time the list gets a bit too crowded, go in and clear it out.

Android users, though, get a Safari-like option to automatically close any tabs that haven't been active for over three months (iOS users don't have this option yet). Go to Settings > Tabs and tab groups > Move to inactive session and make sure that the Automatically close inactive items feature is enabled.

Move Chrome's address bar to the bottom

Credit: Khamosh Pathak

Speaking of Safari-like features, Chrome now has an option to move the address bar to the bottom of the screen on both Android and iPhone. This is great news for anyone who uses a giant phone like I do. (Why Google doesn't just switch this to the default, I will never know.) To move the address bar to the bottom, simply tap and hold on the address bar, then tap the Move address bar to bottom button. Going forward, there will be no need to stretch your fingers just to switch to another website.

Use "Send to Your Devices" to open your mobile links on desktop

Credit: Khamosh Pathak

If you use Chrome on both mobile and desktop, you can use a little-known feature to send any link from your phone to the Chrome desktop app. On your smartphone, tap the Share button and choose the Send to Your Devices option. From the list, select the Chrome browser where you want to send it to, and tap the Send to your device button. The next time you open Chrome, you'll see a popup saying that a page was shared from one of the devices. Click on Open in new tab to resume reading or working on the website on your computer.

Block websites from spamming you with notifications (Android only)

Credit: Khamosh Pathak

Spammers love to abuse Chrome for Android's notification system. Every random website you visit wants to send you alerts, and if you tap “Allow” even once, you're inundated with dozens of notifications a day. Luckily, Chrome has an option that blocks all sites from even presenting a popup for enabling notifications. Go to Settings > Site settings > Notifications and switch to Don't allow sites to send notifications. Websites won't be allowed to ask you for notification access, and they won't be able to send you notifications either. If you want to keep the feature enabled, you can also disable notifications on a per-site basis from the section.

Set up your phone so Picture-in-Picture works on any website

Credit: Khamosh Pathak

Picture-in-picture isn't just for YouTube and media apps. Chrome also supports this feature natively on both Android and iOS. This means you can tune in to any website's video, and watch it in a little floating window no matter if they have a dedicated app or not. As long as Picture-in-Picture is enabled on your phone, all you have to do is to open the video playback, and go to the home screen. (This works with YouTube as well, but only if you're paying for YouTube Premium.) On iPhone, you'll even see a PiP button in the native video player, which will automatically close the app, and bring you to the home screen with the video still playing in the floating window.

If Picture-in-Picture is not enabled, you can set it up from the Settings app. On Android, go to Apps > Special app access > Picture-in-Picture > Chrome and enable the “Allow picture-in-picture” feature. On your iPhone, go to Settings > General > Picture in Picture and make sure that the Start PiP Automatically feature is enabled.

Use this setting to force any website into dark mode

Credit: Khamosh Pathak

If you use dark mode on your phone, you might be use to being blinded when you open a news site that only offers a light theme. But there's a simple fix here: All you need is to enable an experimental feature that forces all websites into dark mode, with a black background and white text (without impacting any media or images).

Go to the Chrome address bar and enter "Chrome://flags." Search for "dark" from the top. In the Auto Dark Mode for Web Contents option, tap on the drop-down and switch to Enabled, then tap the Relaunch button to restart Chrome. This works on both Android and iOS.

Lock Incognito tabs when you leave Chrome

Credit: Khamosh Pathak

Incognito tabs are private for a reason, and yet, they're as accessible as your standard tabs. Fortunately, Chrome has a feature that can automatically lock Incognito tabs when you leave the browser—again, something that should be enabled by default.

On Android, go to Settings > Privacy and Security and enable Lock Incognito tabs when you leave Chrome. Verify using your fingerprint or passcode to enable the feature. On iOS, the steps are slightly different. Go to Settings > Privacy and security > Hide Incognito tabs. Here, you can either choose to hide the tabs after 10 minutes, or, better yet, use Lock Immediately with Face ID option for a safer route.

Remove the Discover feed and customize the start page

Credit: Khamosh Pathak

Chrome's start page can be a bit much, especially on iOS. What you want is quick access to the address bar or the search bar, but that's precisely what's farthest to reach. Instead, what you'll find are sections for your top sites, card suggestions, and, of course, the Discover feed, where Google shows you all the articles you might be interested in.

Thankfully, this start page is customizable, and you can disable all three sections to keep things clean and simple. Tap "Edit" from the top-left corner of the new tab page, and disable each feature that you no longer wish to use. When all features are disabled (and you've switched to a calmer background), you'll likely find the new tab page is much more useful.

Join the beta to test out new features early

Credit: Khamosh Pathak

If you like being on the bleeding edge of tech, you can test new Chrome features before anyone else gets their hands on them, whether you have an iPhone or Android. On iOS, it's as simple as installing the Google Chrome beta from the TestFlight app. If you already have the app installed, the beta version will replace the stable app. On Android, visit the Google Chrome beta testing site, log in with the Google Play account you use on your smartphone, and choose Become a tester. Once enrolled, you will get an update for Chrome that will switch you out to the latest beta version. If you want to leave the program and return to the stable build, go back to the same website, and use the Leave the program button.

from Lifehacker https://ift.tt/NGObmqu

A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransomware gang, Amazon CISO and VP of Security Engineering CJ Moses revealed.

“Our research [using Amazon’s MadPot system of honeypots] found that Interlock was exploiting this vulnerability 36 days before its public disclosure, beginning January 26, 2026,” he said on Wednesday.

CVE-2026-20131 exploited as zero-day for weeks

Cisco Secure Firewall Management Center is used by organizations to centrally manage Cisco Secure Firewall devices.

CVE-2026-20131 affects the FMC web-based management interface and stems from insecure deserialization of a user-supplied Java byte stream.

The vulnerability can be exploited by unauthenticated, remote attackers by sending a crafted serialized Java object to the management interface of a vulnerable device, and can lead to code execution and privilege escalation (to root).

Cisco was made aware of CVE-2026-20131 after a member of its Advanced Security Initiatives Group found it during internal security testing. Unfortunately, it seems that Interlock found it before that.

“Amazon threat intelligence identified threat activity potentially related to CVE-2026-20131 beginning January 26, 2026, predating the public disclosure. Observed activity involved HTTP requests to a specific path in the affected software,” Moses shared.

“Request bodies contained Java code execution attempts and two embedded URLs: one used to deliver configuration data supporting the exploit, and another designed to confirm successful exploitation by causing a vulnerable target to perform an HTTP PUT request and upload a generated file.”

Interlock’s tools revealed

AWS researchers simulated a successful exploitation, tricking the attackers into downloading a malicious Linux executable file from a remote server. By analyzing this server, they found it was a central hub for the attackers’ tools, organized by victim, and used both to send malware to infected systems and receive data back from them.

The malware, other stored artifacts, and the ransom note pointed to Interlock involvement.

The researchers found:

• A PowerShell script the group uses for enumerating and collecting information about Windows hosts present on the targeted network
• A JavaScript remote access trojan that collects information about infected hosts (and has self-update and self-delete capabilities)
• A Java implant that sets up redundant command-and-control communication
• A Bash script that turns a hacked Linux server into a temporary relay server that anonymizes attacks, forwards malicious traffic, and constantly erases traces to make tracking attacker activity difficult
• A memory-resident webshell/backdoot
• A lightweight network beacon that confirms successful code execution or network port reachability following initial exploitation.

Interlock also uses legitimate tools like ConnectWise ScreenConnect (for redundant remote access), Volatility (for parsing memory dumps in search for sensitive data), and Certify (for identifying vulnerable certificate templates and enrollment permissions).

Mitigation and remediation

AWS has shared indicators of compromise enterprise defenders can check for in their logs and has advised on immediate actions and long-term measures they should take.

“The real story here isn’t just about one vulnerability or one ransomware group—it’s about the fundamental challenge zero-day exploits pose to every security model. When attackers exploit vulnerabilities before patches exist, even the most diligent patching programs can’t protect you in that critical window,” Moses pointed out.

“This is precisely why defense in depth is essential—layered security controls provide protection when any single control fails or hasn’t yet been deployed. Rapid patching remains foundational in vulnerability management, but defense in depth helps organizations not to be defenseless during the window between exploit and patch.”

Cisco updated the advisory to say they’ve been made aware of active CVE-2026-20131 exploitation, and the US Cybersecurity and Infrastructure Security Agency has ordered US federal civilian agencies to address CVE-2026-20131 by March 22, 2026.

“If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced,” Cisco noted in its advisory.

CVE-2026-20131 is the third Cisco vulnerability flagged as exploited as a zero-day since the start of this year: attackers also leveraged CVE-2026-20127 (in Cisco Catalyst SD-WAN Controller), CVE-2026-20045 (in the company’s unified communications solutions), and CVE-2025-20393 (in Email Security Gateway and Secure Email and Web Manager devices).

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

from Help Net Security https://ift.tt/dx47vHf

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

Convertible laptops are a versatile and affordable alternative to buying a separate laptop and tablet. They offer touchscreen capability, multiple viewing modes, and greater portability than traditional laptops, which is a perk for commuters. They’re also useful if you want a second screen but don’t want to invest in a full second laptop or desktop. One of the most popular options is the entry-level 14-inch ASUS Chromebook Flip CX1 Convertible Laptop, which is down to a record low of $279.99 (originally $369.99), according to price trackers. 

Asus Chromebook Flip CX1 2-in-1

$279.99 at Amazon

$369.99 Save $90.00

$279.99 at Amazon

$369.99 Save $90.00

It’s one of the most affordable convertible laptops with a 360-degree hinge, a 13-inch touchscreen, and all the essentials for everyday tasks like streaming video, getting work done, multitasking, or serving as a secondary device. That said, it’s not designed for more intensive tasks like design work, competitive gaming, and video editing.

It has an Intel Celeron N4500 processor, 8 GB of RAM, and 128 GB of eMMC storage, and lasts up to 11 hours per charge. It can be used in laptop, tent, or tablet mode, adding to its versatility. While it doesn’t have the high-end specs and performance of dedicated computers, this  2-in-1 does come with fingerprint login, a backlit keyboard, dual speakers,  and a 1080p webcam. It also has fast-charging USB-C, USB-A, and micro-SD ports, offering more connectivity than many budget Chromebooks.

If you’re looking for a model that covers the basics and your priority is versatility and convenience at under $300, the Asus Chromebook Flip CX1 2-in-1 is a strong choice. However, if you need more storage, better brightness and visuals, and a more capable processor, it’s worth stepping up to a slightly more powerful model like the ASUS Chromebook CM14 Flip or the Lenovo IdeaPad Flex 5i Chromebook Plus, though those upgrades will come with a higher price tag.

Our Best Editor-Vetted Amazon Big Spring Sale Deals Right Now

Apple AirPods 4 Active Noise Cancelling Wireless Earbuds — $148.99 (List Price $179.00)

Apple iPad 11" 128GB A16 WiFi Tablet (Blue, 2025) — $299.00 (List Price $349.00)

Sony WH1000XM6- Best Wireless Noise Canceling Headphones — $398.00 (List Price $459.99)

Apple Watch Series 11 (GPS, 42mm, S/M Black Sport Band) — $299.00 (List Price $399.00)

Blink Video Doorbell Wireless (Newest Model) + Sync Module Core — $35.99 (List Price $69.99)

Ring Indoor Cam Plus 2K Wired Security Camera (White) — $39.99 (List Price $59.99)

Fire TV Stick 4K Max Streaming Player With Remote — $34.99 (List Price $59.99)

Deals are selected by our commerce team

from Lifehacker https://ift.tt/XPpMOhz

A powerful iPhone hacking toolkit dubbed “DarkSword” has been used since November 2025 to compromise devices by exploiting zero-day iOS vulnerabilities, Google researchers have shared.

iOS vulnerabilities exploited by DarkSword

Two weeks ago, Google Threat Intelligence Group (GTIG) and iVerify disclosed the existence of Coruna, a spy-grade iOS exploit kit that has been used in a commercial surveillance operation, by state-linked threat actors engaged in cyber espionage, and cybercriminals.

While Coruna contains five full iOS exploit chains and a total of 23 exploits for vulnerabilities (with and without a CVE identifier), Darksword chains six vulnerabilities to allow attackers to achieve remote code execution on vulnerable iPhones and deploy malicious payloads.

Three of these are flaws in WebKit, the browser engine used by Apple’s Safari browser and all web browsers on iOS and iPadOS. Two are in the iOS (and macOS) kernel and one in the Dynamic Link Editor component of Apple’s operating systems.

Apple fixed:

• CVE-2025-31277 (WebKit) in iOS 18.6, in July 2025
• CVE-2025-43510 and CVE-2025-43520 (kernel) in iOS 26.1 and 18.7.2, in November 2025
• CVE-2025-43529 and CVE-2025-14174 (WebKit) in iOS 26.2 and 18.7.3, in December 2025 (after reports of targeted in-the-wild exploitation)
• CVE-2026-20700 (dyld) in iOS 26.3, in February 2026, also after confirmed zero-day exploitation.

DarkSword discovery

According to Google researchers, DarkSword has been leveraged in a variety of attack campaigns tied to several threat actors, including suspected Russian state-sponsored attackers UNC6353, who also leveraged the Coruna exploit kit, and customers of PARS Defense, a Turkish commercial surveillance vendor.

Timeline of observed DarkSword use and Apple’s patching of the flaws (Source: Google Threat Intelligence Group)

After uncovering Coruna, researchers from mobile security company Lookout identified another suspicious domain (cdncounter[.]net) closely linked to previously known malicious infrastructure tied to UNC6748.

The domain shared technical characteristics with earlier infrastructure and was connected to compromised Ukrainian websites where hidden iframes were used to deliver malicious code.

Further analysis showed this activity was not Coruna but a new operation: the injected code fingerprinted visiting devices and selectively targeted certain iOS versions with a separate exploit chain: DarkSword (named thus to internal references found in the malware).

“DarkSword is a complete exploit chain and infostealer written in JavaScript. It leverages multiple vulnerabilities to establish privileged code execution to access sensitive information and exfiltrate it off the device. The kill chain begins with Safari encountering the malicious iframe embedded in a web page. Once loaded, Darksword breaks out of the WebContent sandbox and then leverages WebGPU to inject into mediaplaybackd. From there it can craft Kernel read/write access, which it leverages to gain access to privileged processes and modify sandbox restrictions, gaining access to restricted parts of the filesystem,” Lookout researchers explained.

After gaining deeper access to the device, the malware runs a main script that coordinates several smaller malicious components, which collect sensitive data like passwords, encryption keys, and files, and store them temporarily on the device, then send them to a remote server controlled by the attackers.

DarkSword use

In November 2025, Google researchers spotted DarkSword being used by UNC6748 to target Saudi Arabian users via a Snapchat-themed website. In November 2025 and January 2026, they uncovered evidence of DarkSword being used in two campaigns associated with different PARS Defense customers and targeting users in Turkey and Malaysia.

UNC6353, who were previously observed using Coruna, also targeted Ukrainian users again with DarkSword and a backdoor (GHOSTBLADE) that collected a wide variety of information about the device, installed apps, accounts, location history, photos, calendar entries, notes, cryptocurrency wallet and account data, Safari history, and more.

iVerify researchers also analyzed that last campaign.

Lookout researchers say UNC6353 appears to have access to advanced iOS exploit chains, likely originating from top-tier commercial surveillance vendors. Some of these exploits were used as zero-days, suggesting the group is well funded and may be linked to exploit brokers such as Matrix LLC / Operation Zero.

They also note that both Coruna and DarkSword can steal cryptocurrency alongside sensitive personal data, meaning they can be used for both espionage and financial theft. It remains unclear whether crypto theft was a primary objective, leaving open the possibility that the group is financially motivated or that this state-aligned actor has expanded into targeting mobile users for profit.

What to do?

The fear now is that other cybercriminals might get their hands on the two toolkits and leverage them to target a larger pool of iOS users.

“The combined attacks now likely affect hundreds of millions of unpatched devices running iOS versions from 13 to 18.6.2,” iVerify researchers noted.

“We strongly recommend updating to iOS 18.7.6 or iOS 26.3.1. This will mitigate all vulnerabilities that have been exploited in these attack chains.”

Google researchers say users that cannot update to either of those should consider enabling Lockdown Mode for enhanced security.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

from Help Net Security https://ift.tt/sadBZ7k

Flare has unveiled the general availability of Foretrace, a new business-to-business-to-employee (B2B2E) product that delivers enterprise-grade identity protection directly to employees. Built on the same threat intelligence infrastructure used by security teams to defend their organizations, Foretrace allows individuals to monitor and remediate their personal digital identity exposures.

The spread of infostealer malware and the shift to remote and hybrid work have created a new reality where personal and corporate identities are increasingly interconnected, exposing both to greater risk. In fact, 48% of stealer logs contain corporate account credentials. Foretrace addresses this challenge by extending Flare’s identity intelligence beyond the security operations team and directly to employees, democratizing security within the enterprise.

By giving individuals accessible visibility into identity risks and the tools to address them, organizations can reduce their attack surface, strengthen their security culture, and better manage risks arising from employee exposures.

“For years, security teams have been able to monitor corporate credential exposures, but personal identity risks tied to their employees have not been something a security team can act on,” said Nick Ascoli, VP Product of Strategy, Flare. “Foretrace changes that by empowering employees to be part of the solution. When people can see and fix risks tied to their own identities, security becomes personal, and that leads to stronger outcomes than awareness training alone.”

Foretrace is powered by Flare’s identity intelligence infrastructure, which includes approximately 100 million stealer logs, monitoring of more than 57,000 Telegram channels, and roughly 20 billion leaked credentials. Foretrace surfaces real-time exposure data drawn from the same sources attackers use to conduct account takeovers and social engineering campaigns.

The product is delivered through a B2B2E model, enabling organizations to offer Foretrace as a security benefit to their workforce via the Flare platform. Employees access their own private identity profile — one that their employer cannot view. This ensures that the service functions as personal protection rather than workplace monitoring, a distinction designed to build trust and encourage adoption.

from Help Net Security https://ift.tt/AaVi4dh