Threat Advisories

Cybersecurity researchers have uncovered a new wave of supply-chain attacks attributed to North Korean state aligned threat actors, involving the publication of 26 malicious npm packages posing as legitimate developer tools. The campaign tracked as “StegaBin”, uses Pastebin based steganography to conceal command and control (C2) endpoints and ultimately deploy credential stealers and a cross platform remote access trojan (RAT). The infrastructure supporting these operations spans 31 Vercel deployments, highlighting a sophisticated and evolving threat to the global software supply chain.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a newly disclosed VMware Aria Operations vulnerability, tracked as CVE‑2026‑22719to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw is a command injection vulnerability enabling unauthenticated remote code execution (RCE) under certain conditions. VMware (Broadcom) released patches on February 24, 2026, but reports indicate attackers are now leveraging the issue against unpatched systems. Federal civilian agencies have been mandated to remediate the vulnerability by March 24, 2026.

The global geopolitical and cybersecurity landscape has shifted dramatically following the February 28, 2026 launch of Operation “Epic Fury” by the United States and the parallel Israeli campaign Operation “Roaring Lion” against Iran. The coordinated military strikes successfully eliminated key Iranian leadership, including Supreme Leader Ayatollah Ali Khamenei, and heavily degraded Iran's conventional military and nuclear infrastructure.

Cisco Catalyst SD-WAN platforms are widely deployed across enterprises, governments, and service providers, often serving as the core infrastructure that links remote offices, data centers, and cloud environments. Because these controllers are frequently reachable from external networks to support distributed operations, they represent a highly visible and attractive target for threat actors.

SolarWinds has released urgent patches for four critical vulnerabilities affecting ServU 15.5. All flaws are rated CVSS 9.1 and can allow an attacker with sufficient privileges to execute arbitrary code as root, potentially taking full control of affected systems. The issues are resolved in ServU version 15.5.4.

CVE‑2026‑2329 is a critical stack‑based buffer overflow vulnerability affecting the Grandstream GXP1600 series of VoIP desk phones. The flaw sits in the device’s web‑based API endpoint and can be exploited remotely without any authentication. If successfully exploited, an attacker can gain full remote code execution with root privileges on the phone.

CVE-2026-2649 is a high severity integer overflow vulnerability in the V8 JavaScript engine used by Google Chrome. The issue affects Chrome versions earlier than 145.0.7632.109. If a user opens a specially crafted HTML page, the flaw can lead to heap corruption inside the browser.
Because V8 handles JavaScript execution, weaknesses in this component can have wide impact across normal browsing and sandboxed processes.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SolarWinds Web Help Desk (WHD) vulnerability—CVE‑2025‑40551—to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The flaw carries a CVSS score of 9.8 and enables unauthenticated remote code execution (RCE) via deserialization of untrusted data. This vulnerability poses a severe risk to enterprises, government agencies, and critical infrastructure relying on SolarWinds WHD. 

The popular open source txt editor Notepad++ has been targeted in a sophisticated supply chain attack by a suspected state sponsored threat actor.

Ivanti has disclosed and patched two critical security vulnerabilities affecting Ivanti Endpoint Manager Mobile (EPMM) that have been actively exploited in zero-day attacks. The flaws, tracked as CVE-2026-1281 and CVE-2026-1340, allow unauthenticated remote code execution and carry CVSS scores of 9.8, placing them among the most severe vulnerability classes. One of the vulnerabilities has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, significantly increasing the urgency for remediation, particularly across U.S. federal environments.