Microsoft released a significant batch of security patches on Tuesday, addressing 84 new vulnerabilities across its software ecosystem. This comprehensive update includes fixes for two publicly known zero-day exploits, underscoring the ongoing threat landscape for businesses and individuals. The release marks a critical moment for IT professionals to ensure their…

Microsoft released its monthly security update, Patch Tuesday, addressing a total of 83 vulnerabilities across its software suite. Notably, this release included no actively exploited zero-day vulnerabilities, a welcome change from previous months, and six defects assessed as more likely to be exploited by malicious actors. The update targets a…

A federal judge has halted Perplexity AI’s Comet browser from unauthorized access and purchases via user Amazon accounts. The decision comes as part of a preliminary injunction granted to Amazon, which alleges Perplexity’s actions violate computer fraud laws. The injunction, issued on March 9 by Judge Maxine Chesney of the…

Cybersecurity researchers are highlighting a concerning new campaign where threat actors are exploiting FortiGate Next-Generation Firewall (NGFW) appliances as a primary entry point to compromise victim networks. This innovative exploitation tactic targets organizations within the healthcare, government, and managed service provider sectors, leveraging either recently disclosed vulnerabilities or weak credentials.…

The Cybersecurity and Infrastructure Security Agency (CISA) has formally warned of a critical authentication bypass vulnerability in Ivanti Endpoint Manager (EPM), identifying it as CVE-2026-1603. This severe flaw, now cataloged on CISA’s Known Exploited Vulnerabilities (KEV) list, allows remote, unauthenticated attackers to steal sensitive stored credentials without any form of…

Cybersecurity researchers have identified nine critical vulnerabilities within Google Looker Studio, collectively dubbed “LeakyLooker.” These flaws could have allowed malicious actors to execute arbitrary SQL queries on victim databases and exfiltrate sensitive information across organizations’ Google Cloud environments. While Tenable, the firm that disclosed the research, stated there’s no evidence…

The rapid surge in security advisories from the self-hosted AI agent OpenClaw has exposed a significant and growing divide between GitHub’s advisory system and the established Common Vulnerabilities and Exposures (CVE) tracking ecosystem. Weeks after becoming GitHub’s most-starred repository, OpenClaw’s creators began publishing security advisories at an unprecedented rate, highlighting…

A sophisticated Chinese-linked cyberespionage campaign, attributed to the advanced persistent threat (APT) group Camaro Dragon, has targeted entities in Qatar with PlugX malware. The campaign, detected on March 1, 2026, commenced within 24 hours of renewed hostilities in the Middle East, deploying war-themed lure documents to trick recipients into installing…

A sophisticated phishing campaign is exploiting the trust ingrained in familiar work applications, disguising malware as legitimate Microsoft Teams, Zoom, and Adobe Acrobat Reader updates. This advanced threat, identified by Microsoft Defender Experts, utilizes digitally signed malicious files that appear authentic, making them incredibly difficult for both end-users and basic…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following confirmed evidence of active exploitation by malicious actors. This proactive measure mandates federal agencies to patch these vulnerabilities to mitigate significant risks to the federal enterprise. The newly…

A sophisticated malware campaign, known as GhostClaw, is actively targeting software developers by masquerading as a legitimate command-line installer for a tool called “OpenClaw Installer.” This malicious package, published on the npm registry as @openclaw-ai/openclawai, stealthily infiltrates developer systems to exfiltrate sensitive credentials, cryptocurrency wallet details, SSH keys, active browser…

A sophisticated credential-stealing campaign leveraging a stealthy tool known as VIP Keylogger has emerged as a significant threat to organizations worldwide. This advanced malware operates entirely in memory, bypassing traditional file-based detection methods. Security researchers first identified the campaign through suspicious email activity, which directed recipients to open deceptive attachments…