Security incidents in March 2026

Attackers exploited CVE-2025-53521 in F5 BIG-IP APM, used for organisational access and remote working. Fixes are available for all four listed branches. Ask IT to update and investigate earlier compromise: an upgrade alone may leave a backdoor.

Attackers exploited CVE-2026-3055 to read sensitive memory from NetScaler appliances providing SAML sign-in. Supported branches have fixes. Ask your organisation's IT provider to update affected appliances and investigate possible compromise.

Attackers are exploiting Laravel Livewire CVE-2025-54068 to steal website credentials and databases. Website operators should update to 3.6.4 or later and investigate possible compromise. Visitors have no device update to install.

Attackers used CVE-2025-32432 to compromise Craft CMS websites before its April 2025 fixes, with further attacks reported in 2026. Ask your website manager to update and check for compromise; Craft 5 also needs the later related fix in 5.10.12.

Attackers are exploiting CVE-2026-20963 to run code on unpatched SharePoint servers without signing in. Microsoft released fixes in January for Server 2016, 2019 and Subscription Edition. Ask your IT provider to update and check exposed servers for compromise.

Attackers used CVE-2025-66376 to steal emails through Zimbra Classic webmail. Opening or previewing a malicious email could trigger it. Ask your mail provider or IT team to confirm patching and check for unauthorised account access.

DarkSword used website visits to compromise outdated iPhones and steal private data. Attacks were observed in four countries. Install the latest available update; protections include iOS 26.3 and iOS 18.7.7.

Attackers exploited Langflow’s AI workflow builder to run code without logging in, harvest credentials and install cryptocurrency miners. Version 1.8.2 remained vulnerable; 1.9.0 fixes this flaw. Ask your IT team to update and check exposed servers.

Attackers are exploiting a flaw in Wing FTP Server before 7.4.4 that reveals where the software is installed to a logged-in user. The fix has been available since May 2025. Ask the administrator to update to a current release.

Two exploited flaws let malicious web pages corrupt Chrome's memory or run code within its sandbox. Desktop Chrome needs 146.0.7680.80 or later for both fixes; Edge Stable needs 146.0.3856.62 or later. Update to the latest release and relaunch.

Attackers used an n8n workflow-expression flaw to run code on automation servers. Businesses and family offices running n8n should install a current supported release: later expression escapes required further updates beyond the original fix.

Attackers are exploiting an old flaw in Omnissa Workspace ONE UEM management servers. Patches have existed since December 2021. Ask whoever manages your organisation’s devices to confirm its server is patched; updating your phone alone does not fix this.

Attackers are exploiting a flaw in Ivanti Endpoint Manager that exposes certain stored credentials without a login. It affects business management systems before EPM 2024 SU5. Ask your IT team to confirm the server has been updated.

SolarWinds Web Help Desk 12.8.7 and earlier has a login-free remote code execution flaw (CVE-2025-26399). CISA lists it as exploited. Organisations running it should install 12.8.7 Hotfix 1 or later and rotate credentials. Not a consumer product.

A flaw in Rockwell’s industrial controllers lets attackers with network access bypass checks and change controller settings or programs. CISA confirmed exploitation in March 2026. There is no patch: operators must apply Rockwell’s protective controls.

CISA listed an old Hikvision camera flaw (CVE-2017-7921) as exploited on 5 Mar 2026. Attackers can bypass login on unpatched cameras and recorders. Update the firmware from Hikvision, change default passwords, and don't expose the device to the internet.

A maximum-severity flaw (CVE-2026-20131) in Cisco Secure Firewall Management Center let anyone reach it over the network run code as root with no login. Interlock ransomware used it before the fix. Organisations running FMC should install Cisco's fixed release.

CISA lists VMware Aria Operations flaw CVE-2026-22719 as exploited. It permits commands without a login during support-assisted migration. Ask IT to install the fixed release; older Telco installations need Broadcom's upgrade guidance.

Coruna used malicious websites to compromise older iPhones for spying and cryptocurrency theft. Apple has released fixes, including iOS/iPadOS 15.8.7 and 16.7.15 for older devices. Install the latest update your device offers.

Google's March 2026 Android update fixes CVE-2026-21385, a Qualcomm memory flaw possibly used in limited, targeted attacks. CISA lists it as exploited. Install updates until your phone shows a security patch level of 2026-03-05 or later.

Two compromised Hightower accounts allowed January file theft affecting 131,483 people. Reported data includes names, Social Security and driving-licence numbers. Affected families should check credit reports and consider credit freezes.

Cyrus Finance, a yield protocol on BNB Chain, lost about US$512,000 to US$517,000 (not US$5 million) on 22 March 2026 when an attacker manipulated a PancakeSwap price. Funds went to Tornado Cash and no recovery is reported. If you used Cyrus, check with the team.

An attacker got Resolv's minting key, created 80 million unbacked USR stablecoins and cashed out about US$25M in ether on 22 March. USR lost its peg. Resolv offers pre-hack holders 1:1 USDC; no recovery of the stolen funds is reported.

Ransomware disrupted Foster City’s municipal services in March. Services returned on 16 April, but personal records may have been taken. Affected people should check their notification letters, use offered identity protection and monitor accounts.

Hackers copied confidential P3 crime and school-safety data, exposing tipsters and people named in reports. The 8.3 million figure counts records, not people. Ask your programme about exposure; Toronto has paused tips. Never share tip passwords with callers.

A phone-phishing attack on one Aura employee exposed about 900,000 marketing contacts, mostly names and emails from the acquired Circle business. Aura says no passwords, SSNs or financial data were taken. Expect scam emails or calls posing as Aura.

Attackers copied AssuranceAmerica insurance files affecting 6,998,886 people. Information varied, including driving-licence numbers and, for some, Social Security numbers. Check your notice, review credit reports and consider credit freezes.

A March cyberattack disrupted Intoxalock’s required ignition-interlock calibrations, leaving some US drivers unable to start their cars. Services resumed on 22 March. Follow device prompts and contact your service centre about any remaining lockout.

Telus Digital, the outsourced customer-support arm of Telus, confirmed unauthorised access to some systems after ShinyHunters claimed nearly 1 PB stolen. Volume and people affected are unconfirmed.

Crunchyroll confirmed a third-party support incident. Samples exposed customer identities and ticket contents; HIBP received 1.2 million email addresses. Watch for convincing fake support messages and change any password shared in a ticket.

A destructive attack on Stryker disrupted medical supplies and delayed some implant procedures. Manufacturing and ordering systems were restored by April. Stryker said its medical devices were unaffected; ask your care team about any delayed procedure.

KadNap malware has infected 14,000+ devices, mainly ASUS routers, and resells them as criminal proxies. About 60% are in the US. No takedown or ASUS fix was found in our search. Reboot, update firmware, change passwords, close remote admin, replace end-of-life routers.

A Loblaw breach affected approximately two million Canadians, exposing varying combinations of contact, birth date, loyalty, purchase and partial card details. Check your individual notice, verify unexpected messages and use the identity protection offered.

A CareCloud cloud breach affected 3,756,469 people, potentially exposing identity, medical and insurance details, plus some card data. Check your notice, use offered identity protection by 17 December, and review financial and insurance statements.

SafePay ransomware published data stolen from NSW's Smile Team Orthodontics, including hundreds of patient payment plans, some treatment histories and staff details. Patients should watch for phishing and unusual account activity, and wait for the practice's notice.

A Navia benefits breach affected about 2.7 million people, exposing identity and health-plan information. Affected US employees and former employees should check their notice, freeze their credit and review the offered identity protection.

Attackers stole Bitrefill’s crypto and gift-card inventory and accessed about 18,500 purchase records. Bitrefill said customer balances were unaffected. Customers should be cautious of unexpected Bitrefill or crypto messages; no software update is required.

Attackers poisoned Trivy (19 March) then LiteLLM 1.82.7/1.82.8 on PyPI (24 March) to steal cloud keys and secrets. Anyone who ran them or the altered Trivy actions should update and rotate every reachable secret. Little direct risk to home users.

Perseus is Android malware spread through sideloaded IPTV and free-sports streaming apps. It can take over a phone, steal banking logins and search notes apps for passwords and crypto recovery phrases. Don't install APKs from outside Google Play, and keep nothing secret in notes.

Nordstrom's real marketing email address was used to send a fake St Patrick's Day offer to double crypto sent to a wallet. Wallets took over US$5,600. Nordstrom disowned the emails. Delete any such message and never send crypto to a retailer.

Russian-linked attackers hijacked thousands of messaging accounts, targeting officials, military personnel and journalists. Never share verification codes, PINs or backup keys; check linked devices and replace any exposed Signal backup key.

Scammers sent LastPass customers fake support conversations about unauthorised account changes, linking to password-stealing pages. Open LastPass directly, ignore the email links and never disclose your master password. LastPass said its systems were unaffected.