• Microsoft has released its March 2026 Patch Tuesday updates, successfully addressing 79 security vulnerabilities across various products and mitigating two publicly disclosed zero-day flaws. These critical security updates provide essential fixes for enterprise systems, including Microsoft Windows, Office, SQL Server, and the .NET framework. March 2026 Vulnerability Overview The March 2026 Patch Tuesday addresses a […]

    The post Microsoft Fixes 79 Vulnerabilities in March 2026 Patch Tuesday, Mitigating Two Exploited 0-Days appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Fortinet has issued a security alert regarding a high-severity vulnerability affecting its FortiManager platform. Tracked as CVE-2025-54820 and carrying a CVSS score of 7.0, this flaw allows remote, unauthenticated attackers to execute unauthorized commands. Because FortiManager is designed to centrally manage multiple Fortinet security devices, securing these systems is critical to maintaining a strong network […]

    The post Fortinet FortiManager fgtupdates Flaw Enables Attackers to Execute Malicious Commands Remotely appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have discovered five malicious Rust crates that masquerade as time-related utilities to transmit .env file data to the threat actors. The Rust packages, published to crates.io, are listed below – chrono_anchor dnp3times time_calibrator time_calibrators time-sync The crates, per Socket, impersonate timeapi.io and were published between late February and early March

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A large-scale malware campaign known as PhantomRaven has resurfaced, targeting the npm software supply chain and attempting to steal sensitive developer credentials. The newly identified packages belong to three new phases of the campaign Wave 2, Wave 3, and Wave 4 distributed between November 2025 and February 2026. Despite the discovery and reporting of the […]

    The post PhantomRaven Malware Resurfaces, Targets npm Supply Chain to Steal Developer Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has disclosed a critical security flaw affecting SQL Server, officially tracked as CVE-2026-21262. Released on March 10, 2026, this elevation of privilege vulnerability exposes organizations to significant risks by allowing malicious actors to gain unauthorized control over enterprise database environments. With a maximum severity rating of “Important” and a CVSS 3.1 score of 8.8, […]

    The post Microsoft SQL Server Zero-Day Exposes Privilege Escalation Risk for Users appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing “zero-day” flaws this month (compared to February’s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month’s Patch Tuesday.

    Image: Shutterstock, @nwz.

    Two of the bugs Microsoft patched today were publicly disclosed previously. CVE-2026-21262 is a weakness that allows an attacker to elevate their privileges on SQL Server 2016 and later editions.

    “This isn’t just any elevation of privilege vulnerability, either; the advisory notes that an authorized attacker can elevate privileges to sysadmin over a network,” Rapid7’s Adam Barnett said. “The CVSS v3 base score of 8.8 is just below the threshold for critical severity, since low-level privileges are required. It would be a courageous defender who shrugged and deferred the patches for this one.”

    The other publicly disclosed flaw is CVE-2026-26127, a vulnerability in applications running on .NET. Barnett said the immediate impact of exploitation is likely limited to denial of service by triggering a crash, with the potential for other types of attacks during a service reboot.

    It would hardly be a proper Patch Tuesday without at least one critical Microsoft Office exploit, and this month doesn’t disappoint. CVE-2026-26113 and CVE-2026-26110 are both remote code execution flaws that can be triggered just by viewing a booby-trapped message in the Preview Pane.

    Satnam Narang at Tenable notes that just over half (55%) of all Patch Tuesday CVEs this month are privilege escalation bugs, and of those, a half dozen were rated “exploitation more likely” — across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server and Winlogon. These include:

    CVE-2026-24291: Incorrect permission assignments within the Windows Accessibility Infrastructure to reach SYSTEM (CVSS 7.8)
    CVE-2026-24294: Improper authentication in the core SMB component (CVSS 7.8)
    CVE-2026-24289: High-severity memory corruption and race condition flaw (CVSS 7.8)
    CVE-2026-25187: Winlogon process weakness discovered by Google Project Zero (CVSS 7.8).

    Ben McCarthy, lead cyber security engineer at Immersive, called attention to CVE-2026-21536, a critical remote code execution bug in a component called the Microsoft Devices Pricing Program. Microsoft has already resolved the issue on their end, and fixing it requires no action on the part of Windows users. But McCarthy says it’s notable as one of the first vulnerabilities identified by an AI agent and officially recognized with a CVE attributed to the Windows operating system. It was discovered by XBOW, a fully autonomous AI penetration testing agent.

    XBOW has consistently ranked at or near the top of the Hacker One bug bounty leaderboard for the past year. McCarthy said CVE-2026-21536 demonstrates how AI agents can identify critical 9.8-rated vulnerabilities without access to source code.

    “Although Microsoft has already patched and mitigated the vulnerability, it highlights a shift toward AI-driven discovery of complex vulnerabilities at increasing speed,” McCarthy said. “This development suggests AI-assisted vulnerability research will play a growing role in the security landscape.”

    Microsoft earlier provided patches to address nine browser vulnerabilities, which are not included in the Patch Tuesday count above. In addition, Microsoft issued a crucial out-of-band (emergency) update on March 2 for Windows Server 2022 to address a certificate renewal issue with passwordless authentication technology Windows Hello for Business.

    Separately, Adobe shipped updates to fix 80 vulnerabilities — some of them critical in severity — in a variety of products, including Acrobat and Adobe Commerce. Mozilla Firefox v. 148.0.2 resolves three high severity CVEs.

    For a complete breakdown of all the patches Microsoft released today, check out the SANS Internet Storm Center’s Patch Tuesday post. Windows enterprise admins who wish to stay abreast of any news about problematic updates, AskWoody.com is always worth a visit. Please feel free to drop a comment below if you experience any issues apply this month’s patches.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cal AI faces data breach claims after hackers post alleged data of 3 million users, including emails, health details, and subscriptions.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • HONOLULU—“What happens when you concentrate on one [AI] model and all of a sudden that model isn’t available to you?” That’s the reality that U.S. Indo-Pacific Command is living right now, its resources and requirements director said here Monday.

    The audience, after a beat, laughed cautiously at the realization that Bob Stephenson was likely referring to Anthropic’s Claude model.

    “It happens,” Stephenson said Monday at the Pacific Operational Science & Technology conference. “You know, I actually started thinking about this last September. We were working on a plan to be more model-neutral in our workforce. Now we’re just going faster.”

    More than a year ago, INDOPACOM integrated AI throughout its headquarters. Less than two weeks ago, President Trump directed federal agencies to stop using tools by Anthropic. And on Monday, the company sued the Pentagon, Defense Secretary Pete Hegseth, and others, claiming illegal retaliation.

    Stephenson, moderating a panel focused on advanced partnerships for multi-domain command and control, described his own “AI journey.” 

    “My challenge right now is: I’m trying—if you understand the seven functions of joint warfare…those things all happen simultaneously.”

    “If you’re going to send a ship into position to launch a missile…you have to worry about, does it have enough fuel to get there? Is it going to have to be refueled when it gets back? What about reloading? What’s the status of the launcher? What’s the status of the weapon? And so on and so forth. And so these things all interact. So we’re trying to use AI to create agentic workflows to allow us to do this at scale.”

    On the other side of the world, in Central Command, he said, “They’re executing about 1,000 fires a day. That’s a lot. That’s what we think, that’s what modern warfare looks like. They’re working really hard to try to stay up with this, and they’re using some AI tools that actually worked well for us.”

    Panelist Paul Gaertner, project leader for integrated command, control, communications and computing for the Australian Department of Defense, told the audience that he is worried about both under-trusting and over-trusting AI.

    Stephenson said he shares that concern. But when asked about allowing autonomous forms to manage themselves and mitigate their own risk, he said the answer is “sort of.”

    “My boss tells us that in offensive weapons, there must be human agency,” Stephenson said, referring to commander Adm. Sam Paparo. But for defensive weapons, “the criteria varies. If somebody is shooting at you, there’s much more latitude” in having systems to automatically defend against the threat.

    Stephenson, who retired from the Navy in 2003 after 30 years of service, noted that the U.S. has had autonomous weapons systems since he was a captain. 

    “There is a need for autonomy. There is a desire for autonomy at the edge, but with some of them, every weapon we have has a failsafe. We obviously don’t want to unleash a swarm that’s just going to fly around and go after the wrong thing. So there will be limits,” he said. But “we have these things called torpedoes that we have shot for, you know, a year or two, they worked out this thing called anti-circular run that kept the torpedo from zigzagging around” and coming back to “attack the thing that shot it. So think of a similar constraint for autonomous systems.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShinyHunters claims to have stolen data from 400 firms via Salesforce portals and is threatening to leak the information unless ransom demands are paid.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • China-linked hackers targeted Qatar using fake war news lures to spread PlugX backdoor malware and spy on military and energy sectors.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶