This briefing covers the 24-hour period from March 26-27, 2026, revealing a significant vulnerability landscape with multiple critical security flaws and active malware distribution campaigns. The period saw 30 new CVE entries, including four CRITICAL severity vulnerabilities (CVSSv3 9.0+) affecting widely-used systems including Ory Oathkeeper (authentication bypass via path traversal), SiYuan personal knowledge systems (unauthorized document access), Incus container managers (arbitrary file read/write), and Tandoor Recipes (authentication framework weakness). Additionally, CISA added one new Known Exploited Vulnerability (KEV) affecting Aquasecurity Trivy with an embedded malicious code vulnerability that exposes CI/CD credentials.
Malware distribution activity remained substantial with 51 malicious URLs identified by abuse.ch, predominantly distributing Mozi and Mirai IoT botnet variants alongside ClearFake browser update scams. The ClearFake campaign showed particular sophistication with 20 distinct URLs using deceptive Google verification themes across multiple infrastructure clusters. IoT-focused threats targeted ARM and MIPS architectures through compromised devices, while a Smoke Loader/Amadey dropper campaign was observed targeting Windows systems.
Organizations should prioritize immediate patching of the CISA KEV entry affecting CI/CD pipelines, assess exposure to the four critical vulnerabilities (particularly the Ory Oathkeeper path traversal allowing complete authentication bypass), and strengthen IoT device security postures against ongoing botnet recruitment campaigns. The absence of honeypot telemetry and enrichment alerts limits deeper tactical analysis for this period.
Four critical-severity vulnerabilities and one CISA KEV demand immediate remediation across CI/CD, authentication, and container management systems.
CISA KEV: Embedded malicious code in Trivy scanner allows attackers to access all CI/CD environment secrets including tokens, SSH keys, cloud credentials, and database passwords. Immediate remediation required.
Multiple Ory framework products contain SQL injection flaws in pagination token handling, exposing sensitive data across Hydra, Keto, and Kratos platforms.
Multiple high-severity authentication bypass and access control vulnerabilities affecting various platforms including Ory Oathkeeper, Ory Polis, and payment SDKs.
Multiple buffer overflow and remote code execution vulnerabilities identified in Tenda routers and Ruckus wireless systems.
File handling vulnerabilities enabling arbitrary file access and upload bypass across multiple content management and file-sharing platforms.
Cross-site scripting, host header injection, and API security vulnerabilities affecting web applications and frameworks.
Regular expression and memory management vulnerabilities enabling denial of service conditions.
Glob matcher vulnerable to Regular Expression Denial of Service when processing crafted extglob patterns with overlapping quantifiers.
Multiple sequential optional groups generate exponentially growing regex patterns, causing denial of service.
Sensitive data exposure issues affecting monitoring systems and image processing applications.
Miscellaneous high-severity vulnerabilities including XML signature bypass and compiler buffer overflow.
validateSignature function uses map iteration to match references, causing non-deterministic behavior in Go <1.22 that may bypass signature validation.
Widespread ClearFake malware distribution campaign using fake Google verification themes across 20 malicious domains targeting browser users.
20 distinct malicious URLs identified hosting ClearFake fake browser update pages masquerading as Google verification. Domains span multiple infrastructure clusters including blackpeakstorage, whitetideinterface, coldstonemetrics, wildbranchcluster, ironrootprocessor, darkcloudgateway, bluepointterminal, and donkeyemploy networks.
Extensive IoT malware distribution targeting ARM and MIPS architectures with 26 malicious URLs delivering Mozi and Mirai botnet payloads.
Multiple IP addresses distributing 32-bit ELF Mozi variants for MIPS architecture devices through /bin.sh and /i endpoints. Source IPs include 91.143.172.196, 217.208.164.149, 115.58.170.232, 110.39.235.153, 59.88.4.199, 117.209.95.226, 27.193.157.41, 115.55.222.214, and 59.95.91.84.
Smoke Loader and Amadey dropper campaign observed delivering secondary payloads to Windows systems.