The period from March 30-31, 2026 witnessed significant threat activity across multiple attack vectors. Critical vulnerabilities are being actively exploited in enterprise infrastructure, including a Fortinet FortiClient EMS flaw and a newly disclosed CISA KEV entry for Citrix NetScaler. The threat landscape includes 30 new CVE disclosures with five critical-severity vulnerabilities, several requiring immediate attention including privilege escalation flaws in WordPress plugins and authentication bypasses in OpenID Connect implementations. Malware distribution infrastructure remains highly active with 50 malicious URLs identified, primarily distributing Mozi botnet variants, ACRStealer, and ClearFake malware through compromised IoT devices and social engineering campaigns. A significant data breach at the European Commission was claimed by the ShinyHunters extortion gang, demonstrating continued targeting of high-value government entities. Organizations should prioritize patching Fortinet FortiClient EMS, Citrix NetScaler, and critical WordPress vulnerabilities while implementing enhanced monitoring for Mozi botnet activity and phishing campaigns leveraging fake verification pages.
Multiple critical vulnerabilities are under active exploitation or pose immediate risk to enterprise infrastructure, including authentication bypasses, privilege escalation, and remote code execution flaws.
Attackers are actively exploiting a critical vulnerability in Fortinet's FortiClient EMS platform according to Defused threat intelligence. This represents an immediate threat to organizations using FortiClient for endpoint management.
Significant malware distribution activity detected with 50 malicious URLs identified, primarily distributing Mozi botnet variants targeting IoT devices and ACRStealer/ClearFake campaigns using fake Google verification pages.
Widespread distribution campaign using fake Google verification pages hosted on multiple domains (fabledrift.in.net, skyl1tfern.in.net, mistlatch.in.net, silvershade.in.net, quillspire.in.net, ashenkite.in.net) delivering ACRStealer and ClearFake malware. 25+ malicious URLs identified.
High-profile data breach targeting European government infrastructure claimed by established extortion group.
The European Commission confirmed a data breach after the Europa.eu web platform was compromised. ShinyHunters extortion gang claimed responsibility, demonstrating continued targeting of government entities for data theft and extortion operations.
Additional high-severity vulnerabilities affecting widely deployed software including FreeRDP, GNU C Library, network equipment, and CMS platforms.
The iconv() function in glibc 2.43 and earlier crashes on IBM1390/IBM1399 character set conversions, enabling remote application crashes. Mitigated by removing affected character sets.