DFIRLab
All Briefings
weeklyMarch 2, 2026 — March 9, 2026Published 07:00 UTC

Weekly Threat Briefing — 2026-03-02 to 2026-03-09

40 findings90 articles9 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
90 Articles833 CVEs3,341 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 29
Browse all 40 findings

Executive summary · as of 07:00 UTC

The situation

The March 2-9, 2026 period saw critical threats emerge across multiple attack vectors. Nation-state actors increasingly weaponized AI for malware development and social engineering, while commercial spyware targeted mobile platforms using zero-day exploits. A Cisco Fireware OS remote code execution vulnerability (CVE-2026-20131, CVSS 10.0) enables unauthenticated attackers to execute arbitrary Java code as root. Multiple critical vulnerabilities affecting Chamilo LMS, OpenClaw, and authentication systems demonstrate ongoing risks from insecure deserialization and authentication bypass patterns. Security teams should prioritize patching critical infrastructure flaws, especially in network appliances and authentication systems, while monitoring for AI-enhanced social engineering campaigns and ClickFix/InstallFix attack variants targeting developer tools.

Browse the full briefing

40 findings · 9 sections
Findings by severity
  • 9 critical
  • 20 high
  • 8 medium
  • 3 low
Vulnerabilities3 critical · 2 high

Critical Infrastructure and Authentication Vulnerabilities

Multiple critical-severity flaws in network infrastructure and authentication systems present immediate risk of complete system compromise.

Malware5 high

Ransomware, Infostealers, and Social Engineering Campaigns

Sophisticated malware campaigns targeting developers, cryptocurrency users, and corporate environments through fake installers and browser-based attacks.

Threat Actors4 high · 1 medium

Nation-State and APT Activity

State-sponsored actors increasingly leverage AI capabilities for enhanced operations while targeting critical infrastructure and telecommunications.

Tools & Techniques3 high · 2 medium

Attack Techniques and Exploit Developments

Novel attack techniques including OAuth abuse, prompt injection, and infrastructure vulnerabilities demonstrate evolving threat actor capabilities.

Vulnerabilities1 critical · 3 high

Mobile and IoT Device Vulnerabilities

Critical mobile platform and IoT vulnerabilities exploited in targeted attacks, particularly affecting Apple iOS and Qualcomm chipsets.

Policy3 medium · 1 low

Policy, Compliance, and Legal Developments

Significant law enforcement actions and regulatory developments affecting cybersecurity landscape and emerging technologies.

DFIR Lab2 medium · 2 low

Digital Forensics Research and Tooling

New forensic tools and research addressing mental health challenges in the DFIR profession while expanding investigative capabilities.

Vulnerabilities3 critical · 1 high

Enterprise Application and CMS Vulnerabilities

Critical vulnerabilities in widely-deployed enterprise applications and content management systems requiring immediate patching.

Vulnerabilities2 critical · 2 high

Open Source and Developer Tool Vulnerabilities

Critical security issues affecting popular development tools and frameworks expose supply chain risks.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.