Good morning. This is your security briefing for Saturday, March 7th, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors, and all article analysis is automated.
According to research from Craig Rowland, a sophisticated passive network backdoor called BPFDoor has been attributed to Chinese state-sponsored APT group Red Menshen. The malware uses Berkeley Packet Filters to covertly sniff network traffic without opening visible listening ports, activates via magic packets across multiple protocols, and employs evasion techniques including RAM-based execution and process masquerading.
Radu Tudorica reports that APT36, also known as Transparent Tribe, a Pakistan-based threat actor, has adopted an AI-driven malware development strategy called 'vibeware' to generate numerous disposable implants in niche languages like Nim, Zig, and Crystal. The group primarily targets Indian government and diplomatic missions, using trusted cloud services like Slack, Discord, and Google Sheets for command and control infrastructure in what they call a 'Distributed Denial of Detection' approach.
CloudSEK has published a threat landscape assessment warning that multiple threat actors, including hacktivist groups motivated by the 2026 Iran-U.S. conflict, are actively targeting U.S. and allied critical infrastructure across energy, water, telecommunications, and transportation sectors. Attackers are exploiting internet-exposed ICS and OT devices via Shodan queries, launching spearphishing campaigns against SCADA engineers, and using living-off-the-land techniques for IT-to-OT lateral movement.
QwikDev has disclosed a critical remote code execution vulnerability in the Qwik JavaScript framework affecting versions up to 1.19.0. The vulnerability allows unauthenticated attackers to execute arbitrary code on servers through deserialization of untrusted data in the server$ RPC mechanism via a single HTTP request, and users are urged to upgrade to version 1.19.1 immediately.
Multiple sources report that two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, with CVSS scores of 9.8, are being actively exploited in Ivanti EPMM platforms. The flaws allow unauthenticated remote code execution through unsafe handling of attacker-controlled input in server-side Bash scripts, and attackers are exploiting them across government, healthcare, and manufacturing sectors globally to deploy backdoors, webshells, and malware. The German BSI has issued warnings about widespread exploitation affecting both active and End-of-Life EPMM appliances.
Spaceraccoon's blog details multiple critical vulnerabilities in the Tapo C260 webcam, tracked as CVE-2026-0651, CVE-2026-0652, and CVE-2026-0653, allowing Local File Disclosure and Remote Code Execution. The vulnerabilities stem from improper sanitization of URL-decoded paths and unsafe command execution, enabling attackers with even guest-level authentication to achieve full device compromise through path traversal and configuration manipulation.
Adnan Khan has discovered a supply chain vulnerability in Angular's GitHub repository development infrastructure that combines script injection in GitHub Actions workflows with cache poisoning techniques. The researcher developed a tool called Cacheract to automate cache poisoning, enabling escalation from limited script injection to token exfiltration and potential compromise of the angular-robot account with elevated privileges, though Google has since fixed the vulnerability with no risk to Angular users.
Mullvad VPN reports that Assured Security Consultants completed a security audit of GotaTun version 0.2.0, a WireGuard implementation. The audit identified two low-severity issues: predictable session identifiers using an 8-bit counter instead of random 32-bit integers, and incorrect payload padding that didn't align with WireGuard specifications, both of which have been patched.
Aqua Security has disclosed that the Trivy project experienced a supply chain attack on March 1st, 2026, originating from a compromised Personal Access Token exploited through GitHub Actions workflows. Attackers renamed the repository, deleted releases from versions 0.27.0 through 0.69.1, and published a malicious artifact to the Open VSIX marketplace, affecting users who downloaded binaries directly from GitHub.
tmp.out has announced a Linux Rootkit Competition targeting kernel version 6.18 LTS, designed to showcase advanced techniques in rootkit development including stealth, persistence, and detection evasion. Submissions will be evaluated on criteria including complexity, obfuscation, and novelty, with testing conducted in containerized environments.
According to research by Gi7w0rm on Medium, a global malvertising campaign is distributing a sophisticated AMOS Stealer variant called 'malext' targeting macOS users through compromised Google Ads accounts and free text-sharing platforms like Medium, kimi, and Evernote. The malware features anti-VM and sandbox evasion, credential theft, crypto wallet backdooring, and persistence mechanisms, with over 50 compromised Google Ads accounts and thousands of landing pages identified.
Security researcher Karsten Hahn tested Large Language Models including OpenAI GPT 5.1 and Claude Sonnet 4.6 for malware analysis capabilities and found that while LLMs can accelerate certain analysis tasks, they frequently produce inaccurate verdicts and generate convincing but factually incorrect security reports. The research highlights significant risks of misinformation and false security assessments when relying on LLM-generated malware analysis without proper human oversight.
Gen Digital Inc has introduced AARTS, which stands for An Open Standard for AI Agent Runtime Safety, a new vendor-neutral standard designed to enhance security in AI agent runtime environments. The standard defines lifecycle hook points, a common data model, and behavioral requirements to improve the security posture of AI agent deployments and facilitate consistent security controls across diverse AI systems.
Finally, Hex-Rays SA has released ida-cyberchef, a Qt-based tool that integrates CyberChef's data transformation capabilities directly into IDA Pro for malware analysis workflows. The tool embeds CyberChef's JavaScript engine within IDA Pro's interface and can be installed via the IDA Pro plugin manager, enabling analysts to leverage CyberChef's data manipulation features without leaving their analysis environment. That concludes today's briefing.
That concludes today's briefing.