Daily Cybersecurity News - March 3, 2026

Google has released an emergency security update to address a high-severity zero-day vulnerability, identified as CVE-2026-21385, in a Qualcomm Graphics component. The flaw is confirmed to be under limited, targeted exploitation and could allow for memory corruption.

A critical vulnerability, identified as CVE-2026-2256, in the ModelScope MS-Agent framework allows for arbitrary command execution due to improper input sanitization. A patch has been issued, and users should update to the latest version to mitigate the risk of a full system compromise.

Adversaries are embedding hidden instructions in web content to manipulate AI agents and Large Language Models (LLMs). This technique, known as indirect prompt injection, is being used in real-world attacks to commit high-impact fraud.

This attack vector marks a shift from theoretical to practical exploitation, weaponizing the trusted functionality of AI assistants to bypass traditional security controls. These real-world attacks demonstrate a new class of vulnerability where the AI itself becomes an unwitting accomplice.

Google's Threat Intelligence Group (GTIG) has identified "Coruna," a powerful exploit kit with five full exploit chains targeting Apple iPhones. The kit affects iOS versions from 13.0 up to 17.2.1 and has been used in various campaigns, from targeted surveillance to broader attacks.

The Coruna kit demonstrates how sophisticated exploits proliferate from surveillance vendors to state-sponsored espionage groups and financially motivated actors. This suggests an active market for "second hand" zero-day exploits, allowing various threat actors to acquire and repurpose advanced capabilities.

Unidentified actors executed physical drone strikes against Amazon Web Services (AWS) data centers in the Middle East. The attacks aimed to disrupt critical cloud infrastructure, causing widespread service outages in the United Arab Emirates and Bahrain.

This incident highlights the vulnerability of digital infrastructure to kinetic, real-world attacks. The physical damage from drone strikes led to significant and prolonged cloud service disruptions, demonstrating a critical threat vector where physical conflict directly impacts cyber operations.

A newly announced quantum algorithm drastically reduces the resources needed to break modern encryption, suggesting the threat to RSA and ECC is much closer than previously anticipated.

This development fundamentally shortens the timeline for the quantum threat. The feasibility of breaking current encryption standards is no longer a distant, decade-away problem. This finding creates urgency for organizations to accelerate their transition to post-quantum cryptography (PQC) to protect against "harvest now, decrypt later" attacks.

CyberStrikeAI is an open-source, AI-native security testing platform being adopted by threat actors to automate attacks against network infrastructure. It integrates over 100 security tools, enabling end-to-end automation from vulnerability discovery to attack-chain analysis.

This tool significantly lowers the barrier for threat actors to conduct sophisticated, large-scale attacks. Red teams can use it for advanced testing, while blue teams must adapt to detect AI-driven reconnaissance and exploitation, particularly against vulnerable edge devices like FortiGate firewalls.

CyberStrikeAI is an open-source tool available on GitHub.