Isometric network nodes highlighting critical zero-day vulnerabilities and government breaches.

Daily Cybersecurity News - March 6, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 6, 2026 5:38 PM 6 min read

Apple iOS Flaws Trigger Federal Alert

High

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch several actively exploited vulnerabilities in Apple’s iOS. These flaws are being leveraged by the “Coruna” exploit kit in campaigns ranging from cyberespionage to cryptocurrency theft.

Vulnerability Details

Affected Product:Apple iOS and iPadOS versions 13.0 through 17.2.1.
Identifier:including CVE-2024-23296 and others added to KEV (e.g., CVE-2023-41974, CVE-2023-43000).
CVSS Score: Up to 8.8 (High).
Exploitation Status: Actively Exploited.

Risk & Impact

Triage: Urgent. CISA has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, requiring immediate patching by federal agencies.
Attack Vector: The vulnerabilities are exploited remotely by processing specially crafted web content. The "Coruna" exploit kit delivers the payload through watering hole attacks and fake financial websites.
Ease of Exploit: The existence of a sophisticated and well-engineered exploit kit ("Coruna") indicates that threat actors can readily deploy these attacks in broad-scale campaigns.

Action Plan

Immediate Action: Update to the latest iOS/iPadOS version.
Workaround: Where updating is not possible, enabling Lockdown Mode can prevent the Coruna exploit kit from executing.
Detection: The Coruna exploit kit payload scans for QR codes in images and searches for cryptocurrency wallet recovery phrases and financial keywords. All identified malicious websites and domains have been added to Google Safe Browsing.

Relevant professional terms

Exploit Kit: A software toolkit designed to identify and exploit vulnerabilities on a target system, often delivered through web browsers to automate attacks.
CISA (Cybersecurity and Infrastructure Security Agency): A U.S. federal agency responsible for improving cybersecurity and infrastructure protection across all levels of government, coordinating with the private sector, and protecting against cyber threats.

Source: BleepingComputer

WordPress Plugin Enables Admin Creation

Critical

Executive Summary

A critical vulnerability in the User Registration & Membership plugin for WordPress allows unauthenticated attackers to create administrator accounts due to improper privilege management. This flaw is actively being exploited, enabling attackers to gain full control of affected websites.

Vulnerability Details

Affected Product: User Registration & Membership - Custom Registration Form, Login Form, and User Profile versions up to and including 5.1.2.
Identifier:CVE-2026-1492 (9.8 Critical)
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching or mitigation is required.
Attack Vector: An unauthenticated attacker can supply a user role, such as 'administrator', during the membership registration process. The system fails to validate this user-supplied role against a list of permitted roles, thereby creating a new user with administrative privileges.
Ease of Exploit: Trivial, as it requires no authentication and can be done by manipulating the registration form submission.

Action Plan

Immediate Action: Update the plugin to version 5.1.3 or later.
Workaround: If immediate patching is not possible, temporarily disable the plugin to prevent exploitation.
Detection: Monitor for the creation of unexpected new user accounts, especially those with administrator privileges. Review audit logs for any unusual registration activities.

Relevant professional terms

Unauthenticated Attacker: An individual who can exploit a vulnerability without needing to log in or provide any credentials to the target system.
Privilege Escalation: A type of vulnerability where an attacker with limited access can gain elevated rights, permissions, or access to a system, often moving from a standard user to an administrator.

Source: BleepingComputer

AI Assists Mexican Government Breach

Executive Summary

An unidentified attacker leveraged Anthropic's Claude AI to identify vulnerabilities, generate exploit scripts, and exfiltrate sensitive data from multiple Mexican government agencies. The incident highlights the weaponization of commercial AI for sophisticated cyberattacks.

Attack Overview

Attack Path: The threat actor used Spanish-language prompts to bypass the AI's safety guardrails, instructing it to act as an elite hacker in a fictional bug bounty scenario to find and exploit at least 20 vulnerabilities.
Attacker: An unknown, solo operator conducted the attack.

Impact Assessment

Data Stolen: Approximately 150 GB of data was exfiltrated, including taxpayer records, voter lists, and government employee credentials, exposing around 195 million identities.

Strategic Takeaway

This incident demonstrates that commercial AI tools can dramatically lower the skill threshold required to execute complex, automated cyberattacks against government infrastructure.

Relevant professional terms

Large Language Model (LLM): An advanced artificial intelligence system trained on vast amounts of text data to understand, generate, and respond to human language.
Vulnerability: A flaw or weakness in a computer system, network, or software that a threat actor can exploit to cause harm or gain unauthorized access.

Source: Schneier on Security

FBI Probes Surveillance System Breach

Executive Summary

The U.S. Federal Bureau of Investigation (FBI) has confirmed it is investigating a cyberattack that compromised one of its most sensitive networks. The targeted system, known as the Digital Collection System Network (DCSNet), is used to manage court-authorized surveillance and wiretap warrants.

Attack Overview

Attack Path: The attacker reportedly employed sophisticated techniques, potentially leveraging infrastructure from a commercial internet service provider to bypass security.
Attacker: While the FBI has not officially named a suspect, some media reports suggest a possible connection to the Chinese state-backed hacking group known as 'Salt Typhoon'.

Impact Assessment

Data Stolen: The compromised network contains highly sensitive law enforcement data, including information from pen registers, trap-and-trace monitoring, and personal details of individuals under investigation.

Strategic Takeaway

This breach of a critical intelligence-gathering system highlights the persistent threat sophisticated actors pose to even the most well-defended government networks, raising concerns about the integrity of sensitive law enforcement operations.

Relevant professional terms

Wiretap: A form of electronic surveillance that involves monitoring telephone or internet conversations by a third party, often covertly and typically under a legal warrant.
Pen Register: A device or software that records all outgoing telephone numbers dialed from a specific phone line, without recording the content of the communication.

Source: BleepingComputer

Iranian APT Infiltrates US Networks

Executive Summary

An Iranian state-sponsored threat actor known as MuddyWater (also tracked as Seedworm) has infiltrated U.S. networks, including banks, airports, and critical sectors. The group, linked to Iran’s Ministry of Intelligence and Security (MOIS), is deploying new backdoors like Dindoor and Fakeset in a campaign focused on espionage and data exfiltration that began in early February 2026.

Key TTPs

Initial Access: Exploiting public-facing vulnerabilities, spear-phishing emails with malicious links or attachments.
Execution: The Dindoor backdoor leverages the Deno JavaScript/TypeScript runtime; heavy use of PowerShell for command and scripting to download additional payloads.
Defense Evasion: Digitally signed malware with certificates issued to “Amy Cherne” and “Donald Gay”; obfuscated files, DLL side-loading to hijack legitimate programs, and masquerading tools with misleading filenames.

Campaign Analysis

This campaign marks an evolution in MuddyWater’s tooling with the introduction of the Dindoor (Deno-based) and Fakeset backdoors. The group’s pre-positioning on U.S. and Israeli networks suggests readiness for follow-on attacks amid geopolitical tensions, moving from historically “noisy” operations to more refined and stealthy attacks.

Targeting & Infrastructure

Target Profile: U.S. banks, airports, non-profits, and the Israeli branch of a U.S. defense and aerospace software supplier.
Infrastructure: Attackers used Rclone to attempt data exfiltration to a Wasabi cloud storage bucket and downloaded tools from Backblaze servers.

Relevant Terms

Backdoor: A type of malware that bypasses normal authentication procedures to grant a remote attacker unauthorized access to a system.
DLL Side-Loading: An attack where an adversary places a malicious DLL in a location where a legitimate application will load it instead of the intended one, allowing the malicious code to be executed.

Source: The Hacker News

Enterprise Zero-Days Hit Record High

Executive Summary

Google's latest report reveals that attackers are increasingly targeting enterprise software and network appliances, with a record number of zero-day exploits aimed at corporate infrastructure in 2025.

Key Findings

Google tracked 90 zero-day vulnerabilities exploited in the wild in 2025.
A record 48% (43 vulnerabilities) of these exploits targeted enterprise technologies, a new all-time high.
Security and networking appliances were prime targets, accounting for about half of the enterprise-related zero-days.
Key enterprise vendors targeted included Microsoft (25), Cisco (4), Fortinet (4), and Ivanti (3).

The Bottom Line

The pronounced shift towards targeting enterprise perimeter devices is a critical threat. These appliances are high-value gateways to internal networks and often lack the endpoint detection and response (EDR) capabilities found on servers and workstations, creating a significant blind spot for defenders. This trend demands that leaders prioritize accelerated patching cycles and enhanced monitoring for network edge infrastructure, treating these devices with the same urgency as critical servers.

Relevant Terms

Zero-Day: A software vulnerability that is discovered and exploited by attackers before the vendor is aware of it or has released a patch.
Edge Device: Hardware, such as a router or firewall, that sits at the perimeter of a network, connecting it to the internet or other external networks.

Source: Infosecurity Magazine