Geometric network illustrating multiple software vulnerabilities and AI-weaponized cyberattacks.

Daily Cybersecurity News - March 8, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 8, 2026 3:12 PM 6 min read

OCaml Flaw Enables Remote Code Execution

High

Executive Summary

A high-severity buffer over-read vulnerability, CVE-2026-28364, exists in OCaml's Marshal deserialization process. This flaw stems from missing bounds validation and allows remote attackers to execute arbitrary code through a multi-phase attack. Patches are available in versions 4.14.3 and 5.4.1 and should be applied immediately.

Vulnerability Details

Affected Product: OCaml (versions before 4.14.3 and 5.x before 5.4.1)
Identifier: CVE-2026-28364
CVSS Score: 7.9 (High)
Exploitation Status: No known active exploitation.

Risk & Impact

Triage: Critical. Immediate patching is recommended due to the potential for remote code execution.
Attack Vector: A remote attacker can send crafted Marshal data to a vulnerable application. The lack of bounds checking in the `readblock()` function allows an unbounded `memcpy()` operation, leading to a buffer over-read that can be chained to achieve code execution.
Ease of Exploit: The attack complexity is considered low, and it requires no user interaction or special privileges.

Action Plan

Immediate Action: Upgrade OCaml to version 4.14.3 or 5.4.1 or a later version.
Workaround: No specific workarounds have been provided. Prioritize applying the available patches.
Detection: Monitor applications that utilize OCaml's Marshal module for abnormal behavior, unexpected process terminations, or crashes that could indicate exploitation attempts.

Relevant professional terms

Deserialization: The process of converting data from a stored or transmittable format (like a byte stream) back into an object. If an application deserializes untrusted data without proper validation, it can lead to severe vulnerabilities like remote code execution.
Buffer Over-read: A vulnerability where a program reads data beyond the boundary of a buffer. This can lead to the disclosure of sensitive information, system crashes, or be leveraged by an attacker to bypass security mechanisms.

Source: Microsoft Security Response Center

Cisco SD-WAN Flaw Sees Mass Exploitation

Critical

Executive Summary

A critical authentication bypass vulnerability in Cisco Catalyst SD-WAN products, identified as CVE-2026-20127, is being actively and widely exploited. The flaw allows unauthenticated, remote attackers to gain administrative privileges on affected systems.

Vulnerability Details

Affected Product: Cisco Catalyst SD-WAN Manager (formerly vManage) and Controller (formerly vSmart) in versions prior to 20.9.1, and specific 20.9.x, 20.12.x, 20.15.x, and 20.18.x releases.
Identifier: CVE-2026-20127
CVSS Score: 10.0 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate patching is required due to widespread, active exploitation and the critical nature of the vulnerability. Any exposed system should be considered compromised until investigated.
Attack Vector: A remote, unauthenticated attacker can bypass authentication by sending crafted requests to an affected system's peering authentication mechanism. This allows the attacker to log in with administrative privileges, manipulate network configurations, and insert rogue devices.
Ease of Exploit: The exploit is being used in widespread, opportunistic attacks, indicating a low barrier to exploitation.

Action Plan

Immediate Action: Upgrade to a fixed software release immediately. Patched versions include 20.9.8.2, 20.12.6.1, 20.15.4.2, and 20.18.2.1.
Workaround: There are no workarounds that address this vulnerability.
Detection: Monitor for log entries in /var/log/auth.log that may indicate compromise and review systems for any unauthorized or rogue peer devices added to the SD-WAN configuration. Threat actors have been observed deploying webshells.

Relevant professional terms

SD-WAN (Software-Defined Wide Area Network): A virtualized network architecture that simplifies the management and operation of a wide area network (WAN) by decoupling the networking hardware from its control mechanism.
Webshell: A malicious script uploaded to a server that enables a threat actor to maintain persistence and execute arbitrary commands on the server remotely.

Source: SecurityWeek

Hackers Abuse DNS to Bypass Security

Executive Summary

Threat actors are abusing the infrastructure-only .arpa domain and IPv6 reverse DNS to host phishing campaigns. This novel technique allows them to bypass traditional security controls that rely on domain reputation, increasing the likelihood of successful attacks.

Key TTPs

Initial Access: Phishing emails, often impersonating major brands with "free gift" lures, contain a single hyperlinked image.
Defense Evasion: Malicious links use an IPv6 reverse DNS string within the .arpa domain, which is implicitly trusted and often not inspected by security tools.

Campaign Analysis

This campaign weaponizes core internet infrastructure that security tools are not designed to inspect for web content. By abusing the trusted .arpa namespace, attackers bypass reputation and policy-based defenses that are ineffective against these domains.

Targeting & Infrastructure

Target Profile: The campaign appears opportunistic, targeting a wide range of victims with brand impersonation lures.
Infrastructure: Attackers use free IPv6 tunnel services to acquire IP addresses and gain control of the corresponding reverse DNS zone.

Relevant Terms

.arpa: A top-level domain used exclusively for internet infrastructure purposes, such as reverse DNS lookups, and not intended for hosting public websites.
Reverse DNS (rDNS): A system that looks up a domain name associated with a given IP address, the opposite of a standard (forward) DNS query.

Source: BleepingComputer

Actors Exploit ClickFix for Ransomware Delivery

Executive Summary

The threat actor Velvet Tempest is leveraging a social engineering technique known as "ClickFix" to deploy the DonutLoader malware and CastleRAT backdoor. This campaign uses malvertising and legitimate Windows utilities to gain initial access and stage payloads for eventual ransomware attacks.

Key TTPs

Initial Access: Malvertising campaigns redirect users to pages with fake CAPTCHA or error messages, tricking them into pasting a malicious command into the Windows Run dialog.
Execution: The initial command uses legitimate Windows tools like PowerShell and cmd.exe to download and run subsequent payloads.
Defense Evasion: Actors use legitimate utilities (LOLBins) like csc.exe to compile .NET components, blending in with normal system activity.

Campaign Analysis

This campaign showcases a multi-stage intrusion chain that relies on user interaction to bypass initial security controls. The use of ClickFix demonstrates a growing trend of social engineering to execute code and deploy sophisticated malware like the CastleRAT backdoor.

Targeting & Infrastructure

Target Profile: The observed attack was against a simulated U.S. non-profit organization. Velvet Tempest has historically targeted a wide range of industries, including IT, manufacturing, and energy.

Relevant Terms

CastleRAT: A Remote Access Trojan (RAT) that allows an attacker to take remote control of a victim's machine, enabling activities like data theft, keylogging, and deploying additional malware.
ClickFix: A social engineering technique that tricks users into copying and executing malicious code, often PowerShell commands, under the guise of fixing a fake technical problem or completing a CAPTCHA verification.

Source: BleepingComputer

Hackers Weaponize AI To Accelerate Attacks

Executive Summary

Microsoft reports that state-affiliated threat actors are using Large Language Models (LLMs) at every stage of the cyberattack lifecycle. This adoption of AI serves as a "force multiplier," lowering technical barriers and enabling attackers to scale and accelerate their malicious operations.

Key Findings

Nation-state actors like Russia's Forest Blizzard and North Korea's Emerald Sleet use AI for reconnaissance, scripting, and social engineering.
AI is used to generate convincing phishing emails, debug malware, and summarize stolen data, streamlining attack execution.
North Korean groups, specifically Jasper Sleet and Coral Sleet, use AI to create fraudulent remote IT worker personas to infiltrate Western companies.

The Bottom Line

The integration of AI into cyberattacks fundamentally lowers the barrier for entry, allowing less-skilled actors to perform sophisticated operations. This trend forces a strategic shift for defenders, who must now assume that adversaries can operate at machine speed. Security leaders must prioritize AI-driven defensive mechanisms and Zero Trust architectures to counter these evolving, accelerated threats.

Relevant Terms

Threat Actor: An individual or group that performs malicious activities against digital assets.
Large Language Model (LLM): An AI algorithm trained on vast amounts of text data to understand, generate, and translate human-like language.

Source: BleepingComputer