Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

mend

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install

Mar 31, 2026 By Tom Abai In Mend
On March 30-31, 2026, threat actors published two malicious versions of the popular HTTP library axios (versions 1.14.1 and 0.30.4) to the npm registry. Both versions included a new dependency named plain-crypto-js which, in its 4.2.1 release, contained a fully-featured cross-platform dropper that silently installed a Remote Access Trojan (RAT) on developer machines.
Read Post
cloudflare

Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers

Mar 31, 2026 By Anita Tenjarla In Cloudflare
We're proud to introduce Programmable Flow Protection: a system designed to let Magic Transit customers implement their own custom DDoS mitigation logic and deploy it across Cloudflare’s global network. This enables precise, stateful mitigation for custom and proprietary protocols built on UDP. It is engineered to provide the highest possible level of customization and flexibility to mitigate DDoS attacks of any scale.
Read Post
jfrog

From Shai-Hulud to LiteLLM: Supply Chain Attackers Are Coming for Your Agents

Mar 30, 2026 By Yuval Fernbach In JFrog
The LiteLLM supply chain compromise of March 24, 2026, is not an isolated incident. It is the latest and perhaps most dangerous chapter in an evolving attacker playbook that JFrog Security Research has been tracking for years. The target has shifted from developers to the AI agents that developers now rely on to build software.
Read Post
mend

Famous Telnyx Pypi Package compromised by TeamPCP

Mar 27, 2026 By Tom Abai In Mend
Part 1 covered CanisterWorm, the self-spreading npm worm. Part 2 covered the malicious LiteLLM package and its.pth persistence. This post covers the third wave: a compromised telnyxPyPI package that hides its payload inside audio files and delivers entirely different malware depending on the victim’s operating system.
Read Post
sedara

What the Stryker Cyber Incident Reveals About Todays Risk, Visibility, and Hardening

Mar 27, 2026 By Liz Sujka In Sedara
In March 2026, Stryker Corporation experienced a global cyber incident that disrupted operations across its environment. Manufacturing slowed, internal systems went offline, and employees were instructed to disconnect devices. At first glance, it looked like another large-scale cyberattack. It wasn’t. This incident exposed a much more important reality about modern cybersecurity risk: organizations are no longer being breached in traditional ways.
Read Post
acronis

What is a zero-day attack and how can you defend against one?

Mar 27, 2026 By Acronis In Acronis
Zero-day vulnerability: A security flaw in software, hardware, or firmware that is unknown to the vendor responsible for fixing it. Because no patch exists, the flaw is exploitable from the moment it is discovered by an attacker. Zero-day exploit: The specific technique, code, or method an attacker uses to take advantage of a zero-day vulnerability. A single vulnerability may have multiple exploits.
Read Post
Why Every Industry Now Needs Cybersecurity Leaders

Why Every Industry Now Needs Cybersecurity Leaders

Mar 27, 2026 By SecuritySenses In SecuritySenses
Cyberattacks are no longer rare events that only affect large tech firms. Many businesses today face constant attempts to access their systems, steal data, or disrupt operations. Even in growing cities like Wilmington, NC, where small businesses, startups, and universities are expanding their digital presence, this risk is becoming part of everyday business reality. Many organizations still rely only on technical teams to handle security, but that approach often falls short. Decisions about risk, spending, and response need leadership involvement.
Read Post
manageengine

The NotPetya attack: What it teaches us about cyber survival

Mar 25, 2026 By Sharon Natasha Francis In ManageEngine
In June 2017, the world witnessed one of the most destructive cyberattacks in history: the NotPetya attack. Unlike traditional ransomware, NotPetya was a wiper. Once it infected a system, recovery was impossible. The ransom demand was a ruse because no decryption keys were ever made available. The true intent of the attackers was to cause disruption and damage. Nearly a decade later, NotPetya is considered a turning point in how organizations approach backup and recovery. The threat has only grown.
Read Post
Arctic Wolf

TeamPCP Supply Chain Attack Campaign Targets Trivy, Checkmarx (KICS), and LiteLLM (Potential Downstream Impact to Additional Projects)

Mar 25, 2026 By Andres Ramos In Arctic Wolf
The threat actor TeamPCP has recently launched a coordinated campaign targeting security tools and open-source developer infrastructure by pivoting with stolen CI/CD secrets and signing credentials (such as GitHub Actions tokens and release signing keys). At the time of writing, repositories for Trivy, Checkmarx, and LiteLLM have been impacted, and reports indicate that at least 1,000 enterprise software-as-a-service (SaaS) environments may be affected by this threat campaign.
Read Post
keeper

How To Protect Patient Data From Phishing Attacks

Mar 24, 2026 By Ashley D'Andrea In Keeper
According to HIPAA Journal, phishing remains one of the most common and effective attack methods used against healthcare organizations and is a leading cause of healthcare data breaches. As healthcare becomes more digital, cybercriminals increasingly target clinicians and administrative staff to access Electronic Health Records (EHRs) and other Protected Health Information (PHI).
Read Post
bitsight

The Hidden Third-Party Risks Behind Domain Hijacking

Mar 23, 2026 By Emma Stevens In BitSight
Domains are foundational to digital trust. You visit your favorite online store or log in to your email without thinking twice about the web address in your browser. But what happens if that domain has been hijacked and you have just entered your personal information into an attacker’s trap?
Read Post
mend

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

Mar 21, 2026 By Tom Abai In Mend
On March 20, 2026 at 20:45 UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were receiving unauthorized patch updates, all containing the same hidden malicious code. What they had caught was CanisterWorm, a self-spreading npm worm deployed by the threat actor group TeamPCP. We track this incident as MSC-2026-3271.
Read Post
CrowdStrike

From Scanner to Stealer: Inside the trivy-action Supply Chain Compromise

Mar 20, 2026 By Adam Cardillo - Ben Ellett - Travis Lowe - Radu-Emanuel Chiscariu In CrowdStrike
While investigating a spike in script execution detections across several CrowdStrike Falcon platform customers, CrowdStrike’s Engineering team traced the activity to a compromised GitHub Action named aquasecurity/trivy-action. This popular open-source vulnerability scanner is frequently used in CI/CD pipelines.
Read Post
SIP Trunking Security in 2026: What Enterprises Must Know Before Their Next Breach

SIP Trunking Security in 2026: What Enterprises Must Know Before Their Next Breach

Mar 19, 2026 By SecuritySenses In SecuritySenses
Telecom fraud exceeded an estimated $41.82 billion in losses in 2025 - and a substantial share of that exposure runs directly through SIP trunks. The SIP trunking market itself reached $73.14 billion that same year, and is projected to more than double to $157.91 billion by 2030, according to Mordor Intelligence. That collision of rapid adoption and surging fraud is not a coincidence. Enterprises are migrating voice infrastructure to IP-based systems faster than security teams are adapting their threat models to cover them. In 2026, SIP trunking is business-critical infrastructure.
Read Post
bitsight

Are AI Security Tools the New EDR? Attackers Are Treating Them That Way

Mar 17, 2026 By Emma Stevens In BitSight
AI security tools are no longer just defensive layers. They are high value targets being studied, fingerprinted, and bypassed much like traditional endpoint detection and response (EDR) platforms and antivirus solutions were in their early days. The speed and scale at which these tools are being deployed makes reactive defense increasingly unsustainable.
Read Post
Cyber Warfare Comes to West Michigan: What the Stryker Cyberattack Means for Manufacturing

Cyber Warfare Comes to West Michigan: What the Stryker Cyberattack Means for Manufacturing

Mar 17, 2026 By Matt Kahle In SecuritySenses
In March 2026, one of West Michigan's most recognizable manufacturers found itself at the center of a major cybersecurity incident. Medical technology company Stryker, headquartered near Grand Rapids, experienced a widespread cyberattack that reportedly disrupted systems across its global network.
Read Post
graylog

The Stryker Cyberattack: Why Endpoint and Mobile Device Monitoring Matter

Mar 13, 2026 By Jeff Darrington In Graylog
Recent reports of a cyberattack targeting medical device manufacturer Stryker highlight a growing challenge for modern organizations: maintaining visibility across every device connected to their networks. The Michigan-based healthcare technology company reported a global network disruption affecting its Microsoft environment following a cyberattack.
Read Post
idstrong

What You Need to Know about the Stryker Cyberattack

Mar 13, 2026 By IDStrong In IDStrong
Stryker Corporation is a Fortune 500 medical technology company headquartered in Kalamazoo, Michigan. Founded in 1941, Stryker manufactures surgical equipment, orthopedic implants, neurotechnology, hospital beds, and robotic surgery systems. The company employs approximately 56,000 people globally and reported over $25 billion in revenue for 2025. Stryker's products reach more than 150 million patients annually across 61 countries.
Read Post
ciso global

Scorched Earth: Wiper Attacks are the New Face of Cyber War

Mar 13, 2026 By Chris Clements In CISO Global
Sure, they would vastly prefer targeting organizations in the opponent’s supply chain (which is why new requirements like CMMC are absolutely crucial), but every organization that is affiliated with or operates in the adversary’s territory becomes a target no matter how large or small.
Read Post
Meeting European Data Protection Standards in CRM Systems

Meeting European Data Protection Standards in CRM Systems

Mar 13, 2026 By SecuritySenses In SecuritySenses
If your business involves working with people in Europe, then it is likely that you are already familiar with the General Data Protection Regulation (GDPR). This system has revolutionized how businesses operate in regard to people's information since it was introduced. Not only does information need to be protected against breaches, but people's rights to their information must be respected. For most businesses, it is the CRM system that houses information. It is therefore important to ensure that your CRM system complies with these regulations in Europe. This is not just a technical requirement; it is a business imperative.
Read Post

What Healthcare Leaders Face After a Cyberattack

Mar 12, 2026 By Rubrik In Rubrik
In this episode of Building Cyber Resilience: A Healthcare Leader’s Guide, host Josh Howell speaks with Errol Weiss, Chief Security Officer at Health-ISAC. Drawing on decades of experience across government, finance, and healthcare, Errol walks through what leaders actually face in the hours and weeks following a cyberattack. The conversation explores why healthcare remains a top ransomware target, how uncertainty shapes recovery decisions, and why trusted, anonymous information sharing has become one of the sector’s strongest defenses.
View Video
knowbe4

FBI: Phishing Attacks Are Impersonating City and County Officials

Mar 12, 2026 By KnowBe4 Team In KnowBe4
The US Federal Bureau of Investigation (FBI) has issued an advisory warning of a phishing campaign that’s impersonating city and county officials to send phony requests for permit fees. “Individuals and businesses with active applications for land-use permits are being targeted by criminals impersonating city and county planning and zoning board officials, fraudulently requesting fees associated with these permits,” the FBI says.
Read Post
knowbe4

Ransomware Attacks Surge by 50% Even as Payments Drop

Mar 11, 2026 By KnowBe4 Team In KnowBe4
The number of ransomware attacks increased by 50% in 2025, even though the number of victims who decided to pay the ransom fell to an all-time low, according to a new report from Chainalysis. The size of the ransom for victims who did pay increased significantly, growing 368% year-over-year to nearly $60,000. The total ransom payments observed by Chainalysis last year amounted to $820 million.
Read Post
memcyco

How to Detect Account Takeover Attempts in the First 5 Minutes

Mar 9, 2026 By Ezra M. In Memcyco
Most ATO detection tools are watching the wrong moment. Attackers don’t start at your login page – they start days earlier, registering lookalike domains, cloning your site, and harvesting credentials before your stack sees a single signal. Knowing how to detect account takeover means moving detection upstream: to the reconnaissance stage, the cloning event, and the live harvesting window. That’s where the attack is stoppable.
Read Post
safeaeon

How to Prevent and Defend Against Spoofing Attacks

Mar 5, 2026 By SafeAeon Inc. In SafeAeon
In this age of computers and the internet, cyber risks like spoofing attacks are becoming more sophisticated and more harmful. Spoofing is when cybercriminals pretend to be legitimate entities, like companies, people, or websites, to trick people into giving up private information or doing malicious activities. Spoofing has significant effects, ranging from financial losses to reputational damage. According to Proofpoint’s research, over 90% of phishing attacks occur through email spoofing alone.
Read Post
fidelis security

How Does Endpoint Deception Detect Attacks Before Damage Happens?

Mar 5, 2026 By Fidelis Security In Fidelis Security
Let’s be honest. EDR has improved endpoint security dramatically over the last few years. It catches malware, blocks suspicious processes, and alerts on abnormal behavior. But no tool is perfect. Every detection model has blind spots. Attackers know this. They test environments. They move carefully. They use living-off-the-land techniques, stolen credentials, and legitimate tools. Sometimes, they move in ways that don’t immediately trigger alarms.
Read Post
fidelis security

Detecting Living-off-the-Land Attacks in OT Networks

Mar 5, 2026 By Fidelis Security In Fidelis Security
The most dangerous attacker inside your OT network right now may not have brought a single piece of malware with them. They’re using your own tools. Your own administrative credentials. Your own scheduled tasks and remote management utilities to execute malicious commands, move laterally, and quietly pre-position for a future disruption. This is living-off-the-land (LOTL), the dominant attack technique in critical infrastructure targeting today.
Read Post
memcyco

How LAPSUS$ Bypassed MFA and How to Prevent Similar Identity Attacks

Mar 4, 2026 By Julian Agudelo In Memcyco
LAPSUS$-linked breaches did not break multi-factor authentication (MFA) cryptographically. Attackers obtained valid authentication outcomes through techniques commonly described as MFA fatigue attacks or MFA bypass attacks, including push-prompt abuse, SIM swapping, social engineering, and session token replay. Understanding how these attacks succeed helps explain where modern identity defenses must evolve.
Read Post
wallarm

Everyone Knows About Broken Authorization - So Why Does It Still Work for Attackers?

Mar 2, 2026 By Wallarm In Wallarm
Broken authorization is one of the most widely known API vulnerabilities. It features in the OWASP Top 10, AppSec conversations, and secure coding guidelines. Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA) account for hundreds of API vulnerabilities every quarter. According to the 2026 API ThreatStats report, authorization issues ranked ninth in the API Top 10, “reflecting chronic difficulty in managing roles and permissions at scale.”
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.