![Cybersecurity News | Daily Recap [07 Mar 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [07 Mar 2026]")
Daily Recap, several high-profile vulnerabilities were disclosed, including a WordPress membership plugin flaw that can create unauthorized administrator accounts and iOS vulnerabilities exploited by the Coruna exploit kit, used by UNC6353 and UNC6691 to enable remote code execution, kernel privilege escalation, and crypto theft. The coverage also highlights APT36’s Vibeware campaign against Indian government networks, InstallFix infostealers, a self-propagating Wikipedia JavaScript worm, the TriZetto Provider Solutions breach affecting millions, and Microsoft 365 Backup’s upcoming file- and folder-level restore feature.
#Coruna #UNC6353 #UNC6691 #APT36 #Vibeware #InstallFix #WikipediaWorm #TriZettoProviderSolutions #Microsoft365Backup #SharePoint #OneDrive
#Coruna #UNC6353 #UNC6691 #APT36 #Vibeware #InstallFix #WikipediaWorm #TriZettoProviderSolutions #Microsoft365Backup #SharePoint #OneDrive
Vulnerabilities & Exploits
- WordPress membership plugin flaw is being exploited to create unauthorized administrator accounts on sites – WP Membership
- CISA ordered federal agencies to patch three iOS flaws exploited by the Coruna exploit kit (used by groups including UNC6353 and UNC6691) enabling remote code execution, kernel privilege escalation and crypto theft – iOS Flaws
Malware & Campaigns
- Pakistan-linked APT36 is flooding Indian government networks with low-quality, AI-generated “Vibeware” written in niche languages (Nim, Zig, Crystal), using Google Sheets and Discord for C2 and deploying tools like LuminousCookies and BackupSpy to steal credentials and documents – APT36 Vibeware
- Fake “Claude Code” install guides are being used to distribute infostealers in ongoing InstallFix attacks that trick users into sideloading malicious payloads – InstallFix Infostealer
- A self-propagating JavaScript worm briefly infected Wikimedia’s Meta‑Wiki, injecting malicious loaders into common.js files and global MediaWiki scripts, vandalizing thousands of pages during a ~23-minute window while engineers disabled editing and removed the code with no evidence of data breach – Wikipedia Worm
Breaches & Data Exposures
- TriZetto Provider Solutions disclosed unauthorized access to an insurance eligibility portal exposing sensitive information for 3,433,965 individuals, offering 12 months of identity protection and reporting no confirmed misuse to date – TriZetto Breach
Products & Recovery
- Microsoft will add granular file- and folder-level restore to Microsoft 365 Backup (public preview March 2026, GA expected late April–early May 2026), allowing admins with the SharePoint Backup Administrator role to browse and recover individual files from SharePoint and OneDrive – M365 Backup
Training & Governance
- EC‑Council launched the Enterprise AI Credential Suite (role-based certs AIE, CAIPM, COASP, CRAGE) and updated Certified CISO v4 to address a projected $5.5 trillion unmanaged AI risk and a 700,000-person U.S. reskilling shortfall – AI Certs