SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites

An SQL injection vulnerability in Ally, a WordPress plugin from Elementor for web accessibility and usability with more than 400,000 installations, could be exploited to steal sensitive data without authentication. The security issue, tracked as CVE-2026-2313, received a high severity score. It was discovered by Drew Webber (mcdruid), an offensive security engineer at Acquia, a software-as-a-service company […]

Medtech giant Stryker offline after Iran-linked wiper malware attack

Update: Story updated with a statement from Stryker confirming they suffered a disruptive cyberattack. Leading medical technology company Stryker has been hit by a wiper malware attack claimed by Handala, an Iranian-linked and pro-Palestinian hacktivist group. The medtech giant manufactures a range of products, including surgical and neurotechnology equipment. With over 53,000 employees, Stryker is […]

New PhantomRaven NPM attack wave steals dev data via 88 packages

New attack waves from the ‘PhantomRaven’ supply-chain campaign are hitting the npm registry, with dozens of malicious packages that exfiltrate sensitive data from JavaScript developers. The campaign was initially uncovered in October 2025 by researchers at cybersecurity company Koi, who said that it had been running since August and published 126 malicious packages on the npm […]

New BeatBanker Android malware poses as Starlink app to hijack devices

A new Android malware named BeatBanker can hijack devices and tricks users into installing it by posing as a Starlink app on websites masquerading as the official Google Play Store. The malware combines banking trojan functions with Monero mining, and can steal credentials, as well as tamper with cryptocurrency transactions. Kaspersky researchers discovered BeatBanker in campaigns […]

New ‘Zombie ZIP’ technique lets malware slip past security tools

A new technique dubbed “Zombie ZIP” helps conceal payloads in compressed files specially created to avoid detection from security solutions such as antivirus and endpoint detection and response (EDR) products. Trying to extract the files with standard utilities like WinRAR or 7-Zip results in errors or corrupted data. The technique works by manipulating ZIP headers to trick parsing engines into […]

Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws

Tag CVE ID CVE Title Severity .NET CVE-2026-26131 .NET Elevation of Privilege Vulnerability Important .NET CVE-2026-26127 .NET Denial of Service Vulnerability Important Active Directory Domain Services CVE-2026-25177 Active Directory Domain Services Elevation of Privilege Vulnerability Important ASP.NET Core CVE-2026-26130 ASP.NET Core Denial of Service Vulnerability Important Azure Arc CVE-2026-26141 Hybrid Worker Extension (Arc-enabled Windows VMs) […]