Week of March 9, 2026: Salesforce Data-Theft Claim, Russian Signal/WhatsApp Hacking

Security leaders faced a week dominated by CISA's rapid-fire Known Exploited Vulnerabilities additions, a Salesforce Experience Cloud data-theft campaign claimed by ShinyHunters, and Dutch intelligence warnings that Russian state hackers were targeting officials' Signal and WhatsApp accounts. Microsoft's March Patch Tuesday, ESET's disclosure of Sednit's BeardShell and Covenant espionage toolkit, and the White House's new Cyber Strategy for America rounded out a week focused on patching urgency and nation-state activity.

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

On March 9, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: an Omnissa Workspace ONE server-side request forgery flaw, a SolarWinds Web Help Desk deserialization vulnerability, and an Ivanti Endpoint Manager authentication bypass. Federal Civilian Executive Branch agencies must remediate these flaws by CISA's required deadlines under Binding Operational Directive 22-01. CISA urged all organizations to prioritize these entries in their vulnerability management programs, flagging them as frequent vectors for malicious cyber actors. (CISA)

CISA Flags Two Chromium Zero-Days as Actively Exploited

On March 13, 2026, CISA added two more vulnerabilities to the KEV Catalog after confirming active exploitation: CVE-2026-3909, an out-of-bounds write in Google Skia, and CVE-2026-3910, an unspecified flaw in Chromium's V8 engine. Both affect software embedded in browsers used widely across enterprise endpoints. CISA reiterated that Federal Civilian Executive Branch agencies must remediate by the published due dates under Binding Operational Directive 22-01, and encouraged all organizations to treat these browser-engine bugs as priority patches given their frequent use as attack vectors. (CISA)

Dutch Intelligence Warns of Russian Campaign Against Officials' Signal and WhatsApp

Dutch intelligence agencies reported that Russian state hackers were attempting to break into Signal and WhatsApp accounts belonging to diplomats, military staff, and government officials worldwide, with journalists also at risk. Investigators said attackers tricked targets into revealing verification codes and PINs rather than exploiting technical flaws, using a fake Signal support chatbot and abuse of the linked-devices feature. AIVD Director-General Simone Smit said individual accounts, not the platforms themselves, were being targeted. Officials advised watching for duplicate identities in group chats as a sign of compromise. (Help Net Security)

ShinyHunters Claims New Data-Theft Campaign Against Salesforce Experience Cloud Sites

Salesforce confirmed on March 11, 2026 that its security team identified an attack campaign using a modified version of the open-source Aura Inspector tool to mass-scan public Experience Cloud sites, probe the Aura API endpoint, and pull CRM data from guest user profiles with excessive permissions. The company said no platform vulnerability was involved and urged customers to restrict guest-user access, disable public API queries, and review Aura Event Monitoring logs. The ShinyHunters group claimed the campaign on its data leak site and said it had taken data from roughly 100 companies. (Help Net Security)

Microsoft's March 2026 Patch Tuesday Fixes 80+ Flaws, Six Rated More Likely to Be Exploited

On March 2026 Patch Tuesday, Microsoft addressed more than 80 vulnerabilities, including two publicly disclosed but not yet exploited flaws in SQL Server and .NET. Six additional privilege-escalation bugs, spanning the Windows Kernel, Graphics Component, SMB Server, Winlogon, and Accessibility Infrastructure, were flagged by Microsoft as more likely to be exploited. Researchers also highlighted a Print Spooler remote-code-execution flaw, an Excel cross-site-scripting bug that could trigger Copilot Agent data exfiltration, and two Office RCE issues reachable through the Preview Pane. (Help Net Security)

ESET Details Sednit's BeardShell and Covenant Espionage Toolkit Targeting Ukraine

ESET researchers reported that Russia-linked group Sednit has used two complementary implants, BeardShell and Covenant, each relying on a separate cloud provider, to sustain espionage against Ukrainian military personnel since at least April 2024. BeardShell executes PowerShell commands via a .NET runtime and uses the Icedrive cloud service as its command-and-control channel, while Covenant, an open-source post-exploitation framework, has been deployed through 2025 and into 2026, including in January 2026 spearphishing campaigns exploiting CVE-2026-21509, as reported by Ukraine's CERT-UA. (Help Net Security)

White House Releases President Trump's Cyber Strategy for America

The White House released President Trump's Cyber Strategy for America, a seven-page framework published March 9, 2026 outlining priorities for maintaining U.S. leadership in cyberspace. The strategy commits to a coordinated, government-wide response that includes dismantling malicious networks, pursuing hackers and espionage operatives, and imposing sanctions on foreign entities tied to cyber activity. It also calls for modernizing federal systems through post-quantum cryptography, zero-trust architecture, and cloud migration, while aiming to simplify cyber regulations to reduce compliance burdens and better align regulators with industry globally. (Help Net Security)