Week of March 30, 2026: EU Commission breach and Hasbro cyberattack

Security leaders tracked a cluster of disclosed incidents and advisories during the week of March 30, 2026, including the European Commission's second confirmed breach of the year, a cyberattack against toy maker Hasbro, and a North Korea-linked npm supply chain compromise of the Axios HTTP library. CISA added Citrix NetScaler, Google Dawn and TrueConf client vulnerabilities to its Known Exploited Vulnerabilities Catalog in the same stretch, while researchers flagged active exploitation of a TrueConf zero-day against government networks and a critical FortiClient EMS flaw.

CISA adds actively exploited Citrix NetScaler flaw to KEV Catalog

On March 30, 2026, CISA added CVE-2026-3055, an out-of-bounds read vulnerability in Citrix NetScaler, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. The addition triggers remediation deadlines for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01, though CISA urged all organizations to prioritize patching the flaw regardless of sector. NetScaler appliances sit at the network edge for many enterprises, making exploited vulnerabilities in the product attractive targets for remote attackers seeking initial access into corporate networks. (CISA)

CISA flags exploited Chrome Dawn flaw as Known Exploited Vulnerability

On April 1, 2026, CISA added CVE-2026-5281, a use-after-free vulnerability in Google Dawn, the WebGPU implementation embedded in Chromium-based browsers, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Federal Civilian Executive Branch agencies face a remediation deadline under Binding Operational Directive 22-01, and CISA again urged other organizations to treat KEV entries as near-term patching priorities. Dawn vulnerabilities affect any Chromium-derived browser, extending exposure beyond Chrome itself to other widely deployed browsers built on the same rendering engine. (CISA)

Critical FortiClient EMS SQL injection flaw under active attack

Researchers at Defused reported that a critical SQL injection flaw in Fortinet FortiClient Endpoint Management Server, tracked as CVE-2026-21643, was being actively exploited, with first attacks observed four days before the March 30, 2026 disclosure. The bug lets unauthenticated remote attackers send crafted HTTP requests to the EMS administrative interface to run unauthorized commands. It affects only FortiClientEMS v7.4.4 in multi-tenant mode; Fortinet fixed it in version 7.4.5. Shodan data showed close to 1000 internet-exposed FortiClient EMS instances, and researchers urged organizations running multi-tenant 7.4.4 deployments to upgrade immediately. (Help Net Security)

European Commission confirms second 2026 breach of Europa.eu infrastructure

The European Commission confirmed that a cyberattack hit cloud infrastructure hosting its public-facing Europa.eu websites, with the intrusion discovered on March 24, 2026. Early findings indicated that data had been taken from the affected sites, though the Commission said there was no indication its internal systems were compromised. Screenshots circulating online suggested a hacking group claimed to hold roughly 350 GB of Commission data, including mail server contents and databases. It marked the second confirmed breach affecting EU institutions in 2026, following an earlier compromise of the Commission's mobile device management platform. (Help Net Security)

Hasbro takes systems offline after cyberattack detected

Hasbro, the toy maker with more than 5,000 employees, disclosed a cyberattack that was detected on March 28, 2026, prompting it to take certain systems offline and activate incident response protocols. The company said interim business-continuity measures supporting order processing and shipping could remain in place for several weeks while a third-party-assisted investigation determines the scope of the intrusion and whether data was affected. Hasbro stated it would issue notifications required under applicable law once its review of potentially affected data is complete. (Help Net Security)

North Korea-linked actors tied to Axios npm supply chain compromise

Google Threat Intelligence Group and Mandiant attributed a supply chain compromise of the widely used Axios npm HTTP client library to financially motivated North Korean actors tracked as UNC1069. On March 31, 2026, attackers published two backdoored Axios package versions after gaining access to a maintainer's npm account, deploying a post-install script that fetched a backdoor researchers named WAVESHAPER.V2 for Windows, macOS and Linux. The malicious versions were available for less than three hours but were pulled into countless build pipelines given Axios's inclusion as a transitive dependency across millions of applications. (Help Net Security)

TrueConf zero-day exploited against Southeast Asian government networks

Check Point researchers disclosed that suspected China-nexus attackers exploited a zero-day vulnerability in the TrueConf videoconferencing client, tracked as CVE-2026-3502, to distribute malware inside government networks in Southeast Asia in a campaign the company calls Operation TrueChaos. Attackers compromised on-premises TrueConf update servers and replaced legitimate update packages with weaponized versions, delivered after a link launched the client and presented a fake update prompt. The payload deployed the Havoc post-exploitation framework for reconnaissance and persistence. TrueConf patched the flaw in Windows client version 8.5.3, released in March 2026, but earlier versions remain exposed. (Help Net Security)