The Lyceum: Cybersecurity Daily — Mar 15, 2026

It's a Sunday built on deferred homework. March Patch Tuesday dropped five days ago and the blast radius is still expanding — CISA keeps adding exploited bugs to its mandatory-fix list, CL0P is still dining on Oracle zero-days, and a researcher who tried to do the right thing got a cease-and-desist for his trouble. The theme today isn't novel attacks — it's the compounding cost of patches nobody applied and policies nobody wrote.

• Microsoft March 2026 Patch Tuesday (Microsoft): 84 fixes including two publicly disclosed zero-days — CVE-2026-21262 (SQL Server privilege escalation, CVSS 8.8) and CVE-2026-26127 (.NET denial of service, CVSS 7.5). Neither is confirmed exploited in the wild yet, but both were known before the patch shipped.
• Android March 2026 Security Bulletin (Google): Patches CVE-2026-21385, a Qualcomm display component memory corruption flaw under limited, targeted exploitation on Android devices.
• Chrome Emergency Updates (Google): Two high-severity zero-days exploited in attacks — an out-of-bounds write in Skia and a V8 JavaScript engine flaw — patched on March 13.
• VMware Aria Operations Fix (Broadcom/VMware): Patch for CVE-2026-22719 (command injection, CVSS 8.1) released February 24; CISA confirmed active exploitation and set a March 24 federal deadline for federal agencies to patch.
• Nemotron 3 Super (Nvidia): Trained natively in 4-bit floating point on H300-class GPUs, designed to make always-on agent inference dramatically cheaper.
• Olmo 7B (AI2): Hybrid RNN-Transformer model that reportedly matches larger competitors with half the training data — lowering the barrier for in-house agent deployments.
• NASCIO Agentic AI Report (NASCIO): First mainstream public-sector playbook explicitly framing AI agents as privileged service accounts requiring procurement guardrails and least-privilege controls.

If your organization touches Oracle E-Business Suite — directly or through a vendor — this is the story that should ruin your Sunday coffee.

CL0P-linked attackers exploited CVE-2025-61882, a now-patched zero-day in Oracle E-Business Suite, to breach dozens of organizations. The flaw allowed remote code execution on exposed Oracle instances, and internet-facing deployments with weak segmentation were essentially open doors. Victim reports continue to surface — early coverage names universities and large enterprises, with some outlets identifying Harvard University among the targets. The extortion activity is ongoing, with follow-up ransom demands arriving months after initial compromise, according to Bright Defense's reporting.

The uncomfortable truth: you might not think you run Oracle EBS, but your payroll provider, logistics partner, or university back-end might. The move today is to confirm whether any Oracle EBS instance you control or depend on has applied the January/February security updates, and push third-party vendors for explicit attestation and IOC sharing. The Paubox blog tracks named victims as they emerge.

A security researcher published a detailed account of what happened when they tried to responsibly disclose a bug: no thank-you, no bounty — just legal threats and accusations, despite following a textbook "email them, give them time, don't exploit anything" playbook. The post is tearing through Hacker News today because it captures a fear every researcher carries: that doing the right thing gets you sued.

For organizations, the lesson is blunt. A lawyer-first response to vulnerability reports doesn't reduce risk — it accelerates public disclosure, scares off the people who might quietly save you, and signals to the next researcher that selling the bug is safer than reporting it. If your company doesn't have a published vulnerability disclosure policy with safe-harbor language, you're one blog post away from being the villain in this story. Regulators and cyber insurers are already watching these dynamics, and formal disclosure safe harbors may soon become compliance requirements.

VMware Aria Operations is the kind of tool that quietly runs in a management network, sees everything in your virtual environment, and almost never gets patched on schedule. Attackers have noticed.

CISA added CVE-2026-22719 — a command-injection bug (CVSS 8.1) that lets an authenticated attacker run arbitrary commands on the underlying OS — to the Known Exploited Vulnerabilities catalog. Federal agencies have until March 24 to patch; that's nine days away. The real danger is positional: Aria typically runs with elevated privileges, which can give attackers a single pivot point to credentials, configurations, and the entire virtualization stack. Think of it as robbing the locksmith instead of picking a lock. No public proof-of-concept or detailed exploitation chain has surfaced yet, but CISA's confirmation of active exploitation is enough to act on. Patch now, or run VMware's workaround script on every appliance node while you schedule the change window — and check whether these boxes are unnecessarily exposed to flat networks or the internet.

The FBI has opened an investigation after malware was found embedded in games distributed through Steam — Valve's dominant PC gaming platform with over 130 million active users. This isn't a sketchy piracy site; it's the most trusted name in PC gaming.

The enterprise angle is real and underappreciated. Employees who game on the same machine they use for work — or who share a home network with a gaming PC — could unknowingly introduce malware into corporate environments. Most endpoint detection tools are tuned for corporate software; game installers often fly under the radar entirely. It's unclear whether the malware arrived via compromised developer accounts, a supply-chain attack on a game's build pipeline, or another vector. Valve has not made a public statement. Until Valve issues guidance and names affected titles, avoid installing new games or updates on any machine with access to corporate resources, and consider whether game distribution platforms are addressed in your acceptable-use and endpoint policies.

A ransomware gang breaching Oracle ERP systems like it's an all-you-can-breach buffet, a medical device company getting wiped by its own laptop management tool, and the FBI investigating malware hiding inside video games on the world's most trusted gaming platform. Somewhere a CISO is explaining to the board that the real threat isn't the hackers — it's the 17-year-old PowerPoint bug nobody patched because "who still uses ActiveX?" Enjoy your Sunday.

If someone you know is still gaming on their work laptop, forward this before they find out the hard way.