Lyceum News Desk · March 22, 2026

The Lyceum: Cybersecurity Daily — Mar 22, 2026

Sunday, March 22, 2026

The Big Picture

CISA's deadline to patch a max-severity Cisco firewall flaw is today, 23 public exploit templates for a Windows Notepad RCE are live on GitHub, and the FBI confirmed that Russian intelligence is actively hijacking Signal and WhatsApp accounts belonging to U.S. officials and journalists. Meanwhile, Los Angeles Metro is down after a WorldLeaks ransomware attack disrupted operations, and macOS 26 quietly broke its own VPN and encrypted DNS features in ways that leak traffic in plaintext. This is a day when the things people trust most — their firewall, their text editor, their encrypted messenger, their operating system's DNS — are all demonstrably failing.

What Just Shipped

CVE-2026-20131 Patch (Cisco): Emergency fix for max-severity unauthenticated RCE in Secure Firewall Management Center; CISA deadline is today.
CVE-2026-21992 Out-of-Cycle Patch (Oracle): CVSS 9.8 unauthenticated RCE fix for Identity Manager and Web Services Manager.
KB5085516 Emergency Update (Microsoft): Out-of-band fix for sign-in breakages caused by the March cumulative update KB5079473.
CVE-2026-20841 PoC Templates (Community): 23 public exploit repositories now live for the Windows Notepad Markdown RCE.
CISA KEV Additions (CISA): Five new entries including Craft CMS and Apple iOS zero-days confirmed exploited in the wild.
CVE-2026-21385 Patch (Google/Qualcomm): Android March bulletin patches actively exploited Qualcomm GPU memory corruption zero-day across 234 chipsets.

Today's Stories

Your Cisco Firewall Has Been a Root Shell Since January — Today's the Last Day to Fix It

CVE-2026-20131 is a maximum-severity flaw in Cisco Secure Firewall Management Center — the centralized control plane for enterprise Cisco firewalls, intrusion prevention, and malware filtering. An unauthenticated attacker sends a crafted request to the web management interface and can obtain a root shell. No credentials required.

Cisco patched it March 4. CISA added it to the Known Exploited Vulnerabilities catalog on March 20, flagging active use in ransomware campaigns, and gave federal agencies until today to patch or disconnect. A Reddit thread claims the Interlock ransomware group exploited it 36 days before public disclosure and alleges they used compromised firewalls as on-ramps, converted random Linux servers into proxy relays, and wiped logs every five minutes.

If you run Cisco FMC and haven't patched since March 4, assume your perimeter has been compromised. No workaround exists. The patch is the only fix, and the deadline is today. Watch for Interlock to expand targeting as unpatched instances linger past today.

The Notepad Exploit Is Now a Template — All 23 of Them

Nobody thinks of a text file as dangerous. That mental blind spot is exactly why CVE-2026-20841 matters today.

The vulnerability lives in Windows Notepad's Markdown rendering feature — the 2025 addition that lets Notepad display formatted text. Open a crafted .md file, click a link inside it, and Notepad invokes unverified protocol handlers (system shortcuts that tell Windows which program should open a particular type of link) that can download and execute attacker-controlled code with your permissions. CVSS 8.8. Microsoft patched it in February, but only for users with Microsoft Store auto-updates enabled — and many enterprise environments disable exactly that. The CVE record confirms the scope.

What changed today: 23 public proof-of-concept exploits are now live on GitHub. The window from research paper to phishing campaign is closed. Check your Notepad version — it should be 11.2510 or later. If your organization pushes updates through SCCM or Intune rather than the Store, verify those .md files aren't already sitting in someone's inbox. Expect phishing campaigns using Markdown attachments to spike this week.

Russia Is Reading Your Signal Messages — The FBI Made It Official

A joint CISA and FBI advisory issued Friday confirms that Russian intelligence-linked actors are running a sustained campaign to hijack Signal and WhatsApp accounts. The method is disarmingly simple: targets receive what appears to be a request from a trusted contact asking them to verify a device or scan a QR code. Complying links the attacker's device to your account as a trusted secondary device, giving them real-time access to every message — sent and received — going forward.

The advisory names current and former U.S. government officials, military personnel, political figures, and journalists as targets. The FBI reports thousands of accounts already compromised. This isn't a theoretical nation-state technique limited to embassy staff — Signal and WhatsApp's legitimate device-linking features are the attack surface.

The fix is immediate: open Settings in both apps, check which devices are linked, and remove anything you don't recognize. Be deeply skeptical of any request to link a new device or scan a QR code, even from people you know. Amid concurrent APT28 activity against European institutions, this campaign may expand to EU targets.

macOS 26 Just Quietly Broke VPN DNS, Encrypted DNS Profiles, and Private Network Resolution

Apple's newest macOS has three DNS bugs that collectively undermine the privacy and security features people specifically bought into. The /etc/resolver/ per-domain DNS mechanism — a long-standing, Apple-documented feature — is silently broken for any custom top-level domain not in the public IANA root zone. Apple's mDNSResponder intercepts queries for domains like .internal, .local, and .test and treats them as multicast DNS, never consulting the nameserver you configured.

It gets worse. Installing encrypted DNS profiles via .mobileconfig files fails with a misleading error. VPN services that rely on custom DNS configurations experience resolution failures when encryption is enabled — and the system falls back to plaintext DNS on port 53, breaking the entire security model. Users of Mullvad, NextDNS, AdGuard, or Quad9 can't install or update encrypted DNS profiles; existing ones work, but remove one and it's gone.

These issues have been reported across Hacker News, Privacy Guides, Tailscale, and Docker forums — multiple independent workflows are broken. Apple has issued no statement. If your organization deploys macOS with VPN or internal DNS, validate resolution paths end-to-end now. The thing protecting your DNS traffic may be the thing leaking it.

⚡ What Most People Missed

OpenClaw, the AI agent framework that became GitHub's most-starred project faster than anything in history, accumulated five new CVEs in 48 hours. Researchers have called out CVE-2026-25253 and flagged a "skills" marketplace distributing malicious plugins. One audit reportedly found 512 vulnerabilities, eight critical. If your team adopted OpenClaw because it moved fast, ask what security review happened along the way. Dark Reading's assessment calls it "a security nightmare."

A cyberattack on breathalyzer company Intoxalock left Connecticut drivers unable to start their cars. The company's supporting systems were paused on March 14 as a precaution, preventing required recalibrations for ignition interlock devices. No data breach — just a vendor backend going dark and creating immediate physical-world consequences for people who literally cannot drive without it.

Bruce Schneier's AI training poisoning demo from February is detonating on r/hacking today with 1,200+ upvotes. He wrote a fake article claiming competitive hot-dog-eating was popular among tech journalists; within 24 hours, Google Gemini and ChatGPT were confidently repeating it. The community conversation has shifted from "neat demo" to "what happens when agentic AI systems act on poisoned data without human review" — and nobody has a good answer.

The Akira ransomware GPU decryptor from March 2025 is trending again on Hacker News. A year-old blog post dominating today's front page almost certainly means organizations are still dealing with this variant. The tool exploits a timestamp-based key generation flaw and works for the Linux/ESXi variant — free, on GitHub, and within reach of any IR team with cloud GPU access.

WorldLeaks ransomware group disrupted Los Angeles Metro operations and prompted Foster City to declare a state of emergency. The group claims 160 GB of stolen city data. When ransomware hits transit infrastructure, the extortion clock runs against real people missing buses, not IT tickets.

From the Foreign Press

New Banking Trojan "Perseus" Hunts Passwords Hidden in Notes Apps

Xakep.ru details a newly identified Android banking trojan called Perseus that specifically targets note-taking and memo applications — the places where people store passwords, seed phrases, and account recovery codes they're too lazy to put in a proper password manager. Perseus scans note content using pattern matching for cryptocurrency wallet formats and common credential structures, then exfiltrates matches to C2 infrastructure. This is a reminder that "write it down in Notes" is now an explicitly targeted behavior, not just bad hygiene advice.

Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

DarkSword iOS Exploit Kit: Full Technical Breakdown

FreeBuf published a detailed Chinese-language technical analysis of the DarkSword iOS exploit kit, documenting its six-vulnerability chain (three zero-days) that achieves full device control on iOS 18.4 through 18.7. The writeup maps the WebKit/JavaScriptCore entry points, sandbox escape mechanisms, and data exfiltration paths — providing IOC-level detail that hasn't appeared in English-language coverage. For teams building mobile threat detection rules, this is the most granular public analysis available.

Source: FreeBuf — Chinese. No English-language coverage confirmed at time of publication.

Interpol: AI-Powered Fraud Now 4.5× More Profitable Than Traditional Schemes

Xakep.ru reports on new Interpol statistics showing fraud operations leveraging AI tools — deepfake voice, generated identity documents, automated social engineering — are generating 4.5 times the revenue of traditional fraud. The numbers come from Interpol's own operational data, and they quantify what the industry has been saying anecdotally: AI doesn't just make fraud easier, it makes it dramatically more profitable per operation.

Source: Xakep.ru — Russian. No English-language coverage confirmed at time of publication.

📅 What to Watch

If CISA adds Oracle CVE-2026-21992 to KEV this week, that would indicate active exploitation of a CVSS 9.8 unauthenticated RCE in identity management — and would force every Oracle IAM shop into immediate triage and accelerated patching.
If WorldLeaks publishes Los Angeles city data within days, it would signal negotiations failed and provide a template for targeting transit-dependent cities where operational pressure is likely to shorten ransom timelines.
If Apple ships a macOS 26 point release addressing DNS, watch whether they also repair the encrypted-DNS profile handling; if Apple remains silent, organizations that rely on enterprise-managed encrypted DNS and VPNs will lack a deployable fix and may need to implement alternative DNS filtering or split-tunnel workarounds, extending exposure.
If Akira ransomware variants start using different key generation methods, that could indicate community attention or disclosure has prompted actors to change tactics, which would reduce the GPU decryptor's usefulness and require incident responders to update recovery strategies.
If phishing campaigns using .md file attachments appear in your telemetry this week, the 23 Notepad PoCs have been industrialized faster than expected — tune detections to flag abnormal Notepad protocol handler invocations and unusual outbound fetches spawned by the editor.

The Closer

A text editor that executes code, a firewall that hands out root shells, and an encrypted messenger that gives Russia a front-row seat — the tools we trust most are having their worst week. Meanwhile, macOS quietly decided your VPN's DNS should travel in plaintext, which is the operating system equivalent of installing a screen door on a submarine. Stay paranoid.

If someone you know is still opening .md files in Notepad like it's 2024, forward them this.