🛡️ Straylight Sentinel Intelligence Report | Wednesday, March 18, 2026 | 14:50 UTC
🛡️ /Straylight Sentinel Brief
[Wednesday, March 18, 2026 | 14:50 UTC Edition]
BLUF (Bottom Line Up Front)
State-sponsored actors like APT28 and DPRK are refining their toolkits to target European government entities and cryptocurrency markets, while ransomware operators like LeakNet adopt sophisticated in-memory evasion techniques.
🚨 FLASH ALERTS (Critical Threats)
01 | Critical Unauthenticated Takeover in Oracle Edge Cloud Infrastructure Designer Exploitation Status: Not Actively Exploited Threat Metrics: CVSS: 9.8 | EPSS: N/A The Risk: Network Tactical Mitigation: Restrict network access to the management interface and apply Oracle's latest patches immediately. 🧠 Analyst Challenge: How do we monitor for unauthenticated HTTP requests targeting infrastructure design tools? Source: Full Report
02 | Critical Code Execution Vulnerability in jsPDF Library Exploitation Status: Not Actively Exploited Threat Metrics: CVSS: 9.6 | EPSS: 4.0000% The Risk: Network Tactical Mitigation: Update jsPDF to version 4.2.1 or later and sanitize all user-supplied arguments passed to PDF generation functions. 🧠 Analyst Challenge: Are we auditing our client-side libraries for vulnerabilities that could lead to code execution? Source: Full Report
03 | Critical Data Tampering in Moodle Custom Certificate Plugin Exploitation Status: Not Actively Exploited Threat Metrics: CVSS: 9.6 | EPSS: 2.0000% The Risk: Network Tactical Mitigation: Upgrade the modcustomcert plugin to versions 4.4.9 or 5.0.3 to enforce proper context authorization. 🧠 Analyst Challenge: How do we ensure that role-based access controls in third-party plugins are properly scoped to specific contexts? Source: Full Report
🤖 THE AI FRONTIER
Critical Injections in Spring AI Framework The Risk: Spring AI suffers from high-severity SQL injection and JSONPath injection vulnerabilities in its filter expression converters, allowing attackers to bypass metadata-based access controls. Source: Read More
LibreChat RAG API Authentication Compromise The Risk: LibreChat version 0.8.1-rc2 reuses the same JWT secret for both user sessions and its Retrieval-Augmented Generation (RAG) API, compromising service-level authentication and potentially exposing sensitive AI context data. Source: Read More
📰 INDUSTRY INTEL (The Big 5)
01 | Operation Roundish: APT28 Targets Ukraine with Roundcube Toolkit The Scoop: APT28 deployed a comprehensive exploitation toolkit against Ukrainian government webmail, utilizing CSS injection and a Go-based implant for credential harvesting and persistent mail forwarding. Why It Matters: Demonstrates advanced evasion and long-term intelligence gathering capabilities targeting critical European infrastructure. Source: View Story
02 | DPRK's Contagious Trader Campaign Targets Crypto Bots The Scoop: North Korean actors are weaponizing cryptocurrency trading bots on GitHub using malicious npm dependencies to exfiltrate private keys. Why It Matters: Highlights the ongoing threat to the cryptocurrency sector from state-sponsored actors leveraging open-source supply chains. Source: View Story
03 | Konni Group's KakaoTalk-Linked Spear-Phishing The Scoop: The Konni Group executed a multi-stage campaign using spear-phishing and malicious LNK files, notably abusing compromised KakaoTalk PC sessions to distribute RATs to victims' contacts. Why It Matters: Shows the effectiveness of trust-based propagation and the need for behavioral detection against modular RAT deployments. Source: View Story
04 | LeakNet Ransomware Adopts Deno-Based In-Memory Loader The Scoop: Ransomware operator LeakNet has shifted to running its own initial access campaigns using ClickFix lures and a novel Deno-based loader that executes payloads entirely in memory. Why It Matters: Traditional file-based detection mechanisms are bypassed, requiring defenders to focus on behavioral signals and restrict administrative tools like PsExec. Source: View Story
05 | The Refund Fraud Economy Exploits Major Retailers The Scoop: Cybercriminals are increasingly exploiting major retailers and payment platforms through sophisticated refund fraud schemes, creating a dedicated underground economy. Why It Matters: Retailers face significant financial losses and must implement stricter verification and fraud detection mechanisms. Source: View Story
⚡ SPEED ROUND
Nordstrom's email system abused to send crypto scams to customers Minecraft: Dark Tale of Scams, Malware & Extortion Fake Pudgy World site steals crypto passwords
🛡️ PATCH WATCH (Top 8)
pyasn1: ASN.1 library vulnerability (CVE-2026-30922) Juju: Secret-set tool authorization failure (CVE-2026-32693) Cockpit CMS: Headless CMS vulnerability (CVE-2026-31891) jsPDF: User control of arguments (CVE-2026-31898)
- music-metadata: Metadata parser vulnerability (CVE-2026-32256)
