State of (in)security - Week 11, 2026
Take action: If you use AI platforms and chatbots, remember that they are just web applications and have a bunch of other possible flaws. Make sure databases, API endpoints, and system prompts are locked down with proper authentication, access controls, and integrity monitoring, not left exposed as an afterthought. Regularly audit your AI infrastructure for basic web application flaws like exposed APIs, SQL injection, and missing authentication, because even the most advanced AI tools can be undone by classic, well-known security mistakes.
Learn More
In the week between March 9, 2026, midnight and March 16, 2026, midnight we witnessed a total of:
- 22 advisory/vulnerability events
- 16 incident/data breach events
Week over Week comparison of week 11 2026 vs week 10 2026
- Advisories are up and incidents are down. Advisories are up from 15 in week 10 2026 to 22 in week 11 2026. Incidents are down from 17 in week 10 2026 to 16 in week 11 2026.
- The number of known impacted individuals is up - from 474 thousand in week 10 2026 to 3 million in week 11 2026.
We also shared 4 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 3,343,098 impacted individuals across 6 incidents, with the largest breach being the Cal AI Faces Alleged Data Breach Claims Exposing 3 Million User Records incident exposing 3,000,000 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 4 |
| Software Vulnerability and SDLC Exploits | 2 |
| Unauthorized access | 2 |
| Intentional System Sabotage and Crime | 1 |
| System Misconfiguration Exploits | 1 |
| Third Party Compromise | 1 |
| Social Engineering and Phishing | 1 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| Consulting/Professional Services | 3 |
| Healthcare | 3 |
| Food and Beverage | 2 |
| Finance | 2 |
| IT/Software/Technology | 1 |
| Non-profit/Charity | 1 |
| Retail | 1 |
| Entertainment/Leisure | 1 |
| Energy | 1 |
| Telecommunications | 1 |
Read the Event Details of the Week
Knowledge
- active exploit | CISA Mandates Emergency Patching for SolarWinds Web Help Desk Vulnerabilities
- active exploit | CISA Warns of Active Exploitation in Ivanti Endpoint Manager Authentication Bypass
- awareness | Escalating Cyber Attack Techniques Targeting Organizations During the 2026 Middle East Conflict
- active exploit | ShinyHunters Exploits Salesforce Misconfigurations to Target 100 High-Profile Organizations
Vulnerabilities
- critical vulnerability | AdGuard Home Patches Critical Authentication Bypass Vulnerability
- critical vulnerability | Adobe releases March 2026 patches for multiple products
- data breach | Apple Patches 'Coruna' Exploit Kit Targeting Legacy iOS Devices
- critical vulnerability | CrackArmor: Nine Critical Vulnerabilities in AppArmor Allow Unprivileged Users to Escalate to Full Root Privileges
- critical vulnerability | Critical 1-Click Account Takeover Vulnerability Patched in ZITADEL IAM Platform
- critical vulnerability | Critical Authentication Bypass and Smuggling Flaws Impact Siemens RUGGEDCOM APE1808
- critical vulnerability | Critical Authentication Bypass in Honeywell IQ4x BMS Controllers Allows Remote Takeover
- critical vulnerability | Critical Gogs Vulnerability Enables Silent Supply-Chain Attacks via LFS Overwrites
- critical vulnerability | Critical n8n Vulnerabilities Enable Remote Code Execution and Credential Theft
- critical vulnerability | Critical Nginx UI Flaw Allows Unauthenticated Backup Theft and Decryption
- critical vulnerability | Critical SSRF Vulnerability Patched in Angular Server-Side Rendering
- critical vulnerability | Critical Vulnerabilities in Apeman ID71 Cameras Allow Remote Takeover
- critical vulnerability | Critical Vulnerabilities in Lantronix EDS Series Allow Root-Level Takeover
- critical vulnerability | ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push
- critical vulnerability | Fortinet FortiManager vulnerability allows remote command execution
- data breach | GnuPG Releases Version 2.5.17 to Patch Critical RCE and Buffer Overflow Flaws
- critical vulnerability | Google Patches Critical WebML Vulnerability and 28 Other Flaws in Chrome 146
- critical vulnerability | HPE Patches Multiple Flaws Aruba AOS-CX Including Critical Allowing Admin Password Resets
- critical vulnerability | Microsoft March 2026 Patch Fixes 79 Vulnerabilities, Eight Critical, Two Publicly Disclosed Zero-Days
- critical vulnerability | SAP March 2026 Updates Patch Critical FS-QUO, NetWeaver and SCM Flaws
- critical vulnerability | Siemens Patches Critical Code Injection Flaw in SIMATIC S7-1500 Controllers
- critical vulnerability | Veeam Patches Critical RCE Vulnerabilities in Backup & Replication Software
Incidents
- data breach | Telus Digital Confirms Data Breach Following 1 Petabyte Theft Claim by ShinyHunters
- data breach | Lloyds Banking Group Technical Glitch Exposes Private Customer Transactions
- data breach | People's Party of Thailand Reports Membership Database Breach
- data breach | Sweden Investigates Source Code Leak of E-Government Platform Following CGI Sverige Breach
- data breach | Starbucks Reports Employee Data Breach Following Credential Theft Campaign
- data breach | Banner Capital Bank Discloses Data Breach Following Employee Email Compromise
- data breach | Ericsson US Subsidiary Discloses Data Breach Following Third-Party Provider Hack
- data breach | Autonomous Agent Exploits SQL Injection in McKinsey AI Platform Lilli
- data breach | Loblaw Companies Limited Reports Data Breach Affecting Customer Contact Information
- data breach | Cal AI Faces Alleged Data Breach Claims Exposing 3 Million User Records
- ransomware | England Hockey Investigates 129GB Data Theft Claim by AiLock Ransomware Group
- ransomware | SafePay Ransomware Group Targets Smile Team Orthodontics in New South Wales
- ransomware | Stryker Global Networks Disrupted by Destructive Cyberattack Claimed by Handala
- ransomware | Bell Ambulance Ransomware Attack Impacts Over 237,000 Individuals
- ransomware | DragonForce Ransomware Group Leaks 79GB of Data from Australian Poultry Giant Hazeldenes
- ransomware | EV Charger Manufacturer ELECQ Hit by Ransomware Attack Exposing Customer Data
