IT-Sentinel

> TODAY'S SUMMARY (22 articles)

Today's cybersecurity landscape highlights several critical threats and vulnerabilities. Fireworks AI has reported a breach stemming from a third-party cloud hack, emphasizing the risks associated with relying on external providers. France has attributed a cyberattack that affected supermarket refrigeration systems to Iranian operatives, signaling geopolitical tensions in cyberspace. Meanwhile, CISA has warned of active exploitation of multiple security flaws in key software, including OpenSSH and IBM products. Additionally, N-able has taken its N-central Cloud offline after the disclosure of 33 zero-day vulnerabilities. On the consumer side, a data breach at Iris Ohyama may expose personal information of 7.7 million individuals. Lastly, Google has issued a security update for Chrome, addressing the eighth actively exploited zero-day this year.

// AI-powered summary generated at 08:00

> CVE-2026-3479 pkgutil.get_data() does not enforce documented restrictions

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:03]

Information published.

> CVE-2026-3634 Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:02]

Information published.

> The OWASP Top 10 for LLM Applications (2025): Explained Simply

[SOURCE] Security Boulevard [LANGUAGE: EN] [DATE: 2026-03-21 07:42]

6 min readThe OWASP Top 10 for LLM Applications is the most widely referenced framework for understanding these risks. First released in 2023, OWASP updated the list in late 2024 to reflect real-world incidents, emerging attack techniques and the rapid growth of agentic AI. The post The OWASP Top...

> CVE-2026-3632 Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:02]

Information published.

> CVE-2026-32766 astral-tokio-tar insufficiently validates PAX extensions during extraction

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:02]

Information published.

> Trivy vulnerability scanner backdoored with credential stealer in supply chain attack

[SOURCE] CSO Online [LANGUAGE: EN] [DATE: 2026-03-21 05:35]

Attackers have compromised the widely used open-source Trivy vulnerability scanner, injecting credential-stealing malware into official releases and GitHub Actions used by thousands of CI/CD workflows. The breach could trigger a cascade of additional supply-chain compromises i...

> CVE-2026-3633 Libsoup: libsoup: header and http request injection via crlf injection

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:02]

Information published.

> CVE-2026-30922 pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

[SOURCE] Microsoft Security Update Guide [LANGUAGE: EN] [DATE: 2026-03-21 08:02]

Information published.

> Are nations ready to be the cybersecurity insurers of last resort?

[SOURCE] CSO Online [LANGUAGE: EN] [DATE: 2026-03-21 00:17]

A senior member of the Cyber Monitoring Center (CMC), an organization formed last year to monitor, define and classify cyber events impacting UK organizations, this week questioned whether a £1.5 billion (about $2 billion) government loan guarantee provided to Jaguar Land Rove...

> CVE-2026-23204 net/sched: cls_u32: use skb_header_pointer_careful()