Afternoon Review in IT Security — March 22, 2026

The cybersecurity landscape continues to evolve with critical threats emerging across multiple fronts, from sophisticated malware targeting browser encryption to urgent federal patching mandates and significant botnet takedowns. Today's developments underscore the persistent challenges facing both enterprise and consumer security environments.

VoidStealer Malware Exploits Chrome's Encryption Defense

A newly identified information stealer called VoidStealer has demonstrated a sophisticated method for bypassing Chrome's Application-Bound Encryption (ABE) protection mechanism. The malware employs a debugger-based technique to extract the master key used for decrypting sensitive data stored within the browser, effectively circumventing one of Chrome's core security features. This approach represents an escalation in the capabilities of information-stealing malware, with related threats including ElevationKatz also identified in the threat landscape. Source: VoidStealer malware steals Chrome master key via debugger trick

CISA Issues Emergency Patching Order for Critical Cisco Vulnerability

The Cybersecurity and Infrastructure Security Agency has mandated that all federal agencies patch a maximum-severity vulnerability in Cisco Secure Firewall Management Center (FMC) by Sunday, March 22. The vulnerability, tracked as CVE-2026-20131, poses significant risk to critical infrastructure and government networks. Intelligence indicates that multiple threat actors, including those behind Interlock, NodeSnake, and Slopoly malware families, have demonstrated interest in exploiting this flaw. The urgency of this directive reflects the severity of the exposure and the active threat environment surrounding this particular vulnerability. Source: CISA orders feds to patch max-severity Cisco flaw by Sunday

Major Botnet Takedown Disrupts Millions of Compromised Devices

Law enforcement has successfully dismantled four major botnets—Aisuru, Kimwolf, JackSkid, and Mossad—that collectively infected more than three million devices globally. The Justice Department's action represents a significant blow to cybercriminal infrastructure, particularly targeting compromised systems within residential networks. These botnets, which share technical lineage with the notorious Mirai botnet, had been leveraged in record-breaking cyberattacks and posed substantial risks to both individual users and broader network stability. The takedown demonstrates ongoing coordinated efforts to disrupt malicious infrastructure at scale. Source: US Takes Down Botnets Used in Record-Breaking Cyberattacks

WordPress Core Zero-Day Exploit Offered for Sale on Dark Web

A threat actor is actively marketing a previously unknown remote code execution vulnerability affecting WordPress versions 6.8.1 through 6.9.3. The Python-based exploit reportedly functions against default WordPress installations without requiring authentication or user interaction, making it particularly dangerous. The availability of this zero-day exploit for purchase represents an immediate threat to the millions of websites running vulnerable WordPress versions, as the flaw could enable complete site compromise. Source: A threat actor is allegedly selling a WordPress core Remote Code Execution (RCE) 0-day exploit

Today's threat landscape reflects the ongoing sophistication of attackers across multiple vectors, from browser-targeting malware to critical infrastructure vulnerabilities and widespread botnet operations. Organizations should prioritize immediate patching of identified critical flaws while maintaining heightened vigilance regarding emerging threats in both enterprise and consumer-facing platforms.