SAP npm packages poisoned with credential-stealing malware in "Mini Shai-Hulud" attack. Malicious preinstall hooks harvest GitHub tokens, cloud keys and CI/CD secrets. Attackers weaponise AI agent configs for persistence, turning Claude and VS Code settings into execution paths.
Medtronic says a third party accessed data in corporate IT systems, while ShinyHunters claims more than nine million records were stolen. The incident did not disrupt products or patient care, but it exposes the widening risk around corporate IT, identity data and medical technology supply chains.
Australia’s A$25bn AI wager, Bezos’s leap into “physical AI” and Musk’s push to shift data centres into orbit turned this week into a defining moment in the AI global industrial contest, with the Global South emerging as both proving ground and prize in the new AI steel age.
Google has issued an emergency patch for a high-severity zero-day (CVE-2026-3910) in its V8 JavaScript engine, which is being actively exploited in the wild. The flaw allows arbitrary code execution, posing a significant risk to billions of Chrome users globally, including in Australia.
Cyber News Centre's cyber update for 16th March 2026: Google has released an emergency security update for its Chrome browser to patch a high-severity zero-day vulnerability in its V8 JavaScript engine that is being actively exploited in the wild.
Update: Google has released an emergency security update for its Chrome web browser, version 146.0.7680.75, to address a high-severity zero-day vulnerability, tracked as CVE-2026-3910. The flaw, an inappropriate implementation in Chrome's V8 JavaScript and WebAssembly engine, was discovered by Google's Threat Analysis Group on March 10, 2026, and is confirmed to be under active exploitation. The vulnerability allows a remote attacker to execute arbitrary code within the browser's sandbox simply by tricking a user into visiting a malicious website.
Given Chrome's dominant market share in Australia, a significant number of users and organizations are at immediate risk. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply the patch by March 27, 2026.
While another zero-day, CVE-2026-3909 in the Skia graphics library, was initially reported alongside this patch, Google has since clarified that its fix will be released in a future update. Users of all Chromium-based browsers, including Microsoft Edge, Brave, and Vivaldi, are also advised to update their software as soon as patches become available.
Why it Matters: The active exploitation of CVE-2026-3910 represents a direct and immediate threat to Australian individuals and organizations. With a low attack complexity that only requires visiting a compromised webpage, the potential for widespread impact is substantial. For businesses, this could lead to the deployment of malware, ransomware, or spyware, resulting in significant data breaches, financial loss, and reputational damage.
The vulnerability undermines the security of the browser, a primary tool for daily business operations, and highlights the persistent threat of sophisticated actors targeting widely used software. The inclusion in the CISA KEV catalog underscores the seriousness of the threat and the urgency for all organizations, not just government agencies, to prioritize patching to mitigate their exposure.
Given Chrome's dominant market share in Australia, a significant number of users and organizations are at immediate risk. The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply the patch by March 27, 2026.
To keep your device secure, update Chrome as soon as you can. Here are a few handy tips to help you stay out of trouble, even before a zero-day is patched:
Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.
SAP npm packages poisoned with credential-stealing malware in "Mini Shai-Hulud" attack. Malicious preinstall hooks harvest GitHub tokens, cloud keys and CI/CD secrets. Attackers weaponise AI agent configs for persistence, turning Claude and VS Code settings into execution paths.
Medtronic says a third party accessed data in corporate IT systems, while ShinyHunters claims more than nine million records were stolen. The incident did not disrupt products or patient care, but it exposes the widening risk around corporate IT, identity data and medical technology supply chains.
Vercel confirms a security incident after a compromised third-party AI tool's OAuth token allowed attackers to pivot into internal systems, exposing environment variables and API keys across its platform.
According to Microsoft’s April 2026 Security Update Guide, the company fixed more than 160 vulnerabilities across Windows, Office and core services, including an actively exploited SharePoint zero‑day and a Defender privilege‑escalation flaw.
Where cybersecurity meets innovation, the CNC team delivers AI and tech breakthroughs for our digital future. We analyze incidents, data, and insights to keep you informed, secure, and ahead. Sign up for free!
