Wednesday War Room – 03/18/2026

In partnership with

Attio is the AI CRM for modern teams.

Connect your email and calendar, and Attio instantly builds your CRM. Every contact, every company, every conversation, all organized in one place.

Then Ask Attio anything:

• Prep for meetings in seconds with full context from across your business

• Know what’s happening across your entire pipeline instantly

• Spot deals going sideways before they do

No more digging and no more data entry. Just answers.

Start your free trial →

The convergence of social engineering sophistication, unpatched critical vulnerabilities, and coordinated criminal collaboration signals a new phase of threat actor maturity that demands immediate executive attention and strategic response.

Risk Level: High

Business Impact: Information disclosure can become an exploit-chain enabler, especially when it helps attackers reliably weaponize follow-on flaws.

What You Need to Know: CISA added Wing FTP Server CVE-2025-47813 to KEV due to active exploitation, noting it can expose the server’s local installation path and help enable chaining with more severe issues; details are summarized in CISA KEV alert and reinforced by reporting in The Hacker News write-up and SecurityWeek coverage.

Why This Matters: 

• KEV means it’s being used against real orgs… not a theoretical lab problem.

• “Small” disclosures often become the missing puzzle piece for reliable RCE chains.

• FTP servers are frequently exposed and forgotten until they become an incident.

Executive Actions: 

🩹 Patch/upgrade Wing FTP to the fixed release and confirm the version running in production.

🔒 Restrict access (VPN/allowlists) and remove unnecessary internet exposure.

🧾 Review logs for suspicious authenticated activity, unusual enumeration, and chained exploit attempts.

🧱 Segment the service and restrict egress to reduce post-compromise tooling and exfil paths.

Are you tracking agent views on your docs?

AI agents already outnumber human visitors to your docs — now you can track them.

See your AI traffic!

Risk Level: Critical

Business Impact: Supply chain compromise can poison builds, steal tokens/secrets, and spread downstream into customers and production environments.

What You Need to Know: The GlassWorm campaign expanded into a coordinated wave hitting GitHub repos, npm packages, and VSCode/OpenVSX extensions, with details in BleepingComputer’s roundup and additional campaign mechanics described in StepSecurity’s ForceMemo analysis and The Hacker News report (account takeovers → force-push malware → stealthy token/secret theft).

Why This Matters:

• Repo compromise becomes CI/CD compromise when tokens and secrets live in pipelines.

• Force-push + preserved commit metadata is designed to bypass casual review.

• This scales: one poisoned dependency can hit thousands of orgs quietly.

Executive Actions: 

💎 Enforce repo protections: block force-push on protected branches and require signed commits where possible.

🔑 Rotate developer/CI tokens and reduce scope + lifetime (assume exposure if affected tooling was used).

🧪 Add detection for “quiet” supply chain indicators: sudden dependency changes, new publishers, unusual CI egress.

🧱 Restrict CI runner egress and secrets access to only what the job truly needs.

Risk Level: High 

Business Impact: Auth bypass into SD-WAN control components can lead to admin-level access, config tampering, traffic manipulation, and network-wide pivoting.

What You Need to Know: Cisco Talos and multiple researchers warned that exploitation narratives around SD-WAN are broader than a single PoC headline, with CVE-2026-20127 enabling auth bypass and administrative access in certain conditions, as summarized in Cybersecurity Dive coverage (including notes on PoC confusion and how attackers may chain related weaknesses in real campaigns).

Why This Matters: 

• Network control-plane compromise lets attackers rewrite routes, access, and segmentation assumptions.

• “PoC confusion” often delays remediation—attackers don’t wait for clarity.

• SD-WAN sits at a high-leverage layer that can hide or enable follow-on actions.

Executive Actions:

🧯 Validate exposure and patch levels for SD-WAN components tied to the advisory conditions.

🔒 Restrict management access (allowlists/VPN) and enforce MFA for admin workflows.

🕵️ Monitor for anomalous admin activity: unexpected config changes, new users, unusual API calls.

🧱 Treat SD-WAN management systems as Tier-0 infrastructure (segmented, tightly logged, tightly controlled).

Risk Level: High 

Business Impact: Healthcare and government disruption drives operational downtime, safety risk, extortion pressure, and high-cost recovery timelines.Healthcare service disruption, patient data exposure, operational shutdown

What You Need to Know: Medusa claimed responsibility for attacks impacting the University of Mississippi Medical Center and a New Jersey county, including ransom demands and threatened data leaks, according to The Record’s reporting.

Why This Matters: 

• Ransomware is still a business-interruption weapon, not just an IT problem.

• Leak threats compress decision time and increase the odds of mistakes under pressure.

• Healthcare targets amplify downstream harm—patients and operations become collateral.

Executive Actions:

🧯 Validate offline/immutable backups and prove restore timelines (don’t assume).

🔐 Tighten privileged access and require step-up controls for admin actions on critical systems.

🧾 Confirm incident comms/legal workflows are ready before you need them (speed matters).

🕵️ Hunt for pre-ransom signals: unusual remote tooling, credential theft indicators, lateral movement patterns.

🛑 Eliminate Telnet exposure; patch where removal isn’t immediately possible

🍏 Enforce Apple WebKit security update compliance for high-risk users

🩹 Patch Wing FTP and reduce internet exposure for file transfer services

💎 Tighten repo controls (no force-push on protected branches) and rotate CI/dev tokens

🌐 Lock down SD-WAN management access and monitor for config/admin anomalies

🧯 Re-validate ransomware readiness: backups, restore drills, and escalation playbooks

💡 If you’re still treating “legacy” like a harmless leftover, attackers will happily turn it into your next incident bridgehead. 💡

J.W.

(P.S. Check out our partners! It goes a long way to support this newsletter!)

Here's how I use Attio to run my day.

Attio's AI handles my morning prep — surfacing insights from calls, updating records without manual entry, and answering pipeline questions in seconds. No searching, no switching tabs, no manual updates.

Start now →