Security Check-in Quick Hits: Zero-Day Chrome Exploits, Healthcare Data Fire Sale, AI Crushing Human Hackers, and Hellcat Ransomware Boss Unmasked
For March 18, 2026
CISA Adds Two Critical Chrome Zero-Days to KEV Catalog — Actively Exploited Now
Google Chrome (and every Chromium-based browser) just got hit with two high-severity zero-days that attackers are already chaining in the wild. CVE-2026-3909 is an out-of-bounds write in the Skia graphics library; CVE-2026-3910 is an improper restriction in the V8 JavaScript engine. Both let remote attackers escape sandboxes and run code simply by luring victims to a malicious HTML page.
CISA wasted no time: both CVEs are now on the Known Exploited Vulnerabilities list, forcing federal agencies to patch by March 27. Affected platforms include Chrome, Edge, Opera, Android, ChromeOS, and even Flutter apps. Ransomware use isn’t confirmed yet, but the bar for exploitation is low — just visit the wrong site.
Bottom line: Update Chrome (and everything Chromium) right now. If you can’t patch, block untrusted HTML until you can.
Colombian Healthcare Provider Coopsana’s 1.1 Million Patient Records Sold for $350 on Hacker Forum
A fresh healthcare breach surfaced on dark-web markets: Coopsana (coopsana.com.co) allegedly lost an entire database of 1.1 million patient records. The dump includes full names, national IDs, emails, phone numbers, appointment histories, clinic locations, doctors, service types, and exam details — everything a fraudster or identity thief could want.
The asking price? A shockingly low $350. No ransom note or initial access vector has been publicly detailed yet, but the listing proves the data is already in criminal hands.
Bottom line: Healthcare organizations worldwide just got another reminder that patient data is cheap to steal and even cheaper to sell. If you’re a patient at Coopsana or similar providers, monitor your accounts and freeze credit. If you run a clinic, assume your data is next.
Israeli Startup Tenzai’s AI Hacking Agent Crushes 99% of Humans in Elite CTF Competitions
A new AI agent built by Tenzai cofounders (ex-Israeli intelligence cyber execs) just dominated six major capture-the-flag events, beating 99% of 125,000 human competitors. Using customized OpenAI and Anthropic models, it excelled at both classic web-app exploits and novel AI-prompt-injection attacks.
The cofounders are sounding the alarm: the tech lowers the barrier for cyberattacks to pocket change ($5,000 to run the whole suite) and puts powerful offensive capabilities in the hands of script kiddies and non-state actors. They’re openly calling for regulations that restrict sales of high-capability hacking agents to the general public.
Bottom line: AI is no longer just a defense tool — it’s an offensive force multiplier. Expect nation-states and criminals to adopt similar agents fast. Defenders: start testing AI red-team agents now so you know what’s coming.
Hellcat Ransomware Operator “Pryx” Unmasked — Linked to High-Profile Breaches and a Deadly SCADA Fire
X lit up with OSINT revelations about Pryx (aka HolyPryx), the alleged founder and key operator of the Hellcat ransomware gang. He’s tied to major hits on Jaguar Land Rover, Telefónica, Schneider Electric, and others. More alarmingly, he’s connected to a SCADA network hack on Telecom Egypt that triggered a fire, killing four people and injuring 27.
Pryx has been active since mid-2024 on BreachForums, Dread, and Telegram, selling custom malware and running data-leak operations before scaling to full ransomware. An independent OSINT researcher publicly doxxed his identity and tracking methods in the last day, sparking massive discussion across threat-intel accounts.
Bottom line: When ransomware operators cause real-world deaths, the game changes. Law enforcement now has a face and trail. For organizations: if you see Hellcat indicators, treat it as an existential threat — they play for keeps.
These four stories dominated cybersecurity feeds on X in the past 24 hours because they combine immediate exploit risk, cheap stolen data, bleeding-edge AI offense, and high-stakes attribution drama. Patch Chrome today, review your exposure to healthcare and ITSM systems, watch AI red-team tools closely, and keep an eye on Hellcat — the landscape just got hotter. Stay safe out there.