[{"data":1,"prerenderedAt":203},["ShallowReactive",2],{"publication:en:D202603":3},{"meta":4,"copy":18,"relatedArticles":158,"terms":195,"term":196,"resourceParent":197,"glossaryParent":200},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202603","\u002Fblog\u002Fvulnerability-digest-2026-03","article","Website vulnerability digest for March 2026","Cybersecurity digest for March 2026","March 2026: vulnerabilities, breaches and cyber incidents","March 2026 security digest: software vulnerabilities, incidents involving Loblaw and Stryker, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-02","\u002Fblog\u002Fvulnerability-digest-2026-04","2026-04-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":118,"checklist":119,"faq":122,"sources":132,"links":140,"cta":153},"March brought a WordPress core security release, a Node.js HTTP-header crash fix and a curl redirect correction. The work spans the site, its runtime and outbound API clients. Updating one layer does not confirm that the other two use patched packages. The issue also covers incidents involving Loblaw and Stryker, with the reported impact and checks relevant to a business using similar services.",[21,45,54,66,78,95,104,113],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-03-01 to 2026-03-31. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for March 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-03-10","WordPress","6.9.2",[38,39,40],"2026-03-24","Node.js | CVE-2026-21710","20.20.2 \u002F 22.22.2 \u002F 24.14.1 \u002F 25.8.2",[42,43,44],"2026-03-11","curl | CVE-2026-3783","8.19.0 \u002F 8.16.1 \u002F 8.14.2",{"title":46,"paragraphs":47,"sources":50},"WordPress: the March core security release",[48,49],"WordPress 6.9.2 includes fixes for several separate issues, including blind SSRF, stored XSS, authorization weaknesses and archive path traversal. The release also coordinates an external getID3 fix. Each feature has its own conditions; the notice does not establish one universal exploit against every installation.","Apply a current supported core release or verify the corresponding branch backport. Check media handling, editorial permissions and the enquiry route on a copy before updating the live site.",[51],{"label":52,"url":53},"wordpress 6 9 2 release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F03\u002Fwordpress-6-9-2-release\u002F",{"title":55,"paragraphs":56,"sources":59},"Node.js: request headers and availability (CVE-2026-21710)",[57,58],"A request containing the header name __proto__ can crash a Node.js HTTP server when application code reads req.headersDistinct. The exception occurs in a property getter. The March security release fixes the issue in the then-active 20, 22, 24 and 25 branches.","Check application and middleware use of req.headersDistinct. Update the deployed runtime, then verify API error handling and monitoring on controlled requests without testing a crash against production.",[60,63],{"label":61,"url":62},"march 2026 security releases","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Fmarch-2026-security-releases",{"label":64,"url":65},"CVE-2026-21710 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-21710",{"title":67,"paragraphs":68,"sources":71},"curl: redirects, netrc and bearer tokens (CVE-2026-3783)",[69,70],"A bearer token can reach another hostname after a redirect when the destination matches credentials in a netrc file, including a default entry. This affects clients combining those features. The March correction is separate from January's cross-protocol redirect issue.","Inventory netrc use in scheduled jobs and deployment integrations. Keep redirect destinations explicit, update the linked library and verify that authorized requests still reach only their intended endpoint.",[72,75],{"label":73,"url":74},"curl advisory CVE-2026-3783","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2026-3783.html",{"label":76,"url":77},"CVE-2026-3783 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-3783",{"title":79,"paragraphs":80,"table":82},"Breaches and cyber incidents reported this month",[81],"These cases were publicly reported during March 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":83,"headers":84,"rows":88},"Incident notices: March 2026",[85,86,87],"Organization","Public notice","Incident",[89,92],[90,34,91],"Loblaw","Information exposure",[93,42,94],"Stryker","Operational disruption",{"title":96,"paragraphs":97,"sources":100},"Loblaw: contact information and customer session resets (2026-03-10)",[98,99],"On 2026-03-10, Loblaw reported unauthorized access to customer names, phone numbers and email addresses. It logged customers out as a response measure; its initial investigation did not indicate compromise of passwords, health information or credit-card data.","Prepare a controlled way to revoke customer sessions during an incident. Explain the reason for a forced sign-in clearly, and review recovery and support procedures against impersonation using exposed contact information.",[101],{"label":102,"url":103},"Loblaw Companies Limited: incident notice","https:\u002F\u002Fwww.loblaw.ca\u002Fen\u002Floblaw-notifies-customers-of-a-low-level-data-breach\u002F",{"title":105,"paragraphs":106,"sources":109},"Stryker: disruption across a corporate Microsoft environment (2026-03-11)",[107,108],"Stryker's 2026-03-11 filing described a cyber incident causing global disruption to its Microsoft environment and restricting business applications. The filing said the full scope and impact were still being investigated; it did not establish a specific volume of stolen data.","Map which business processes depend on the same identity and collaboration environment. Rehearse an independent way to communicate, receive orders and validate restored access when that environment is unavailable.",[110],{"label":111,"url":112},"Stryker \u002F SEC Form 8-K: incident notice","https:\u002F\u002Fwww.sec.gov\u002FArchives\u002Fedgar\u002Fdata\u002F310764\u002F000119312526102460\u002Fd76279d8k.htm",{"title":114,"paragraphs":115},"Coverage and editorial record",[116,117],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[49,58,70,120,121],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[123,126,129],{"question":124,"answer":125},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":127,"answer":128},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":130,"answer":131},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[133,134,135,136,137,138,139],{"label":52,"url":53},{"label":61,"url":62},{"label":64,"url":65},{"label":73,"url":74},{"label":76,"url":77},{"label":102,"url":103},{"label":111,"url":112},[141,143,145,148,151],{"path":14,"label":142},"Previous issue: February 2026",{"path":15,"label":144},"Next issue: April 2026",{"path":146,"label":147},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":149,"label":150},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":152},"All articles",{"title":154,"description":155,"button":156,"type":157},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[159,171,180,188],{"id":160,"path":14,"title":161,"description":162,"category":163,"artwork":164,"order":165,"publishedOn":166,"period":167,"related":168},"D202602","Cybersecurity digest for February 2026","February 2026 security digest: software vulnerabilities, incidents involving Odido and BridgePay, sources and practical checks for businesses.","digest","vulnerability-digest",9,"2026-03-03","2026-02",[169,6,146,170],"\u002Fblog\u002Fvulnerability-digest-2026-01","\u002Fblog\u002Fwhy-website-updates-matter",{"id":172,"path":15,"title":173,"description":174,"category":163,"artwork":164,"order":175,"publishedOn":176,"period":177,"related":178},"D202604","Cybersecurity digest for April 2026","April 2026 security digest: software vulnerabilities, incidents involving Vercel and Hasbro, sources and practical checks for businesses.",7,"2026-05-03","2026-04",[6,179,146,170],"\u002Fblog\u002Fvulnerability-digest-2026-05",{"id":181,"path":146,"title":182,"description":183,"category":184,"artwork":185,"order":186,"publishedOn":187},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":189,"path":170,"title":190,"description":191,"category":192,"artwork":192,"order":193,"publishedOn":194},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":198,"label":199},"\u002Fresources","Website security resources and templates",{"path":201,"label":202},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058076]