Thursday, 19 March 2026 / Published in AI Agents, Artificial Intelligence, Emerging Threats, Threat Intelligence

State-Sponsored iOS Exploits, Cisco Zero-Day, and Autonomous AI Lead Tech News

This week's technology landscape is marked by critical cybersecurity threats, including a new state-sponsored iOS exploit chain and an actively exploited Cisco firewall zero-day. Alongside these urgent security concerns, advancements in AI continue to reshape enterprise operations, with Snowflake unveiling autonomous AI workflows and new AI-driven solutions emerging to combat agentic AI risks. The accelerating adoption of generative AI in businesses further underscores the need for robust governance and specialized solutions.

Snowflake Unveils Project SnowWork for Autonomous Enterprise AI Workflows

Snowflake has announced the research preview of Project SnowWork, a new autonomous enterprise AI platform designed to significantly accelerate workflows for business users. This platform acts as a proactive AI partner, enabling individuals and teams to articulate their needs conversationally and have Project SnowWork securely complete multi-step tasks. This includes generating board-ready forecast presentations, creating spreadsheets to identify churn risks, or uncovering supply chain bottlenecks, all executed autonomously from end-to-end.

Project SnowWork aims to bridge the gap between extensive investments in modern data platforms and AI, and the continued reliance of most business users on analysts, static dashboards, and siloed systems for basic inquiries. Snowflake's CEO, Sridhar Ramaswamy, emphasized that this shift is about embedding intelligence directly into the operational fabric of the enterprise to unlock new levels of productivity and efficiency. The platform allows business users to move from intent to action and outcomes without needing to file tickets with data teams or search for static dashboards.

Unlike general-purpose AI agents, Project SnowWork is built for action, not just insights. It plans and autonomously executes complex workflows across governed Snowflake data to deliver finished outputs, such as reprioritizing sales territories or generating executive-ready presentations. The platform also generates analysis with recommended actions, turning insights into prioritized next steps tailored to each business role. This secure orchestration of data, AI, and enterprise systems is designed to complete tasks end-to-end, reducing backlogs and accelerating decision-making across the business.

Cisco Firewall Zero-Day Actively Exploited by Interlock Ransomware, Critical Telnetd Flaw Disclosed

Amazon Threat Intelligence has issued a warning regarding an active Interlock ransomware campaign that is exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software. The vulnerability, identified as CVE-2026-20131 with a CVSS score of 10.0, is an insecure deserialization flaw that allows an unauthenticated, remote attacker to bypass authentication and execute arbitrary Java code as root. This zero-day exploit has been active since January 26, 2026, over a month before Cisco publicly disclosed it, giving attackers a significant head start.

In a separate but equally critical development, cybersecurity researchers have disclosed a severe security flaw in the GNU InetUtils telnet daemon (telnetd), tracked as CVE-2026-32746, with a CVSS score of 9.8. This vulnerability, an out-of-bounds write in the LINEMODE Set Local Characters (SLC) suboption handler, can lead to a buffer overflow and ultimately enable unauthenticated remote code execution with elevated privileges. The flaw affects all versions of the Telnet service implementation through 2.7 and can be exploited by sending a specially crafted message during the initial connection handshake.

The active exploitation of the Cisco FMC zero-day by Interlock ransomware highlights the urgent need for organizations to prioritize patching and robust threat intelligence integration. The fact that attackers had a month-long window to compromise systems before public disclosure underscores the effectiveness of zero-day attacks and the challenges in defending against them. Similarly, the Telnetd vulnerability, despite Telnet being an older protocol, poses a significant risk to legacy industrial and networking systems that may still rely on it, potentially granting attackers "keys to the kingdom" if a port is left open.

These incidents emphasize the evolving threat landscape where sophisticated ransomware groups and other malicious actors are quick to weaponize critical vulnerabilities, including zero-days. Organizations must enhance their threat intelligence capabilities to gain early warnings and implement proactive defense strategies, including timely patching, network segmentation, and endpoint protection, to mitigate the risks posed by such high-impact exploits.

New AI Threat Hunting and Continuous Pentesting Solutions Emerge to Combat Agentic AI Risks

As enterprises rapidly adopt generative and agentic AI, new cybersecurity solutions are emerging to address the unique and evolving threat landscape. Coalfire's DivisionHex practice has launched a new AI Threat Hunting capability designed to uncover hidden AI risks, including "shadow AI," compromised AI agents, and agentic insider risks. This service extends traditional threat hunting to actively search for signs of AI systems introducing new attack paths or operating outside their intended permissions. A recent survey highlighted that nearly 90% of organizations have experienced an AI-driven incident in the last 18 months, underscoring the urgent need for such specialized defenses.

The proliferation of AI agents, which can access sensitive data and perform automated tasks, introduces new vulnerabilities such as prompt injection attacks, data poisoning, and privilege escalation through automation. Neil Wyler, Vice President of Defensive Services at Coalfire, emphasizes that manipulated or misconfigured AI agents can effectively become malicious insiders. This highlights a critical shift in the threat landscape, where trusted AI systems themselves can be exploited, necessitating advanced detection and remediation strategies.

In a related development, Cobalt has introduced new AI capabilities for continuous penetration testing, integrating AI with human pentesters and proprietary intelligence to enhance offensive security programs. This platform aims to accelerate the speed, scale, and depth of modern offensive security by automating reconnaissance, vulnerability discovery, and exploitation. With attackers increasingly leveraging AI for sophisticated attacks, continuous validation of real-world risk is becoming essential, moving beyond traditional point-in-time testing.

These new offerings reflect a growing industry recognition that AI-driven threats require AI-powered defenses. The focus on agentic AI security and continuous offensive testing underscores the need for proactive and adaptive cybersecurity strategies to protect against the rapidly evolving capabilities of AI-enabled cyberattacks.

New DarkSword iOS Exploit Chain Leveraged by State-Sponsored Actors and Commercial Spyware

Security researchers have uncovered "DarkSword," a sophisticated iOS exploit chain actively used by multiple threat actors, including suspected state-sponsored groups and commercial surveillance vendors, since at least November 2025. This full-chain exploit leverages six distinct zero-day vulnerabilities in iOS versions 18.4 through 18.7 to achieve complete device compromise. The discovery highlights a concerning trend of advanced mobile exploitation capabilities becoming more accessible and widely deployed.

Notably, the suspected Russian espionage group UNC6353, previously linked to the "Coruna" iOS exploit kit, has incorporated DarkSword into its watering hole campaigns targeting Ukrainian users. This suggests a continuous evolution of tactics by well-resourced threat actors to maintain persistent access and exfiltrate sensitive data. DarkSword is designed for rapid data collection, employing a "hit-and-run" approach to extract credentials, cryptocurrency wallet information, and other personal data within minutes before self-terminating.

The proliferation of such advanced exploit chains, often assumed to be exclusive to state-backed entities, indicates a growing secondary market for these powerful tools. Organizations and individuals, particularly those in high-risk sectors or regions, must prioritize immediate updates to iOS versions 18.7.3 (for iOS 18) or 26.3 (for iOS 26) and newer to mitigate exposure. The exploit's ability to compromise devices with minimal user interaction underscores the critical need for robust mobile security strategies and timely patching.

Enterprise Generative AI Adoption Accelerates, Demanding Enhanced Governance and Domain-Specific Solutions

The enterprise adoption of generative AI and Large Language Models (LLMs) is rapidly transitioning from experimental phases to widespread implementation, with a projected market value reaching approximately USD 78 billion by 2035, growing at a CAGR of 29%. This surge reflects a fundamental shift towards deeply embedded, enterprise-wide intelligence ecosystems. As generative AI becomes an everyday tool across various business functions, organizations are increasingly focusing on real-world use cases that deliver measurable business impact, moving beyond generic AI implementations to domain-specific solutions tailored to industry and functional needs.

However, this rapid adoption highlights a critical need for robust governance and oversight. A recent report indicates that 53% of professionals are using generative AI without formal approval, and 28% of organizations lack a formal policy, suggesting that AI is advancing faster than enterprise controls can be established. This "shadow AI" presents compliance and security risks, underscoring the imperative for organizations to empower teams with authorized, secure AI environments and proactively guide usage through policy, education, and leadership.

The focus is also shifting towards model optimization, cost efficiency, and real-time adaptability, rather than solely on model size. Enterprises are prioritizing interoperability and integration across digital stacks, aligning LLM capabilities with broader digital transformation agendas. This includes the emergence of platforms like Fractal's LLM Studio, which enables organizations to build and run language models tailored to their business, offering greater control over governance, deployment, and management in production, often at a fraction of the cost of larger foundation models.

Sources

You must be logged in to post a comment.