⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More

This article is a weekly cybersecurity recap covering major threats, vulnerabilities, and incidents from the week of March 16, 2026.

• •Google patched two actively exploited Chrome 0-days: CVE-2026-3909 (Skia out-of-bounds write) and CVE-2026-3910 (V8 inappropriate implementation), fixed in Chrome 146.0.7680.75/76
• •Threat actor UNC6426 used stolen nx npm supply chain keys to fully breach an AWS environment within 72 hours, exfiltrating S3 data
• •Law enforcement dismantled the SocksEscort botnet (AVrecon malware); KadNap botnet with 14,000+ devices fuels an illegal proxy service named Doppelganger
• •APT28 deployed a toolkit combining legacy malware techniques with a modified COVENANT framework targeting Ukrainian cyber assets
• •Meta announced discontinuation of Instagram end-to-end encryption after May 8, 2026