MSP cybersecurity news digest, March 30, 2026

This bulletin details multiple active and high-risk threats: a rapidly exploited Langflow code-injection flaw (CVE-2026-33017) that can hijack exposed AI workflows; malicious Telnyx PyPI releases containing credential‑stealing malware hidden in audio files; a coordinated campaign abusing GitHub Discussions to deliver developer-targeting reconnaissance and follow-on malware; illicit Entra ID consent-grant attacks enabling persistent Microsoft 365 access; and a Smart Slider 3 vulnerability exposing sensitive server files on hundreds of thousands of WordPress sites—collectively highlighting supply-chain, identity, and developer-infrastructure attack surfaces.