From Iran to Ukraine, everyone's trying to hack security cameras

A roundup of March 2026 Arstechnica security coverage highlighting active nation‑state campaigns, widespread supply‑chain and commodity malware activity, emerging AI privacy risks, and several high‑impact vulnerabilities in active exploitation. Notable items: apparent Iranian actors hijacking consumer security cameras; CISA adding three iOS flaws to its known‑exploited catalog; Russian‑state exploitation of a newly patched Microsoft Office vulnerability; resurgence of Lumma stealer tied to Castleloader and social engineering lures; a supply‑chain compromise of Notepad++; malicious packages plh