AI-Generated Zero-Day Discovered; Massive Supply Chain Attack Hits npm & PyPI; Ransomware Evolves with Post-Quantum Crypto

A new Q1 2026 report from Check Point Research reveals significant ransomware market consolidation, with top 10 groups claiming 71% of victims. LockBit 5.0 made a strong comeback with 163 victims after law enforcement disruption. Qilin remained the market leader with 338 victims, while 'The Gentlemen' surged to 166 victims, focusing on non-Western regions and FortiGate vulnerabilities. Although overall victim numbers slightly decreased from Q4 2025, the threat level remains high, indicating a mature criminal market dominated by resilient adversaries.

A new report from Barracuda reinforces the escalating email threat landscape, confirming the surge in QR code phishing and highlighting AI's role in crafting hyper-realistic social engineering lures. It identifies malicious HTML attachments as another key evasive delivery method. The report reveals alarming statistics: one in three emails is now malicious or spam, and 34% of companies face monthly account takeovers, increasing internal phishing risks. New mitigation strategies include advanced email security with OCR, account takeover protection, Zero Trust, and Mobile Device Management to combat these industrialized threats.

Ivanti has officially released critical security patches for the actively exploited zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) platform. This RCE flaw, which allows authenticated administrators to execute arbitrary code, was confirmed to be actively exploited in the wild. Despite the availability of patches, reports indicate that hundreds of Ivanti EPMM appliances remained exposed online at the time of disclosure, emphasizing the urgent need for organizations to apply updates and review their network exposure.

New technical analysis of the AI-developed zero-day exploit reveals it targets a semantic logic flaw rooted in a hard-coded trust assumption, enabling 2FA bypass after an attacker obtains valid user credentials. The AI is specifically identified as a Large Language Model (LLM). Additional MITRE ATT&CK techniques include T1588.006 (Develop Capabilities), T1078 (Valid Accounts), and T1610 (Steal Application Access Token). Updated detection guidance emphasizes User and Entity Behavior Analytics (UEBA) and advanced code analysis for AI fingerprints. Mitigation strategies now highlight robust Software Development Lifecycle (SDLC) practices and the use of FIDO2-compliant hardware security keys for MFA.

New reports confirm ShinyHunters exfiltrated an alleged 240 million records from Canvas LMS, including student ID numbers and enrolled course information, in what is now being classified as an encryptionless extortion attack. While previous reports focused on a 'Free-For-Teacher' account exploit, newer analyses broaden the potential initial access vectors. The attack continues to highlight the systemic risk of SaaS dependencies in education.

This update provides further details on the critical CVE-2026-0300 zero-day affecting Palo Alto Networks PAN-OS firewalls. While the CVSS score is noted as 9.3 (compared to 9.8 previously), the article emphasizes the catastrophic impact, including complete firewall compromise, network espionage, and internal network access. CERT-EU has also amplified the warning. Additional detection methods, such as vulnerability scanners, NIDS, and integrity monitoring, are highlighted to help identify and mitigate the threat.