Ransomware, Zero-Days, and Supply Chain Risks Dominate Cybersecurity News

Critical Vulnerabilities and Exploitation:

• [UPDATE] Advisory Warns of Prolific SafePay Ransomware Targeting Critical Infrastructure: Further analysis reveals SafePay ransomware employs double extortion, exfiltrating data before encryption using tools like 7-Zip and RClone. Initial access now specifically includes exploitation of Citrix and Fortinet products, with attackers using Mullvad VPN for anonymity and PsExec for lateral movement.
• [NEW] Arista Patches Exploited VeloCloud Orchestrator Zero-Day: Arista Networks has released emergency patches for CVE-2026-114625, a critical SQL injection vulnerability in its VeloCloud Orchestrator that allows for privilege escalation and is being actively exploited. Successful exploitation grants an authenticated user superuser control over SD-WAN infrastructure.
• [NEW] Critical Splunk Enterprise Flaw Allows System Compromise: A critical improper access control vulnerability, CVE-2026-76299, in Splunk Enterprise (CVSS 9.9) allows a low-privileged network attacker to compromise systems without user interaction, impacting confidentiality, integrity, and availability.

New Threats and Incidents:

• [NEW] Capcom Data Breach Exposes Data of Over 11 Million Users: Japanese gaming company Capcom confirmed a data breach of its CAPCOM ID service, impacting over 11.7 million customer accounts with unauthorized access to email addresses, IP addresses, and login information. Financial data was not compromised.
• [NEW] Ransomware Attack Forces NY School District to Cancel Classes: The Oneonta City School District in New York canceled classes for two days due to a ransomware attack affecting five schools and approximately 1,700 students. Investigations are ongoing with law enforcement.
• [NEW] New 'GlassWorm' Malware Spreads Via VS Code Extensions: A new self-propagating malware named GlassWorm targets developers by hiding in malicious Visual Studio Code extensions. It functions as a worm and credential stealer, exfiltrating browser logins, developer tokens, and cryptocurrency wallet data, posing a supply chain risk.

Industry Trends and Law Enforcement Actions:

• [UPDATE] Kroll Report: 69% of Orgs Breached in Past Year, Most via Third Parties: Updated analysis shows only 7% of breaches originated in the tech sector, yet these incidents caused 79% of all individuals impacted by third-party compromises. The report expands on regulatory implications and vendor risk management, highlighting fourth-party risks and contractual obligations.
• [NEW] INTERPOL Disrupts 10,909 Malicious Networks, Arrests 1,462: Operation Serengeti III, a global law enforcement action led by INTERPOL, disrupted 10,909 malicious networks and led to 1,462 arrests across 21 countries. The operation recovered over $105 million in illicit funds, with estimated losses linked to dismantled networks exceeding $385 million.