Major Data Breaches and Critical Vulnerabilities Dominate Cybersecurity News

Critical Vulnerabilities Under Active Exploitation:

• [UPDATE] China-Linked APT Exploits PHP2Shell and Fragnesia to Root Firewalls: Palo Alto Networks has confirmed active exploitation of PHP2Shell (CVE-2026-109618, CVE-2026-109619) and Fragnesia (CVE-2026-46300) targeting its internet-exposed PAN-OS firewalls and Panorama appliances. Affected versions include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with hotfixes available. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog.
• [NEW] Cisco Patches Actively Exploited Zero-Day Crashing Firewalls: Cisco has released patches for CVE-2026-76418, a high-severity zero-day vulnerability in its ASA and FTD firewall software. Unauthenticated remote attackers are actively exploiting this flaw to cause a denial-of-service condition by crashing devices configured with SSL VPN and secondary authentication.
• [NEW] Chinese APT Exploited Low-Severity VMware Flaw for Stealth: CISA has added a low-severity VMware ESXi logging vulnerability (CVE-2026-41709) to its KEV catalog. A China-linked APT, 'Warp Panda', reportedly exploited this as a zero-day to enable defense evasion and stealthy post-exploitation activity by allowing unlogged command execution with admin privileges.

Significant Data Breaches and Ransomware Incidents:

• [UPDATE] iRhythm Notifies Over 360,000 Patients of Data Breach from June: The iRhythm data breach, initially reported to affect over 360,000 patients, has now been confirmed to impact 8,179,772 individuals. The initial access vector was a social engineering attack targeting company personnel, leading to unauthorized access to third-party business applications.
• [NEW] Japan Airlines Breach Exposes 92,000 Customers via IT Provider: Japan Airlines (JAL) has disclosed a supply chain data breach impacting approximately 92,000 customers. The incident originated at Amadeus IT Group, a third-party vendor managing JAL's passenger reservation system, exposing personal information including names and flight details.
• [NEW] SETTRA Ransomware Group Hits Israel's Largest Car Importer: The SETTRA ransomware group has been identified as the threat actor behind a cyberattack on Colmobil, Israel's largest vehicle importer. The attack disrupted operations and involved double extortion tactics, with threats to leak stolen customer data.
• [NEW] WhiteArmor Ransomware Claims Breach of Echo Global Logistics: The WhiteArmor ransomware group has claimed a major cyberattack against U.S. logistics provider Echo Global Logistics, alleging the theft of millions of freight, customer, and employee records and demanding a $10 million ransom.
• [NEW] Booba Project Ransomware Claims Attack on BASS Medical Group: The 'Booba Project' ransomware group has claimed responsibility for a cyberattack on BASS Medical Group, a California-based healthcare provider, alleging the exfiltration of 100GB of data.