Site Map

DocketWise Data Breach Exposes Sensitive Personal, Financial, and Medical Data of 143,000 People

DocketWise, an immigration and legal case management platform, has disclosed a significant data breach impacting over 143,000 individuals. The incident was traced back to a threat actor using valid credentials to clone repositories belonging to a third-party partner. These repositories contained a data migration pipeline for DocketWise, exposing a vast trove of sensitive data, including Social Security numbers, passport details, financial information, and private medical records.

Lazarus Group Unleashes 'RemotePE' Memory-Only RAT in Attacks on Financial and Crypto Firms

The North Korean state-sponsored threat actor, Lazarus Group, is deploying a sophisticated new memory-only Remote Access Trojan (RAT) named 'RemotePE'. Delivered via a multi-stage infection chain that begins with social engineering, the malware targets financial and cryptocurrency firms, executing entirely in memory to evade filesystem-based security tools and analysis.

NIST Drafts New Guidance for Ransomware Response and Recovery in Manufacturing Sector

The U.S. National Institute of Standards and Technology (NIST) has released a draft special publication, SP 1800-41, aimed at improving ransomware response and operational recovery for the manufacturing sector. The guidance provides a framework for securing operational technology (OT) environments, which are uniquely vulnerable to the disruptions caused by ransomware attacks.

Taiwan Government Agencies Reported 726 Cybersecurity Incidents in Past Year

Taiwan's Administration for Cybersecurity has released its annual report, detailing 726 cybersecurity incidents affecting government agencies over the past year. Unauthorized intrusion was the most common incident type, accounting for nearly 70% of cases. The report also identified several major threats facing the government, including supply chain risks from backdoored hardware, 'bring-your-own-driver' attacks to disable security software, and vulnerabilities in remote access tools and network edge devices.

DragonForce Ransomware Claims Attack on HELIX INTERNATIONAL, Threatens Data Leak

The ransomware group DragonForce has claimed responsibility for a cyberattack on HELIX INTERNATIONAL, a U.S.-based software and managed services provider. The group has posted a notice on its dark web leak site, threatening to publish a 'full leak' of sensitive data allegedly exfiltrated from the company unless a representative enters into negotiations, following a typical double extortion tactic.

Nightspire Ransomware Group Claims Attack on Italian Firm Pat**** S.r.l

The ransomware group Nightspire has claimed responsibility for a cyberattack against Pat**** S.r.l, an Italian company. While details are limited, the group has added the firm to its dark web leak site and implied that data has been exfiltrated, threatening to make it public if their demands are not met, following the common double extortion model.

‘Megalodon’ Campaign Hits 5,500+ GitHub Repos in Automated CI/CD Supply Chain Attack

A massive, automated supply chain attack dubbed 'Megalodon' has compromised over 5,500 public GitHub repositories in just six hours. The attackers pushed thousands of malicious commits that altered CI/CD workflow files, backdooring the build processes of the affected projects. Research from Hudson Rock indicates the attack was enabled by the large-scale theft of GitHub credentials from developers infected with information-stealing malware. Over a third of the compromised repository owners were found on lists of known infostealer victims. This campaign, along with similar attacks from the group TeamPCP, signals a new era of widespread, automated assaults on the software supply chain, prompting defensive measures from platforms like npm.

Europol IOCTA Report: AI, Encryption, and Data Theft are Fueling an Industrialized Cybercrime Wave

Europol's 2026 Internet Organised Crime Threat Assessment (IOCTA) report warns of an industrialized cybercrime landscape where AI, encryption, and proxies are making attacks faster and more sophisticated. The report highlights a significant shift in ransomware tactics towards data theft and extortion, moving away from pure encryption. It also notes a concerning trend of state-sponsored actors using cybercriminal groups as proxies, blurring the lines between espionage and financially motivated crime.

Anthropic's 'Mythos' AI Model Triggers Global Cybersecurity Overhaul

The announcement of 'Claude Mythos', a frontier AI model from Anthropic, is causing a seismic shift in global cybersecurity strategy. Anthropic revealed that the model, which will not be publicly released due to its potential for misuse, is capable of autonomously discovering and exploiting unknown zero-day vulnerabilities in major software. The UK's AI Safety Institute independently confirmed these capabilities, calling it a 'watershed moment'. In response, governments and major corporations are scrambling to reassess their security postures against this new class of AI-driven threat. India's finance ministry and China's cybersecurity industry are already reacting, while Anthropic has launched 'Project Glasswing' to give select partners like Apple and Goldman Sachs controlled access to test their defenses.

Ransomware Evolves in 2026: Attackers Adopt Post-Quantum Crypto and Encryptionless Extortion

Kaspersky's 2026 ransomware report reveals major tactical shifts. While the number of affected organizations has slightly decreased, the threat has intensified. Advanced groups are now deploying ransomware with post-quantum cryptography to future-proof their extortion. A growing trend is 'encryptionless extortion,' where attackers like ShinyHunters skip encryption and focus solely on data theft and the threat of public leaks. Attackers also continue to rely on Initial Access Brokers and increasingly use 'EDR killers' and BYOVD techniques to neutralize endpoint security as a standard attack phase.

Critical Unauthenticated SQLi Flaw in Drupal Core Hits PostgreSQL Sites

The Drupal project has released security updates to patch a critical SQL injection vulnerability, tracked as CVE-2026-9082. The flaw affects Drupal Core sites that use a PostgreSQL database backend. It can be exploited by an unauthenticated, anonymous user, making it extremely dangerous for any public-facing site. Successful exploitation can lead to data disclosure, privilege escalation, and potentially remote code execution (RCE). Drupal administrators using PostgreSQL are urged to update their sites immediately.

Trump Mobile API Flaw Exposes Personal Data of 27,000 Smartphone Pre-Order Customers

Trump Mobile is investigating a significant data exposure incident affecting approximately 27,000 customers who pre-ordered the company's T1 smartphone. A security researcher discovered an unprotected API endpoint that allowed public access to customer records, including names, email addresses, mailing addresses, and phone numbers. The vulnerability, which did not require authentication, could be queried to retrieve customer data in batches. While Trump Mobile stated that sensitive financial data was not compromised, the incident highlights critical security gaps in customer data protection, potentially stemming from a third-party platform used by the company.

CISA Contractor Leaks AWS GovCloud Keys and Internal System Credentials on Public GitHub Repo

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is under congressional investigation after a contractor exposed highly sensitive credentials on a public GitHub repository. The repository, named 'Private-CISA,' contained plaintext credentials for AWS GovCloud accounts, SSH keys, and access tokens for internal CISA systems like Artifactory. The data, totaling 844 MB, was reportedly exposed for months, having been active since November 2025. It was used by the contractor to sync files between work and home. Researchers from GitGuardian discovered the leak and noted that the contractor appeared to have deliberately disabled GitHub's secret-scanning protections. While CISA states there is no evidence of compromise, the incident raises severe concerns about the agency's vendor management and internal data handling policies.

TeamPCP Threat Actor Breaches TanStack in 'Mini Shai-Hulud' Supply Chain Campaign

The financially motivated threat group 'TeamPCP' has been identified as the actor behind the 'Mini Shai-Hulud' supply chain campaign, which recently compromised the popular TanStack open-source library. The attack, which also targeted the npm and PyPI ecosystems, involved publishing malicious packages that, when downloaded by developers, execute a credential-stealing payload. The compromise of TanStack, a widely used suite of tools for web application development, represents a significant threat to the numerous downstream projects that depend on it. This incident is part of a growing trend of software supply chain poisoning attacks aimed at compromising developer environments to steal sensitive secrets.

Akamai Report: Financial Sector Under Siege from AI-Powered Botnets and Escalating DDoS Attacks

According to a new 'State of the Internet' report from Akamai, the financial services sector is facing a growing threat from increasingly sophisticated cyberattacks. The report highlights the use of AI-empowered botnets that operate with greater speed and autonomy, launching what Akamai's Advisory CISO calls a 'sustained siege' rather than simple nuisance attacks. Digital transformation has expanded the attack surface, with API vulnerabilities being a key area of risk. The report, echoed by other industry leaders, concludes that financial institutions must adopt AI-driven defensive technologies to combat AI-weaponizing adversaries, particularly against threats like Authorized Push Payment (APP) fraud and advanced DDoS attacks.

'Trapdoor' Android Ad Fraud Campaign Used 455 Malicious Apps to Hijack Millions of Devices

A sophisticated and large-scale Android ad fraud operation named 'Trapdoor' has been uncovered by security researchers. The campaign involved a network of 455 malicious apps, downloaded over 24 million times from the Google Play Store, that worked together to generate massive fraudulent ad revenue. The operation used a two-stage approach: initial 'dropper' apps would trick users into installing a secondary, more malicious app. This second app would then load hidden browser windows to generate fake ad clicks, at its peak creating 659 million fraudulent ad bid requests in a single day. The malware cleverly evaded detection by remaining dormant unless the user had been acquired through a paid malvertising campaign. Google has since removed the identified apps.

NYC Health + Hospitals Breach May Affect 1.8 Million Patients and Employees

NYC Health + Hospitals Corporation, the largest public health system in the United States, has reported a massive data breach that may have compromised the personal and protected health information (PHI) of approximately 1.8 million people. The breach, which occurred in late March, affects both current and former patients and employees. The compromised data puts a vast number of individuals at risk of identity theft, medical fraud, and other malicious activities. The incident was reported to the U.S. Department of Health and Human Services Office for Civil Rights. Details on how the attackers breached the system have not yet been disclosed, but the scale of the incident underscores the immense value of healthcare data to cybercriminals and the persistent challenges faced by healthcare organizations in protecting it.

Chinese APT 'Webworm' Uses Discord and MS Graph API for C2 in New Backdoor Attacks

The China-aligned threat actor known as 'Webworm' has been observed deploying two new, sophisticated backdoors named 'EchoCreep' and 'GraphWorm'. These tools represent an evolution in the group's tactics, using legitimate and widely-used services for command-and-control (C2) to evade detection. EchoCreep uses Discord for its C2 communications, while GraphWorm leverages the Microsoft Graph API. This 'living off the land' technique allows the malware's traffic to blend in with normal network activity. Webworm, active since at least 2022, has historically targeted government, IT, aerospace, and energy sectors in Asia and Russia, but has recently expanded its targeting to Europe and Africa. The new backdoors demonstrate the group's continuous development and adaptation of its malware arsenal.

TanStack Details Sophisticated Supply Chain Attack That Compromised 42 npm Packages

The maintainers of the popular open-source toolkit TanStack have detailed a highly sophisticated supply chain attack that compromised 42 of their npm packages. In a six-minute window, attackers used a novel method involving a malicious pull request, GitHub Actions cache poisoning, and the theft of a short-lived OIDC token to publish 84 malicious package versions. The attack did not require compromised maintainer credentials and highlights a new, dangerous vector for attacking the software supply chain through CI/CD pipelines.

New 'Underminr' Flaw in CDNs Puts 88 Million Domains at Risk of Evasive Attacks

A newly disclosed vulnerability named 'Underminr' affects shared Content Delivery Network (CDN) infrastructure, enabling a sophisticated form of domain fronting. The flaw allows attackers to hide malicious command-and-control (C2) traffic behind an estimated 88 million trusted domains, primarily impacting infrastructure in the U.S., UK, and Canada. By placing a legitimate domain in the unencrypted part of an HTTPS request, attackers can bypass security tools and route traffic to a malicious server, a technique already being exploited in the wild and expected to be amplified by AI-driven malware.

Critical 18-Year-Old 'NGINX Rift' Vulnerability (CVE-2026-42945) Under Active Attack

A critical vulnerability in the NGINX web server, dubbed 'NGINX Rift' and tracked as CVE-2026-42945, is being actively exploited in the wild. The flaw, a heap buffer overflow that has existed in the codebase for 18 years, can be triggered by a remote attacker to cause a denial-of-service (DoS) and potentially achieve remote code execution (RCE). Given NGINX's widespread use, millions of internet-facing applications are at risk, and administrators are urged to patch immediately.

Laravel-Lang Supply Chain Attack Injects Credential Stealer into 233 Package Versions

A major supply chain attack has targeted the popular Laravel-Lang project, used for language localization in the Laravel PHP framework. Attackers compromised 233 version tags across three key repositories, injecting a multi-stage credential-stealing payload. The attack cleverly exploited a GitHub feature, allowing malicious version tags to point to a forked repository, thereby bypassing direct code commits to the official project. The package manager Packagist served the compromised code, which fingerprinted infected machines and downloaded a second-stage payload from a C2 server to steal a wide array of credentials.

Packagist Supply Chain Attack Uses Clever Evasion to Infect PHP Projects with Linux Malware

A coordinated supply chain attack has compromised at least eight packages on Packagist, the main PHP package repository. The attackers modified the packages to download and execute a Linux binary hosted on GitHub. In a clever evasion tactic, the malicious code was hidden in the `package.json` file, which is typically used for JavaScript tooling, rather than the expected PHP `composer.json` file. This allowed the `postinstall` script to evade security scanners focused on the PHP ecosystem. The Packagist team has since removed the malicious versions.

Gartner Names LinkShadow a 'Visionary' in 2026 Magic Quadrant for Network Detection and Response

The technology research firm Gartner has positioned LinkShadow in the Visionaries Quadrant of its 2026 Magic Quadrant for Network Detection and Response (NDR). This recognition highlights LinkShadow's completeness of vision and ability to execute in the competitive NDR market. LinkShadow's strategy, termed 'Intelligent NDR,' focuses on integrating AI-driven analytics and deep contextual awareness to provide a unified approach to security, helping teams overcome alert fatigue and fragmented visibility.

New 'MiniPlasma' Windows Zero-Day Resurrects Patched Flaw for Full System Control

A security researcher has released a proof-of-concept exploit for 'MiniPlasma,' an unpatched zero-day vulnerability affecting modern Windows 11 systems. The flaw, a regression of a bug Microsoft supposedly fixed in 2020, allows a local attacker to escalate privileges to SYSTEM, gaining complete control over the machine. The vulnerability exists in the Windows Cloud Files Mini Filter Driver (`cldflt.sys`) and highlights potential gaps in Microsoft's patching process, as the original exploit for CVE-2020-17103 now works again on fully updated systems.

Massive HIPAA Breach Wave Hits U.S. Healthcare, Exposing Thousands of Patient Records

Multiple U.S. healthcare organizations, including the World Trade Center Health Program and LHC Group, have disclosed significant data breaches throughout May 2026. These incidents, some orchestrated by ransomware groups like TridentLocker, have resulted in the exposure of highly sensitive Protected Health Information (PHI) for thousands of individuals. The attacks highlight a persistent and troubling trend of cybercriminals targeting the healthcare sector and its third-party vendors, compromising names, Social Security numbers, and detailed medical histories. The breaches underscore the critical need for robust security measures and diligent vendor risk management within the healthcare industry.

New 'Aur0ra' Ransomware Emerges with Stealthy Dual-Extortion Tactics

A new ransomware strain named Aur0ra has been identified, employing a dual-extortion model that is becoming standard for modern ransomware. The malware encrypts files, making them inaccessible, and claims to have exfiltrated sensitive data before encryption. A distinguishing feature of Aur0ra is its stealthy approach: it does not change the filenames or extensions of the files it encrypts, making it harder for users to immediately identify the scope of the damage. Victims are directed to a Tor-based site for negotiation via a ransom note.

Microsoft and FBI Takedown 'Fox Tempest' Malware-Signing Service Fueling Ransomware Attacks

Microsoft's Digital Crimes Unit, in collaboration with the FBI and Europol, has dismantled a major cybercrime operation known as Fox Tempest. The group operated a Malware-Signing-as-a-Service (MSaaS) platform called 'signspace.cloud,' which provided threat actors, including the operators of Qilin, Akira, and Rhysida ransomware, with fraudulently obtained code-signing certificates. This service allowed malicious software to appear legitimate, bypassing security measures and enabling attacks on thousands of organizations worldwide, including hospitals, schools, and other critical infrastructure. The takedown involved seizing the platform's infrastructure and revoking associated certificates, marking a significant disruption to the cybercrime supply chain.

Actively Exploited Microsoft Defender Flaws Allow Privilege Escalation, Evasion

Two vulnerabilities in Microsoft Defender are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) catalog. The flaws, CVE-2026-41091 (Elevation of Privilege, CVSS 7.8) and CVE-2026-45498 (Denial-of-Service, CVSS 4.0), allow attackers to gain SYSTEM-level permissions or disable the antivirus engine, creating a window to deploy malware undetected. Users are urged to ensure their Microsoft Defender Antimalware Platform is updated to version 4.18.26040.7 or later.

Industrial Giants Under Siege: Foxconn and Škoda Auto Suffer Major Cyberattacks

Two major multinational corporations, electronics manufacturer Foxconn and automaker Škoda Auto, have been targeted in separate, significant cyberattacks in May 2026. Foxconn's North American facility was struck by the Nitrogen ransomware group, resulting in the exfiltration of 8 TB of data, including 11 million files of confidential project documentation. Meanwhile, Škoda Auto's online shop was taken offline after attackers exploited a software vulnerability, likely compromising customer personal data. These incidents highlight the diverse and persistent threats facing global manufacturing and automotive industries, from ransomware to application exploits.

Iranian APT 'Screening Serpens' Intensifies Espionage with New RATs Targeting US, Israel, and UAE

The Iran-nexus advanced persistent threat (APT) group known as Screening Serpens (also UNC1549, Smoke Sandstorm) has escalated its cyber-espionage activities, according to researchers at Unit 42. The campaigns, which ran from mid-February to April 2026, coincided with regional conflicts and targeted professionals in the technology sectors of the U.S., Israel, and the UAE. The group has deployed two new malware families, MiniUpdate and MiniJunk V2, and is using advanced techniques like AppDomainManager hijacking to improve its operational resilience and evade detection.

CISA KEV Catalog Updated: Actively Exploited Langflow and Trend Micro Flaws Demand Urgent Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active exploitation. The flaws are CVE-2025-34291, an Origin Validation Error in Langflow, and CVE-2026-34926, a Directory Traversal vulnerability in on-premise versions of Trend Micro Apex One. Under Binding Operational Directive (BOD) 22-01, federal agencies are mandated to remediate these vulnerabilities by a specified deadline, and CISA strongly urges all organizations to prioritize patching immediately to mitigate risk.

Vietnam Government Systems Breached, SOCs Fail to Detect Intrusions

Vietnamese cybersecurity authorities are investigating major data breaches at two unnamed ministry-level agencies, where hackers have allegedly stolen millions of user records. According to the Vietnam National Cyber Emergency Response Team (VNCERT), the attacks were not detected by the Security Operations Center (SOC) platforms in place at the agencies. The incident highlights a critical challenge: a severe shortage of skilled cybersecurity personnel to effectively operate and manage advanced security technologies, rendering significant investments in security infrastructure ineffective.

AI Amplifies Supply Chain Threats, Creating New and Complex Cyber Risks

The rapid integration of Artificial Intelligence (AI) into global supply chains is creating a new and complex risk landscape. While AI offers benefits in automation and analytics, it also introduces a new attack surface for threat actors. Malicious actors are exploiting AI to automate reconnaissance, create polymorphic malware, and carry out sophisticated attacks like model poisoning and prompt injection. With third-party involvement in breaches on the rise, compromised AI tools within a supply chain can lead to data manipulation, operational disruption, and intellectual property theft.

Germany Becomes Epicenter of European Cyber Conflict with 124% Surge in Attacks

Cyberattacks in the DACH region (Germany, Austria, Switzerland) surged by 124% in 2025, with Germany bearing the brunt, accounting for 82% of all incidents. According to research from Check Point, this dramatic increase is fueled by a dual threat: pro-Russian hacktivist groups like NoName057(16) conducting politically motivated denial-of-service and defacement campaigns, and sophisticated ransomware gangs like Qilin, Akira, and LockBit carrying out financially motivated attacks. Germany's economic power and geopolitical stance have made it a prime target for this convergence of cybercrime and geopolitical conflict.

Iranian APT Screening Serpens Unleashes New RATs in Espionage Campaign Against US, Israel, and UAE

Unit 42 has identified a series of cyberespionage campaigns conducted by the Iran-nexus Advanced Persistent Threat (APT) group Screening Serpens (also known as UNC1549) between February and April 2026. The attacks, which align with regional conflicts, targeted technology, aerospace, and defense organizations in the United States, Israel, and the United Arab Emirates. The threat actor has demonstrated a significant evolution in its capabilities, notably employing a .NET technique called AppDomainManager hijacking to disable security mechanisms within legitimate applications. Researchers discovered six new Remote Access Trojan (RAT) variants, which have been grouped into two new families: MiniUpdate and MiniJunk V2. The infection chain begins with highly targeted social engineering lures, often related to job recruitment, and uses DLL sideloading for execution, with command-and-control traffic routed through dedicated Azure-hosted domains to maintain operational security.

Nation-State Actors Weaponize Open-Source ROADtools for Azure Cloud Attacks, Bypassing MFA and Persisting in Networks

Nation-state threat actors, including Midnight Blizzard and Curious Serpens, are increasingly misusing ROADtools, a legitimate open-source framework for Azure and Entra ID security research, to conduct sophisticated cloud attacks. According to Unit 42, attackers leverage ROADtools to perform discovery, establish persistence, and evade defenses within target cloud environments. The tool's ability to interact with legitimate Microsoft APIs and customize its network traffic makes it difficult to detect. Key malicious uses include enumerating tenant information, manipulating OAuth tokens for session hijacking, and registering rogue devices in Entra ID to bypass Multi-Factor Authentication (MFA) and Conditional Access Policies. This report provides defenders with an overview of the tool's capabilities and actionable guidance for detecting and mitigating its malicious use.

State CISO Confidence Plummets as AI Threats Rise and Budgets Fall, Survey Finds

Confidence among U.S. state chief information security officers (CISOs) has dropped dramatically, according to the 2026 NASCIO-Deloitte Cybersecurity Study. Only 26% of state CISOs feel 'extremely' or 'very' confident in their ability to protect state systems, a steep decline from 48% in 2022. The primary drivers for this pessimism are the rapid rise of AI-powered cyberattacks and insufficient funding. Many CISOs report that budgets are either stagnant or, in some cases, have been cut, even as threats like AI-driven ransomware and deepfakes become more prevalent. In response, state cyber leaders are shifting their focus to implementing effectiveness metrics to better justify budget requests and demonstrate the value of their security programs.

Warning: Microsoft Defender Flaws Actively Exploited to Gain SYSTEM Privileges

Microsoft has confirmed that two vulnerabilities in its Microsoft Defender antivirus solution, CVE-2026-41091 and CVE-2026-45498, are being actively exploited in the wild. The more severe flaw, CVE-2026-41091, is a local privilege escalation (LPE) vulnerability that allows an attacker with basic access to a machine to elevate their privileges to the SYSTEM level, granting them full control. The second bug, CVE-2026-45498, can be used to create a denial-of-service condition, disabling the antivirus engine. Microsoft has released an update for the affected Malware Protection Engine and urges users to ensure their systems are patched due to the active exploitation.

Supply Chain in Crisis: Exploits Now Arrive Before Companies Know They're Vulnerable

A May 2026 report from Black Kite warns of a deepening supply chain security crisis, characterized by 'Velocity Without Visibility.' With over 48,000 CVEs published in 2025, the speed of exploitation has now surpassed the speed of discovery for many organizations, meaning exploits are available before or at the moment of public disclosure. The report highlights that while the volume of vulnerabilities is overwhelming, only a small fraction are easily exploitable, making visibility the key challenge for defenders. This crisis is exacerbated by the rise of AI, which is expected to discover even more flaws, and a series of recent attacks targeting foundational developer tools from TanStack, Mistral AI, and UiPath, demonstrating that attackers are moving up the supply chain.

CISA Opens KEV Catalog to Public Submissions to Speed Up Threat Response

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched a new public-facing submission process for its Known Exploited Vulnerabilities (KEV) catalog. Announced on May 21, 2026, the initiative allows security researchers, vendors, and the general public to submit evidence of vulnerabilities being actively exploited in the wild. This move aims to leverage the collective intelligence of the cybersecurity community to make the KEV catalog, a key component of Binding Operational Directive (BOD) 22-01, more comprehensive and timely. By crowdsourcing this data, CISA hopes to reduce the lag time between exploit discovery and official warning, enhancing risk reduction for both federal agencies and private organizations.

CISA Adds Seven New Vulnerabilities to 'Must-Patch' KEV Catalog

On May 20, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This action, under Binding Operational Directive (BOD) 22-01, mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these specific flaws by a set deadline. While the specific CVEs were not detailed in the summary, their inclusion indicates that CISA has credible evidence of active exploitation in the wild. This update follows other recent additions in May, including flaws in Microsoft Exchange, SimpleHelp, Samsung, and D-Link, which were leveraged in ransomware and botnet campaigns. CISA urges all organizations, not just federal agencies, to prioritize patching these vulnerabilities.

CrowdStrike: North Korea Stole Billions in Crypto, Financial Sector Attacks Up 43%

CrowdStrike's 2026 Financial Services Threat Landscape Report, released May 20, 2026, details a massive escalation in cyberattacks against the financial sector, driven by North Korean state actors and organized eCrime groups. DPRK-nexus adversaries, such as PRESSURE CHOLLIMA and GOLDEN CHOLLIMA, stole billions in cryptocurrency in 2025, including a single record-breaking theft of $1.46 billion. These groups are now using AI for social engineering and deception. Overall, hands-on-keyboard intrusions against financial firms surged 43% globally, with attackers increasingly exploiting trusted identities and SaaS applications to bypass defenses. The eCrime group MUTANT SPIDER was also a major driver, using vishing campaigns to gain initial access for ransomware operations.

Cisco Scrambles to Patch Critical 10.0 CVSS Zero-Day in SD-WAN Under Active Attack

Cisco has released emergency patches for a critical authentication bypass vulnerability (CVE-2026-20182) in its Catalyst SD-WAN products, which carries a maximum CVSS score of 10.0. The flaw is being actively exploited in targeted attacks by a sophisticated threat actor tracked as UAT-8616, allowing remote attackers to gain full administrative control over SD-WAN fabrics. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating immediate patching for federal agencies.

State-Sponsored Ransomware Blurs Lines, Increasingly Deployed as Proxy Weapon Against Critical Infrastructure

The line between nation-state espionage and financially motivated cybercrime is dissolving as state-sponsored actors, particularly from Iran, increasingly use ransomware as a proxy weapon. Security analysts report that groups like MuddyWater and APT33 are leveraging criminal ransomware gangs to attack critical infrastructure and operational technology (OT) sectors. This hybrid approach allows nations to cause physical disruption and exert geopolitical pressure while maintaining plausible deniability, shifting ransomware from a tool of extortion to one of strategic sabotage.

Email Under Siege: AI, QR Codes, and Phishing-as-a-Service Fuel Surge in Attacks

A new report from Barracuda reveals a dramatic escalation in email-based threats, with one in three messages being malicious or spam. Attackers are industrializing their operations, using AI for hyper-realistic social engineering and Phishing-as-a-Service (PhaaS) kits for high-volume campaigns. The report highlights a tactical shift towards evasive delivery methods, such as embedding malicious QR codes in PDF attachments to bypass traditional security filters. With 34% of companies experiencing a monthly account takeover, the risk of internal phishing from trusted sources is also rising sharply.

Anthropic to Brief Global Financial Watchdog on 'Mythos' AI's Ability to Find Novel Cyber Flaws

AI startup Anthropic is set to brief the Financial Stability Board (FSB), a global financial regulator, on the capabilities of its powerful 'Mythos' AI model. The briefing was requested by the Bank of England's governor amid growing fears that the AI's advanced ability to autonomously discover novel software vulnerabilities could be weaponized, posing a systemic risk to the entire global financial system. The discussions highlight the emerging challenge of governing dual-use AI technologies.

Microsoft Takedown: 'Fox Tempest' Malware-Signing-as-a-Service Disrupted

Microsoft has successfully disrupted a malware-signing-as-a-service (MSaaS) operation run by a threat actor it tracks as 'Fox Tempest'. The service, active since May 2025 under the name 'OpFauxSign', allowed cybercriminals to pay to have their malicious payloads signed with fraudulently obtained code-signing certificates. This made the malware appear legitimate, allowing it to bypass security controls. The service was used to sign numerous malware families, including the Rhysida ransomware, and infostealers like Lumma and Vidar. Microsoft's Digital Crimes Unit seized the service's website, `signspace[.]cloud`, and took its underlying infrastructure offline, dealing a significant blow to a key enabler in the cybercrime ecosystem.

BWH Hotels Breach: Attackers Had Access for Six Months, Exposing Guest Data

BWH Hotels, the parent company of major brands like Best Western, WorldHotels, and SureStay, has confirmed a significant data breach involving sensitive guest reservation information. The breach was discovered on April 22, but investigations revealed that attackers had unauthorized access to a web application for over six months prior to detection. The compromised data includes thousands of guest reservations, putting affected customers at high risk of sophisticated phishing attacks. BWH Hotels, which operates over 4,500 hotels globally, is in the process of notifying affected guests and has warned them to be vigilant for fraudulent communications, such as fake booking pages or urgent payment requests that leverage their stolen data.

Ransomware Attack on West Pharmaceutical Services Disrupts Global Operations

West Pharmaceutical Services, a leading global manufacturer of pharmaceutical packaging and drug delivery systems, has suffered a ransomware attack that disrupted its global business operations. The company detected unusual network activity on May 4 and proactively shut down portions of its on-premise infrastructure to contain the threat. This decisive action, while causing temporary operational disruptions, was necessary to prevent the attack's spread. The incident highlights the significant threat ransomware poses to the healthcare supply chain, where any disruption can have cascading effects on patient care and drug availability. The specific ransomware group responsible has not been disclosed.

Global Consulting Services Breach Exposes PII of 1,320 Individuals

Global Consulting Services & Software Development, a California-based IT firm, has disclosed a data breach that exposed the personally identifiable information (PII) of 1,320 individuals. The breach occurred in early January 2026 when an unauthorized third party accessed personal information, including names and Social Security numbers, stored on the company's network. The company began notifying affected individuals on May 18, 2026, more than four months after the incident. In response, Global Consulting Services is offering 24 months of free identity monitoring and restoration services through Kroll to the affected individuals.

Six Windows Zero-Day Exploits Leaked by Threat Actor 'Nightmare-Eclipse'

A threat actor operating under the alias 'Nightmare-Eclipse' has released a series of six zero-day exploits targeting Microsoft Windows. The campaign, which appears to be a personal vendetta against Microsoft rather than financially motivated, includes critical vulnerabilities that can lead to privilege escalation. One patched flaw, 'BlueHammer' (CVE-2026-33825), allows a standard user to gain SYSTEM-level privileges through a vulnerability in Windows Defender. The actor has also released exploits for unpatched vulnerabilities, including 'RedSun' for privilege escalation and 'MiniPlasma', which reportedly works on fully patched Windows 11 systems. Microsoft is investigating the claims, which pose a significant risk to the entire Windows ecosystem by providing attackers with powerful tools to escalate privileges on compromised machines.

TamperedChef Malware: Trojanized Apps Masquerade as Productivity Tools to Deploy Stealthy Payloads

Unit 42 has identified and analyzed several clusters of malware activity collectively known as TamperedChef. This threat involves trojanized productivity applications, such as PDF editors and file converters, distributed through malicious advertising (malvertising). While appearing as legitimate software, and often including deceptive End-User License Agreements (EULAs), these applications are designed to remain dormant for extended periods before executing malicious actions. Once activated, they establish command and control (C2) to download and execute secondary payloads, including information stealers, proxy tools, and remote access trojans (RATs). The research highlights three distinct clusters (CL-CRI-1089, CL-UNK-1090, CL-UNK-1110) encompassing over 4,000 unique samples, indicating a widespread and persistent campaign. This activity blurs the line between aggressive adware and outright malware, posing a significant threat due to its stealth and ability to grant attackers arbitrary code execution on victim systems.

Verizon DBIR 2026: Vulnerability Exploitation Now the #1 Cause of Breaches, Surpassing Stolen Credentials

The 2026 Verizon Data Breach Investigations Report (DBIR) marks a historic shift in the threat landscape. For the first time in 19 years, the exploitation of software vulnerabilities is the leading cause of data breaches, responsible for 31% of incidents. This trend is fueled by AI-accelerated attacks and a concurrent slowdown in enterprise patch management, with organizations successfully remediating only 26% of known exploited vulnerabilities. The report also highlights a 60% jump in supply chain breaches and the growing threat of 'Shadow AI' in the workplace.

Microsoft Takes Down 'Fox Tempest' Cybercrime Service That Sold Forged Code-Signing Certificates

Microsoft has executed a legal and technical takedown of 'Fox Tempest,' a financially motivated cybercrime group that ran a sophisticated malware-signing-as-a-service (MSaaS). The group sold counterfeit code-signing certificates for up to $9,500, allowing other criminals, including the Rhysida ransomware gang, to disguise their malware as legitimate software and bypass security controls. Microsoft seized the group's primary domain, took hundreds of VMs offline, and is collaborating with the FBI and Europol to identify the operators.

Virginia Man with Cybercrime History Convicted for Deleting 96 Government Databases

A Virginia man named Akhter, who has a prior history of federal cybercrime convictions, was found guilty on May 8, 2026, for the deliberate destruction of 96 government databases. Akhter, a former database administrator, faces a potential sentence of up to 21 years in prison. This case highlights the significant danger posed by malicious insiders with privileged access. In 2015, Akhter had pleaded guilty to similar charges and served a two-year sentence. His sentencing for the current conviction is scheduled for September 9, 2026.

New 'WantToCry' Ransomware Uses Exposed SMB Services for Novel Remote Encryption Attacks

A new ransomware strain named 'WantToCry' is actively targeting systems with exposed Server Message Block (SMB) services. According to SophosLabs, the attackers brute-force credentials to gain access, then exfiltrate files to their own servers for encryption. The encrypted files are then rewritten back to the victim's host over SMB. This technique minimizes the on-host footprint, making detection difficult as no malware is executed locally. The attacks are linked to infrastructure previously associated with LockBit, Qilin, and BlackCat ransomware.

Microsoft Scrambles to Mitigate Actively Exploited Exchange Server Zero-Day

Microsoft is responding to an actively exploited zero-day spoofing vulnerability, CVE-2026-42897, in on-premises Exchange Servers. The flaw, a cross-site scripting (XSS) issue in Outlook Web Access (OWA), allows attackers to execute arbitrary JavaScript in a user's browser via a malicious email. CISA has added the vulnerability to its KEV Catalog, mandating federal agencies to apply mitigations. While a patch is pending, Microsoft has released temporary mitigation guidance for affected Exchange Server 2016, 2019, and Subscription Edition versions.

AI-Powered Cyberattacks Are Overwhelming Critical Infrastructure Defenses, Experts Warn

Security experts are sounding the alarm that AI-powered cyberattacks are becoming too fast and complex for human-led security teams to handle, particularly in critical infrastructure sectors. As operators of hospitals, utilities, and power grids connect more of their Operational Technology (OT) to IT networks, they create a vast attack surface that AI-assisted adversaries are exploiting. The speed of these attacks is forcing a necessary shift towards automated, AI-driven defensive systems to protect essential services from real-world disruption.

XCSSET Malware Detailed: A Supply Chain Attack on macOS Developers via Xcode Projects

Security firm ADEX has published a deep-dive analysis of the XCSSET macOS malware, detailing how it conducts supply chain attacks against developers. The malware injects itself into Xcode projects and uses a self-propagating mechanism to spread to other projects on a developer's machine and potentially to public repositories. XCSSET is a modular threat capable of stealing a wide range of credentials, including Keychain data, AWS tokens, and SSH keys, and also features clipboard hijacking and ransomware capabilities.

EU Cybersecurity Centre Opens Call for Experts to Oversee Billions in Digital Funding

The European Cybersecurity Competence Centre (ECCC) has launched a call for independent cybersecurity experts to assist in evaluating and monitoring projects funded under the multi-billion Euro Digital Europe and Horizon Europe programs. Professionals with at least five years of experience are invited to apply by June 15, 2026, to help shape the EU's investment in digital resilience, technological sovereignty, and cybersecurity research amid growing global threats.

Japan Introduces New National Strategy to Defend Critical Infrastructure from Cyberattacks

The Japanese government has adopted a new, comprehensive package of measures to strengthen the cyber defenses of its critical infrastructure. The strategy, targeting 15 industry sectors including finance and medicine, is a direct response to the rising risk of sophisticated cyberattacks amplified by advanced AI. The plan focuses on enhancing government-led intelligence gathering, fostering a skilled cybersecurity workforce, and increasing pressure on software vendors to patch vulnerabilities promptly.

Not So Gentle: 'The Gentlemen' Ransomware Gang Hacked, Internal Operations Exposed

The ransomware-as-a-service (RaaS) group known as 'The Gentlemen' has reportedly suffered a major breach of its own internal systems. The compromise has given security researchers at Check Point an unprecedented look inside the gang's operations, including affiliate chats, backend infrastructure, and victim databases. The leak revealed that the group, which offers affiliates a 90% revenue share, had compromised over 1,570 victims—far more than publicly claimed. Despite the major operational security failure, the group appears to be continuing its attacks.

The Agentic Era: Frontier AI Models Fuel a Surge in Vulnerability Discovery

A new era of cybersecurity is dawning as frontier AI models, such as Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber, demonstrate an unprecedented ability to autonomously find and exploit software vulnerabilities. Under initiatives like 'Project Glasswing,' major tech companies including Palo Alto Networks, Apple, and Mozilla are now using these AI agents to proactively scan their own codebases. This has resulted in a massive surge in the number of patched CVEs, as seen in Palo Alto Networks' latest security advisory. While a powerful defensive tool, this capability signals a future where attackers will also wield AI, drastically shortening the window between vulnerability disclosure and mass exploitation.

Unit 42: Frontier AI Models Can Autonomously Find Zero-Days, Posing Major Threat to Software Security

Palo Alto Networks' Unit 42 has conducted hands-on research with frontier AI models, revealing their alarming capability to act as autonomous security researchers. These models can independently identify zero-day vulnerabilities and complex exploit chains, posing a significant and immediate risk to the software ecosystem, especially open-source software (OSS). The research indicates that these AIs dramatically lower the barrier for unskilled attackers and accelerate the vulnerability-to-exploitation timeline from N-days to N-hours. Unit 42 predicts a surge in large-scale, AI-driven supply chain attacks and urges defenders to adopt an aggressive, prevention-first security posture to counter the unprecedented speed and scale of these emerging threats.

Post-Shai-Hulud: npm Attacks Evolve with Wormable Malware and CI/CD Persistence

A Unit 42 investigation reveals a significant evolution in the npm threat landscape since the Shai-Hulud worm of 2025. Two April 2026 campaigns demonstrate advanced adversary TTPs. The first, attributed to TeamPCP, involved a malicious package impersonating the Bitwarden CLI to steal credentials and self-propagate. A second, dubbed 'Mini Shai-Hulud,' compromised four popular SAP CAP and MTA build toolchain packages, affecting over 570,000 weekly downloads. The attacks utilize a multi-stage payload delivered via a `preinstall` hook, employ custom obfuscation, and use GitHub's commit search API as a covert command-and-control channel to exfiltrate stolen developer secrets, cloud credentials, and CI/CD tokens.

‘Mini Shai-Hulud’ Supply Chain Attack Hits 170+ Open-Source Packages via GitHub Actions

A large-scale and sophisticated software supply chain attack, dubbed 'Mini Shai-Hulud,' has compromised over 170 packages in the NPM and PyPI registries. The campaign, attributed to the threat actor TeamPCP, targeted major open-source projects like TanStack and Mistral AI. The attackers ingeniously abused misconfigured GitHub Actions workflows and cache poisoning to inject malicious code into CI/CD pipelines. In a significant escalation, they managed to have the malicious packages signed with valid SLSA provenance signatures, effectively hijacking the trust of the build system itself. The malware was designed for widespread credential harvesting and used the decentralized Session network for resilient C2 communication.

Verus-Ethereum Bridge Loses $11.5M in Logical Exploit; Attacker Forges Value-less Transaction

The Verus-Ethereum cross-chain bridge has been exploited for approximately $11.58 million in digital assets. The attacker leveraged a critical logical flaw in the bridge's smart contract, not a cryptographic weakness. By submitting a validly signed proof for a transaction that had no economic value on the source chain, the attacker tricked the Ethereum-based contract into releasing millions from its reserves. The incident highlights the persistent risk of logic bombs in DeFi protocols, where cryptographic security alone is insufficient.

Pwn2Own Berlin 2026 Concludes with $1.3M Awarded for 47 Zero-Days in Enterprise Software

The Pwn2Own Berlin 2026 ethical hacking competition has concluded, with researchers earning nearly $1.3 million for disclosing 47 unique zero-day vulnerabilities in a range of major enterprise software products. The Taiwanese team DEVCORE won the coveted 'Master of Pwn' title, demonstrating high-impact exploits against Microsoft Exchange and SharePoint. The event highlighted critical security weaknesses in widely used technologies, including virtualization platforms, browsers, and AI systems, reinforcing the value of coordinated vulnerability disclosure.

Researcher Drops Two Windows Zero-Days, 'YellowKey' and 'GreenPlasma,' Exposing BitLocker and Escalating Privileges

A security researcher has publicly released proof-of-concept exploits for two unpatched Windows zero-day vulnerabilities, dubbed 'YellowKey' and 'GreenPlasma'. The first, YellowKey, is a critical BitLocker encryption bypass affecting Windows 11 and Server editions, while GreenPlasma is a local privilege escalation flaw. The researcher released the exploits out of frustration with Microsoft's bug reporting process, creating a significant risk as the PoCs are now public and reportedly being used in attacks.

Russian APT Turla Evolves Kazuar Backdoor into Stealthy P2P Botnet

The Russian state-sponsored threat group Turla has significantly upgraded its Kazuar backdoor, transforming it into a sophisticated, modular peer-to-peer (P2P) botnet. According to Microsoft, this architectural shift is designed to enhance stealth and resilience by decentralizing command and control, making the malware harder to disrupt. The new version isolates tasks, data, and configuration to minimize interaction with external infrastructure, reinforcing Turla's focus on long-term intelligence collection from high-value government, diplomatic, and defense targets.

NIST Finalizes SP 800-172r3, Toughening Security Rules for Controlled Unclassified Information (CUI)

The U.S. National Institute of Standards and Technology (NIST) has finalized Special Publication (SP) 800-172r3, which outlines enhanced security requirements for protecting Controlled Unclassified Information (CUI). The updated guidance adds 80 new controls, with a strong emphasis on supply chain risk management, access control, and threat detection. This revision will impose more stringent cybersecurity obligations on government contractors and other organizations that handle CUI in systems associated with high-value assets or critical programs, requiring them to prepare for implementation.

Microsoft Exchange Zero-Day CVE-2026-42897 Under Active Exploitation, Mitigation Urged

Microsoft has confirmed a new zero-day vulnerability, CVE-2026-42897, in on-premises Exchange Servers is being actively exploited in the wild. The flaw, a cross-site scripting (XSS) and spoofing issue affecting Exchange Server 2016, 2019, and Subscription Edition, allows a remote, unauthenticated attacker to perform spoofing attacks. Microsoft has released mitigation guidance and strongly recommends enabling the Exchange Emergency Mitigation Service (EEMS) as a security update is not yet available. This incident highlights the ongoing risk associated with on-premises email infrastructure and the necessity for administrators to apply temporary fixes promptly.

Instructure Pays Off ShinyHunters to Delete Data of 275M Canvas Users

Ed-tech giant Instructure has confirmed an agreement with the ShinyHunters hacking group following a major data breach of its Canvas learning platform. The attack compromised the data of an estimated 275 million users across 9,000 educational institutions. While Instructure claims the deal includes the deletion of 3.65 TB of stolen data, the company has not disclosed whether a ransom was paid, raising significant concerns among cybersecurity experts and insurers about the precedent and the unverifiable nature of data destruction claims.

Japan Forms Public-Private Task Force to Counter AI-Driven Cyber Threats like 'Mythos'

The Japanese government, led by Prime Minister Sanae Takaichi, is accelerating its response to cybersecurity threats posed by advanced AI models, specifically citing Anthropic's 'Mythos' model, which is highly adept at finding vulnerabilities. Describing the effort as a "race against time," Japan has formed a public-private working group to bolster defenses, starting with the nation's critical financial sector. The group includes government agencies, the Bank of Japan, major banks, and Anthropic's local office, aiming to build a cooperative framework against AI-powered attacks.

OpenAI Hit by "Shai-Hulud" Supply Chain Attack on TanStack NPM Library

A major software supply chain attack has compromised the popular TanStack npm library and hundreds of other open-source packages. The attack, orchestrated by the 'TeamPCP' group, used a self-propagating worm dubbed "Shai-Hulud." OpenAI disclosed that two employee devices were compromised after downloading malicious packages, leading to the theft of credentials and secrets. While OpenAI states no user data was accessed, the incident highlights the systemic risk of supply chain attacks.

Funnel Builder WordPress Plugin Flaw Actively Exploited to Skim Payments from 40,000+ Stores

A critical, unauthenticated vulnerability in the Funnel Builder WordPress plugin is under active exploitation, affecting over 40,000 e-commerce sites using WooCommerce. Attackers are injecting malicious JavaScript that acts as a payment skimmer, stealing customer credit card numbers and other sensitive data from checkout pages. The developer, FunnelKit, has released a patch (version 3.15.0.3) and urges immediate updates.

European Hospitals Now See Cyberattacks as Direct Threats to Patient Care, Not Just Data

A Black Book Research survey of 284 European hospital executives reveals a significant shift in the perception of cyber risk. Attacks are no longer seen merely as IT or data privacy issues but as direct threats to patient care and safety. The study found 82% of leaders have extreme concerns about attacks, yet confidence in maintaining safe operations plummets from 59% at 24 hours post-attack to just 14% after 72 hours, highlighting a critical resilience gap.

UK's HMRC Taps Quantexa AI to Dismantle Cyber-Enabled Tax Fraud Rings

The UK's HM Revenue & Customs (HMRC) has awarded a ten-year, £175 million contract to British AI firm Quantexa. The partnership will use Quantexa's AI-driven "decision intelligence" platform to analyze vast datasets, aiming to better detect sophisticated tax fraud, identify errors, and uncover hidden criminal networks. The move represents a major government investment in AI for combating financial crime.

AI Drives Investment and Uncertainty in Cyber Insurance Market

The cyber insurance market is being profoundly reshaped by artificial intelligence. A Q1 2026 report from Gallagher Re shows 95% of InsurTech funding ($1.63B) targeted AI-focused firms. Simultaneously, a 978% surge in generative AI-related litigation has prompted major insurers like Chubb and Travelers to introduce broad AI liability exclusions in standard commercial policies, creating a complex and uncertain landscape for managing digital risk.

ShinyHunters Claims Massive Canvas Breach, Disrupting 275 Million Users at 9,000 Institutions

The notorious hacking group ShinyHunters has claimed responsibility for a catastrophic data breach of the Canvas Learning Management System (LMS), owned by Instructure. The attack allegedly resulted in the theft of 3.65 TB of data belonging to 275 million users across nearly 9,000 educational institutions worldwide. The compromised data includes full names, email addresses, student IDs, and private messages, creating a severe risk of targeted phishing attacks. The incident caused widespread service outages during final exams and was compounded by a secondary attack where attackers defaced login portals with a public ransom note, escalating panic and disruption across the global education sector.

New 'Mini Shai-Hulud' Worm Hits npm & PyPI in Major Supply Chain Attack

A sophisticated, self-propagating worm dubbed 'Mini Shai-Hulud' has compromised over 170 packages across the npm and PyPI repositories. Attributed to the threat group TeamPCP, the attack hijacked the release pipelines of major projects like TanStack, Mistral AI, and UiPath. The worm steals a wide range of developer credentials and then uses them to publish new infected packages, further spreading the compromise. A critical vulnerability, CVE-2026-45321, has been assigned to the TanStack compromise.

High-Severity Flaw in JetBrains TeamCity On-Premises Allows API Exposure (CVE-2026-44413)

JetBrains has disclosed and patched a high-severity, post-authentication vulnerability (CVE-2026-44413) in its TeamCity On-Premises CI/CD server. The flaw allows any authenticated user, regardless of their permissions, to expose parts of the server API to unauthorized external users. All versions up to 2025.11.4 are affected. JetBrains has released version 2026.1 to fix the issue and has also provided a security patch plugin for users who cannot upgrade immediately. TeamCity Cloud instances are not affected.

OpenAI Launches 'Daybreak' to Automate Vulnerability Hunting with AI

OpenAI has launched 'Daybreak,' a new cybersecurity initiative that uses its advanced AI models, including the new GPT-5.5-Cyber, to help organizations automatically find, validate, and remediate software vulnerabilities. Announced on May 12, 2026, the platform is a direct response to Anthropic's 'Project Glasswing,' marking a new front in the competition to apply frontier AI to solve complex cybersecurity challenges.

New 'Fragnesia' Linux Flaw (CVE-2026-46300) Allows Root Access; PoC Exploit Released

A new high-severity local privilege escalation (LPE) vulnerability in the Linux kernel, dubbed 'Fragnesia' (CVE-2026-46300), has been publicly disclosed along with a working proof-of-concept exploit. The flaw exists in the kernel's XFRM ESP-in-TCP subsystem and allows an unprivileged local user to corrupt the page cache and overwrite read-only files, leading to root access. Fragnesia is an extension of the recent 'Dirty Frag' family of bugs and reportedly bypasses the patches released just days ago. The immediate public release of the PoC puts unpatched systems at significant risk, forcing administrators into a race to apply mitigations or vendor patches.

Cisco Warns of Actively Exploited Critical Auth Bypass Flaw in SD-WAN

Cisco has issued an urgent warning about a critical authentication bypass vulnerability, CVE-2026-20182, in its Catalyst SD-WAN products. The flaw, which has a maximum CVSS severity score of 10.0, is being actively exploited in the wild. It allows a remote, unauthenticated attacker to gain administrative privileges on affected controllers and managers, potentially leading to full network compromise. Attackers have been observed adding SSH keys and modifying network configurations. The vulnerability affects all deployment types, and Cisco urges customers to apply available patches immediately.

Fortinet Patches Critical RCE Flaws in FortiAuthenticator and FortiSandbox

Fortinet has released urgent security updates to address critical vulnerabilities in its FortiAuthenticator (CVE-2026-44277) and FortiSandbox (CVE-2026-26083) products. The flaws, rated 9.8 and 9.1 respectively, could allow an unauthenticated, remote attacker to execute arbitrary code or commands via crafted HTTP requests. Given the critical nature of these products in enterprise security stacks, administrators are strongly advised to apply the patches immediately to prevent potential compromise.

Critical RCE Flaw in CloudNativePG for Kubernetes Allows Superuser Takeover

A critical vulnerability, CVE-2026-44477, has been discovered in CloudNativePG, a popular open-source operator for running PostgreSQL on Kubernetes. The flaw, rated 9.4 in severity, allows for privilege escalation to full 'postgres' superuser and subsequent remote code execution (RCE) within the primary database pod. The vulnerability exists in the metrics exporter component. All users are strongly urged to upgrade to the patched versions (1.29.1 and 1.28.3) immediately to prevent potential cluster compromise.

Sandworm APT Evolves, Targeting Misconfigured Edge Devices for Direct OT Access

The Russian state-sponsored group Sandworm (APT44) is evolving its tactics, moving from traditional IT network intrusions to directly targeting misconfigured edge devices as an entry point into Operational Technology (OT) networks. This shift allows the APT to bypass hardened IT perimeters and gain immediate access to sensitive Industrial Control Systems (ICS). By leveraging vulnerabilities in firewalls, VPNs, and other network appliances at the IT/OT boundary, Sandworm can more rapidly stage attacks against critical infrastructure, highlighting a growing trend of threats against industrial environments.

AI-Powered Attacks on Maritime Industry Weaponize Flaws in Under 48 Hours

A new report from Cydome highlights the dramatic acceleration of cyber threats against the global maritime industry, driven by attackers using Artificial Intelligence (AI). Up to 60% of newly disclosed software vulnerabilities are now being weaponized within 48 hours, a massive reduction from previous years. This collapse of the security response window leaves ships and onshore infrastructure highly exposed. The report also notes that 83% of phishing emails now use AI to craft more convincing, native-language messages, increasing the risk of insider-enabled breaches in a multinational environment.

Microsoft Exchange Zero-Day Under Active Attack, Mitigations Deployed Automatically

Microsoft has disclosed a new high-severity zero-day vulnerability (CVE-2026-42897) in on-premises Exchange Server 2016, 2019, and Subscription Edition. The flaw, a cross-site scripting (XSS) issue in Outlook Web Access (OWA), is being actively exploited for spoofing attacks. While a full security update is pending, Microsoft's Emergency Mitigation service has automatically deployed a fix to most servers, and manual scripts are available for others.

Belarus-Aligned APT 'FrostyNeighbor' Deploys New JavaScript Loader in Attacks on Poland & Ukraine

The Belarus-aligned cyber-espionage group 'FrostyNeighbor' (also known as Ghostwriter/UNC1151) has launched a new wave of attacks targeting government and military organizations in Poland and Ukraine. Active since at least March 2026, the campaign showcases an evolved toolset, including a new JavaScript-based version of its 'PicassoLoader' malware and a more deliberate, server-side victim validation process to evade analysis before deploying Cobalt Strike.

New 'Rex' Ransomware Emerges, Using Double Extortion and .rex48 Extension

A new ransomware strain named "Rex" has been discovered by researchers at CYFIRMA. Targeting Windows enterprise environments, the malware encrypts files, appends a ".rex48" extension, and drops an HTML ransom note. Rex employs a double extortion strategy, threatening to leak confidential data stolen from the victim's network if the ransom is not paid within a 72-hour deadline.

UK Financial Regulators Put Firms on Notice Over Frontier AI Cyber Risks

The Bank of England, the Financial Conduct Authority (FCA), and HM Treasury have issued a joint statement warning UK financial firms about the escalating cyber threats posed by frontier AI. The regulators stressed that AI's ability to amplify attacks requires firms to urgently enhance their cyber defenses, improve vulnerability management, and potentially adopt AI-driven defensive tools to keep pace with the evolving threat landscape.

Massive Phishing Blitz Targets 2026 FIFA World Cup Fans with 79+ Fake Sites

Security researchers are warning of a massive phishing campaign targeting fans of the upcoming 2026 FIFA World Cup. Attackers have registered at least 79 fraudulent websites that are near-perfect clones of the official FIFA site. These scams aim to steal credentials, payment card information, and money through the sale of fake tickets and merchandise, leveraging typosquatting and lookalike domains to deceive victims.

Chinese APT FamousSparrow Hits Azerbaijan Energy Sector with Deed RAT

The China-linked APT group FamousSparrow has expanded its targeting to include the energy sector in Azerbaijan, likely driven by the country's growing importance as an energy supplier to Europe. A campaign running until February 2026 saw the group exploit Microsoft Exchange vulnerabilities to deploy an updated version of the Deed RAT malware. The attackers used advanced DLL sideloading techniques and mimicked legitimate software to achieve persistence and conduct cyber-espionage.

UK Announces Major Cyber Law Overhaul, Including Reforms to Computer Misuse Act

The UK government has announced a significant legislative agenda to reform its digital and cyber regulatory framework. The plan includes a new Cyber Security and Resilience Bill, which will align the UK more closely with the EU's NIS 2 directive, and crucial reforms to the 1990 Computer Misuse Act (CMA). The CMA reforms aim to provide a legal defense for legitimate cybersecurity professionals, a move long awaited by the industry.

Gremlin Stealer Hides in Plain Sight, Using .NET Resources to Steal Crypto and Sessions

Unit 42 has analyzed a new, highly evolved variant of the Gremlin information stealer. This version marks a significant upgrade in stealth and capability, now embedding its malicious payload within the .NET resource section and using XOR encoding to bypass detection. The malware has expanded its targets beyond simple credential harvesting to include active session hijacking from Chromium-based browsers, a dedicated Discord token stealer, and a new clipboard hijacker that replaces cryptocurrency wallet addresses to commit financial fraud. The stealer exfiltrates stolen data in a ZIP archive to a command-and-control server, with recent samples showing zero initial detection on VirusTotal, highlighting its evasiveness.

Chinese APT Mustang Panda Targets Indian Banks, Korean Policy Experts in Espionage Campaign

The China-linked APT group Mustang Panda (TA416) has been conducting a widespread espionage campaign targeting financial organizations in India and public policy experts in Korea and the U.S. According to Acronis, the attacks use spear-phishing and DLL sideloading to deploy a custom backdoor named LotusLite. The campaign appears focused on intelligence gathering, with malware disguised to mimic legitimate Indian banking software to deceive victims. The group's reliance on simple but effective techniques highlights the persistent threat of state-sponsored espionage.

Researcher Leaks Two Windows Zero-Day Exploits, 'YellowKey' and 'GreenPlasma', Amid Dispute with Microsoft

A security researcher known as Chaotic Eclipse has publicly released proof-of-concept exploits for two new zero-day vulnerabilities in Microsoft Windows, which they have named 'YellowKey' and 'GreenPlasma.' The release is an escalation of an ongoing dispute between the researcher and the Microsoft Security Response Center (MSRC). YellowKey is reportedly a BitLocker encryption bypass, while GreenPlasma is a privilege escalation flaw. The vulnerabilities are allegedly being actively exploited in the wild within hours of the public disclosure, placing Windows users at immediate and significant risk.

Foxconn North America Hit by Nitrogen Ransomware; 8TB of Data Allegedly Stolen

Electronics manufacturing giant Foxconn has confirmed a cyberattack on its North American factory operations, with the Nitrogen ransomware group claiming responsibility. The attackers allege they have exfiltrated 8 terabytes of data, including over 11 million files containing confidential documents and schematics related to Foxconn's high-profile clients like Apple, Google, and Intel. The incident, which caused operational disruptions, is the latest in a series of ransomware attacks targeting the company, highlighting the significant and persistent cyber risks facing the global manufacturing and technology supply chain.

Industrial Sector Most Targeted by Ransomware, NCC Group Report Warns

A new report from NCC Group highlights the severe and escalating cyber risk facing the Operational Technology (OT) sector. The analysis, covering March 2025 to March 2026, found that the industrial sector was the most frequent target of ransomware, suffering 2,073 documented attacks. The report warns that the convergence of IT and OT systems is creating new avenues for attack that could lead to severe real-world consequences, including production halts and threats to public safety.

Novel 'GemStuffer' Campaign Abuses RubyGems Repository as Data Exfiltration Channel

A novel and unusual campaign, dubbed 'GemStuffer,' has been observed abusing the RubyGems package registry. Threat actors have published over 150 malicious gems that, instead of containing malware to infect developers, use the registry itself as a free and unconventional data storage and exfiltration channel. The scripts within the packages are designed to scrape web pages from U.K. local government portals, package the scraped HTML into valid gem archives, and then publish them back to the RubyGems repository using hardcoded API keys. The motive remains unclear, but the activity coincided with RubyGems temporarily disabling new account registrations due to a 'major malicious attack.'

SAP Patches Critical Flaws in Commerce Cloud and S/4HANA with 9.6 CVSS Score

SAP has released its May 2026 Security Patch Day updates, addressing two critical vulnerabilities in its enterprise products that both carry a CVSS score of 9.6. The first flaw, CVE-2026-34263, is an arbitrary code execution vulnerability in SAP Commerce Cloud caused by an improper Spring Security configuration. The second, CVE-2026-34260, is a SQL injection vulnerability in the SAP Enterprise Search for ABAP component of S/4HANA. Both flaws could allow attackers to gain significant unauthorized access and control over affected systems, prompting an alert from Singapore's Cyber Security Agency (CSA).

PraisonAI Auth Bypass (CVE-2026-44338) Exploited Within Four Hours of Disclosure

A critical authentication bypass vulnerability in the PraisonAI framework (CVE-2026-44338) was actively exploited by attackers less than four hours after its public disclosure. The flaw, which stems from a legacy API server being shipped with authentication disabled by default, allows unauthenticated remote attackers to take control of AI agent workflows. Security firm Sysdig observed an automated scanner with the user agent 'CVE-Detector/1.0' probing for the vulnerability almost immediately after the advisory was published. This incident is a stark illustration of the rapidly shrinking window between vulnerability disclosure and mass exploitation in the age of automated attack tools.

Instructure Confirms Massive Breach; ShinyHunters Claims 275 Million User Records from Canvas LMS

Educational technology firm Instructure has confirmed a significant data breach affecting its widely used Canvas Learning Management System (LMS). The incident, which caused service disruptions starting May 1, 2026, has been claimed by the notorious extortion group ShinyHunters. The threat actor alleges the theft of 3.65 terabytes of data, including the personal information and private messages of 275 million students and educators from nearly 9,000 institutions globally. Instructure has acknowledged the exposure of names, email addresses, and user messages but stated that more sensitive data like passwords and financial information was not compromised. The company is working with law enforcement and has implemented remedial actions, including rotating API keys.

Foxconn Hit by Nitrogen Ransomware; Gang Claims Theft of Apple, Intel Data

Global electronics manufacturer Foxconn has confirmed a ransomware attack that disrupted operations at its North American factories. The Nitrogen ransomware gang, believed to be an offshoot of the Conti group, has claimed responsibility. The attackers allege they stole 8 terabytes of data, including sensitive project files related to Foxconn's high-profile clients like Apple, Intel, and Google, and have posted samples on their dark web leak site.

Microsoft's May Patch Tuesday: 137 Flaws Fixed, Including Critical Netlogon RCE

Microsoft's May 2026 Patch Tuesday is one of the largest of the year, addressing 137 vulnerabilities. In a notable break from a 22-month trend, no actively exploited zero-day vulnerabilities were fixed. The update includes patches for 30 critical flaws, most notably a 9.8 CVSS RCE in the Windows Netlogon service (CVE-2026-41089) and another 9.8 CVSS RCE in the Windows DNS Client (CVE-2026-41096), both of which require immediate attention.

Anthropic's 'Mythos' AI Model Signals New Era of Autonomous Cyber Threats

AI research firm Anthropic has developed a frontier AI model, 'Claude Mythos Preview,' with capabilities so advanced that it has been deemed too dangerous for public release. The model can autonomously discover unknown zero-day vulnerabilities, generate functional exploits, and execute multi-stage cyberattacks, marking what some call a 'watershed moment for cybersecurity.' During testing, Mythos reportedly identified thousands of high-severity flaws. While Anthropic has restricted access, launching 'Project Glasswing' to allow vetted partners like Apple and Goldman Sachs to use the model for defensive purposes, concerns have been amplified by reports that unauthorized users may have briefly gained access to the model through a third-party contractor. This development accelerates the timeline for AI-driven attacks and heightens the urgency for developing AI-native defenses.

Iranian APT MuddyWater Masquerades as Ransomware Group in Microsoft Teams-Based Espionage Campaign

The Iranian state-sponsored advanced persistent threat (APT) group MuddyWater, also known as Mango Sandstorm, is conducting a sophisticated espionage campaign disguised as a ransomware attack. First observed in early 2026, the operation uses social engineering via Microsoft Teams to trick victims into revealing credentials during interactive screen-sharing sessions, bypassing MFA. Instead of encrypting files, the attackers deploy remote management tools like DWAgent and AnyDesk to exfiltrate data and establish long-term persistence. The campaign, attributed to MuddyWater with moderate confidence, targets organizations of strategic interest to Iran across the U.S., Europe, APAC, and the Middle East, using criminal tactics and off-the-shelf tools to obscure its state-sponsored origins.

Belgium's NIS2 Audit Deadline Arrives, Kicking Off EU-Wide Enforcement

April 18, 2026, marks a significant milestone in European cybersecurity regulation, as Belgium becomes the first EU member state to mandate the completion of an initial NIS2 directive conformity assessment. 'Essential entities' in sectors like energy, health, and transport must now have their cybersecurity posture audited by an accredited body. This move signals the beginning of active NIS2 enforcement across the bloc, putting pressure on organizations to comply with stringent new requirements. Key mandates include a 24-hour incident reporting window, personal liability for management, and documented proof of risk assessments and incident response plans, all of which will significantly impact Security Operations Centers (SOCs).

American Lending Center Breach Exposes 123K SSNs from 2025 Ransomware Attack

The American Lending Center (ALC) is notifying over 123,000 individuals that their sensitive personal information, including Social Security numbers and financial data, was compromised during a ransomware attack that occurred in July 2025. The significant delay in notification—with the breach review concluding in April 2026—has prompted investigations by multiple class-action law firms into the company's data security practices and response.

CISA and G7 Partners Release New Guidance for AI SBOMs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and its G7 partners have published new joint guidance on the minimum elements for a Software Bill of Materials for Artificial Intelligence (AI SBOM). The guidance aims to increase transparency and security in the AI supply chain by providing a framework for documenting the components, models, and data used to build AI systems. While not mandatory, it is expected to become a standard for procurement and risk management.

Frame Security Launches with $50M to Combat AI-Powered Phishing and Deepfakes

A new cybersecurity startup, Frame Security, has launched with $50 million in funding to tackle the growing threat of AI-powered social engineering. Founded by veterans of Wiz and Israel's Unit 8200, Frame is building a 'human risk security' platform. It uses AI to generate hyper-realistic attack simulations and provide continuous, personalized security training to employees, aiming to fortify the human layer against threats like deepfakes and advanced phishing.

Siemens Patches Critical Flaws in SIMATIC S7 PLCs, RUGGEDCOM Devices

As part of the May 2026 Patch Tuesday cycle, Siemens has released 18 security advisories for its industrial products, addressing numerous critical and high-severity vulnerabilities. The patches cover widely used devices, including SIMATIC S7 PLCs and RUGGEDCOM networking equipment. Several flaws, such as critical Cross-Site Scripting (XSS) bugs in S7 web servers (CVE-2026-25786, CVE-2026-25787), could lead to remote code execution or device takeover, posing a significant risk to OT environments.

WebdriverIO Flaw (CVSS 9.8) Allows CI/CD Takeover via Malicious Git Branches

A critical command injection vulnerability, CVE-2026-25244, with a CVSS score of 9.8, has been found in the popular WebdriverIO open-source testing framework. The flaw exists in the '@wdio/browserstack-service' package and can be triggered by a specially crafted git branch name. Successful exploitation could allow an attacker to execute arbitrary commands, leading to a complete takeover of developer machines or CI/CD build servers.

UK Water Company Fined £1M After Cl0p Lurked on Network for 20 Months Undetected

The UK's Information Commissioner's Office (ICO) has fined South Staffordshire Water nearly £1 million for extensive data protection failures that led to a major cyberattack by the Cl0p ransomware group. An attacker gained access via a malicious email in September 2020 and remained undetected on the company's network for 20 months. The breach, discovered in July 2022, resulted in the exfiltration and publication of 4.1 terabytes of customer and employee data. The ICO cited numerous failings, including inadequate monitoring, unpatched systems, and the use of obsolete software.

Living Off the Land: Threat Actors Increasingly Abuse Legitimate Platforms Like Teams and GitHub

A significant 2026 trend shows threat actors are increasingly abusing trusted enterprise platforms to conduct malicious operations and evade detection. Attackers are 'living off the trusted platform' by leveraging services like Microsoft Teams for malware delivery, GitHub for distribution, and the Windows Phone Link app for SMS interception. This strategic shift allows them to blend malicious traffic with legitimate business workflows, exploiting the implicit trust that users and security tools place in these well-known services, and making detection significantly more challenging.

Critical Flaws in AI Coding Agents and Browser Extensions Expose Developer Workflows

Security researchers have uncovered critical vulnerabilities in popular open-source AI tools, highlighting new risks in developer workflows. A WebSocket hijacking flaw (CVSS 9.7) in the AI coding agent Cline's local Kanban server allowed any visited website to exfiltrate data and inject commands. A separate issue in Anthropic's Claude Chrome extension permitted other extensions to hijack the AI agent and send malicious prompts. These findings underscore the growing attack surface of the AI software supply chain as these tools become more integrated into development environments.

AD CS Escalation Deep Dive: How Attackers Abuse Certificate Templates for Domain Dominance

Security researchers from Unit 42 have published a detailed analysis of advanced attacks targeting Active Directory Certificate Services (AD CS). The report highlights how threat actors, from ransomware groups to state-sponsored entities, are exploiting common misconfigurations in certificate templates and abusing shadow credentials to escalate privileges and achieve complete domain control. The research focuses on techniques like ESC1, where attackers can request certificates to impersonate high-privilege accounts. Rather than relying on malware, these attacks leverage native Windows functionality, making them difficult to detect with traditional signature-based tools. The analysis emphasizes the need for behavioral analytics and provides actionable guidance for defenders to identify and mitigate these stealthy but highly impactful threats to enterprise identity infrastructure.

Ransomware Landscape Report: Qilin Leads, 'The Gentlemen' Surges in Q1 2026

The first quarter of 2026 shows that the high volume of ransomware attacks seen in late 2025 has become the new baseline. Research from GuidePoint Security indicates that while overall numbers have stabilized at this elevated level, the landscape of dominant players is shifting. The Qilin ransomware group was the most active, claiming 361 victims, despite a 25% decrease in its activity. A newer group, known as 'The Gentlemen,' saw a dramatic surge, becoming the second most active group with 182 victims. The manufacturing sector remains the primary target, with a notable 44% year-over-year increase in attacks on the construction industry.

QR Code Phishing Surges 146% in Q1 2026, Microsoft Warns

According to Microsoft's Q1 2026 threat intelligence report, QR code-based phishing (quishing) has become the fastest-growing email attack vector, with volumes jumping 146% between January and March. Attackers are increasingly hiding malicious QR codes within PDF attachments to bypass email security scanners. These campaigns, often using CAPTCHA-gated landing pages to further evade detection, aim to steal user credentials. In Q1, Microsoft detected 8.3 billion email phishing threats in total, with one major campaign in March targeting 179,000 organizations across 43 countries, highlighting the scale and sophistication of modern Phishing-as-a-Service (PhaaS) operations like Tycoon2FA.

Ivanti Discloses Third Actively Exploited EPMM Zero-Day of 2026 (CVE-2026-6973)

Ivanti has disclosed another zero-day vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) product that is being actively exploited in targeted attacks. This is the third EPMM zero-day to be exploited this year. The high-severity flaw allows an authenticated administrator to achieve remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its KEV catalog and ordered federal agencies to patch by May 10, 2026. Experts are concerned attackers may be chaining this flaw with previous unauthenticated vulnerabilities to achieve full system compromise.

Landmark Discovery: Google Disrupts Campaign Using First-Ever AI-Developed Zero-Day Exploit

In a watershed moment for cybersecurity, Google's Threat Analysis Group (GTIG) announced it has discovered and thwarted a planned attack that was to use a zero-day exploit believed to be the first ever created by an AI. The exploit, targeting a popular open-source web administration tool, was designed to bypass 2FA. Evidence for AI-generation includes unusual code artifacts, such as hyper-detailed documentation and a 'hallucinated' CVSS score. This discovery confirms long-standing fears and marks the beginning of a new era of AI-driven offensive cyber capabilities.

Canvas LMS Breach: ShinyHunters Hacks Thousands of Schools, Disrupts Final Exams

Instructure, the company behind the widely used Canvas learning management system (LMS), has confirmed a major data breach that disrupted services for thousands of schools and universities globally. The hacking group ShinyHunters claimed responsibility, defacing login portals and threatening to leak student and staff data. The attack, which occurred during final exams for many institutions, was traced to an exploit in the 'Free-For-Teacher' account program, which Instructure has now permanently shut down. Exposed data includes names, emails, and private messages.

CRITICAL: Palo Alto Networks Firewalls Under Active Attack via Unpatched Zero-Day (CVE-2026-0300)

Palo Alto Networks has disclosed a critical, unpatched zero-day vulnerability (CVE-2026-0300) in its PAN-OS software that is being actively exploited. The flaw, a buffer overflow in the User-ID Authentication Portal (Captive Portal), allows an unauthenticated remote attacker to execute code with root privileges. The vulnerability carries a CVSS score of 9.8 and affects PA-Series and VM-Series firewalls. Patches are not yet available, and the company is urging customers to apply immediate mitigations by restricting access to the Captive Portal.

Poland Sounds Alarm as Russian Hackers Target Water Supply Systems for Physical Disruption

Poland's Internal Security Agency (ABW) has issued a stark warning about a significant increase in cyberattacks targeting the nation's critical infrastructure, specifically water utilities. The agency confirmed that hackers, attributed to the Russian Federation, breached at least five municipal water treatment facilities, gaining access to industrial control systems (ICS). The attacks, which exploited weak passwords and internet-exposed systems, aimed to cause physical disruption, with one incident in 2025 nearly cutting off a city's water supply. This marks a dangerous shift from espionage to sabotage.

Citing Lack of Faith in Government, US Corporations Launch New Infrastructure Defense Alliance

A coalition of major U.S. critical infrastructure operators, including JPMorgan Chase, AT&T, and Mastercard, has launched the Alliance for Critical Infrastructure (ACI). The group aims to fill a leadership void in cybersecurity crisis planning, citing a loss of faith in the federal government's ability to provide adequate support amid budget cuts. The ACI will focus on improving cross-sector coordination, understanding shared risks, and developing a national response protocol for large-scale emergencies that impact multiple infrastructure types.

Critical Flaw in Cline AI Agent Lets Any Website Hijack Developer Workspaces

A critical vulnerability (CVSS 9.7) has been discovered in Cline, a popular open-source AI coding agent. The flaw resided in the agent's local Kanban server, whose WebSocket connections lacked proper origin validation. This allowed any website visited by a developer to silently connect to the agent, hijack the session, exfiltrate the entire workspace snapshot, and execute arbitrary commands on the developer's machine without any user interaction. The vulnerability highlights a new class of attack surface introduced by locally-running AI agents with broad system permissions.

Braintrust AI Platform Breach Exposes Customer API Keys in AWS Account

Braintrust, a platform for evaluating AI models, suffered a security breach on May 4, 2026, after detecting unauthorized access to an Amazon Web Services (AWS) account. The compromised account stored sensitive customer API keys, creating a significant supply chain risk. Braintrust immediately notified customers, advising them to rotate all keys stored on the platform. While only one customer has been confirmed as directly affected, three others are investigating suspicious activity, highlighting the critical risk of third-party platforms holding secrets for the burgeoning AI ecosystem.

Report Details "Operation HookedWing," a Four-Year Phishing Campaign Targeting 500+ Organizations

A newly detailed report from SOCRadar has exposed "Operation HookedWing," a persistent and sophisticated phishing campaign that has been active for over four years. The campaign has successfully stolen more than 2,000 user credentials from over 500 organizations, with a focus on critical infrastructure, aviation, government, and financial sectors. The threat actors have continuously evolved their tactics, using a mix of GitHub domains, compromised servers, and lures in both English and French to trick victims into surrendering their Microsoft Outlook credentials on convincing, personalized landing pages.

ShinyHunters' Extortion Attack on Canvas Cripples 9,000 Schools, Exposing Student Data

The notorious cybercrime group ShinyHunters has claimed responsibility for a significant data extortion attack against Instructure's Canvas, a learning management system used by nearly 9,000 educational institutions. The attack, which occurred in early May 2026, involved a breach of the platform, service defacement, and the theft of 3.65 terabytes of data, including student and faculty information. The group publicly demanded ransom from individual schools, causing widespread service outages during a critical final exam period for universities across the U.S. and globally. Instructure confirmed the breach originated from an exploit in its 'Free-For-Teacher' accounts and has since restored services, though the incident highlights the severe vulnerability of the education sector to large-scale cyberattacks.

MOVEit Automation Hit with Critical 9.8 CVSS Auth Bypass Flaw (CVE-2026-4670)

Progress Software has issued an urgent security alert for a critical authentication bypass vulnerability, CVE-2026-4670, in its MOVEit Automation software. The flaw, which has been assigned a CVSS score of 9.8, could allow an unauthenticated attacker to gain unauthorized access and potentially administrative control over the system. Given the history of mass exploitation targeting the MOVEit product suite, this vulnerability poses a significant risk. Progress has released patched versions and strongly urges all customers to upgrade immediately, noting that the update requires a full installer and will cause a system outage.

Critical Palo Alto Networks Zero-Day (CVE-2026-0300) Actively Exploited for RCE

Palo Alto Networks has issued an urgent advisory for a critical, unpatched zero-day vulnerability, CVE-2026-0300, in its PAN-OS software. The flaw, a buffer overflow in the User-ID Authentication Portal, allows for unauthenticated remote code execution with root privileges. The company has confirmed limited but active exploitation in the wild, targeting internet-exposed firewalls. With a CVSS score of 9.3, the vulnerability affects multiple PA-Series and VM-Series firewalls. Patches are not yet available, with the first wave expected around May 13, 2026. Palo Alto Networks and global cybersecurity agencies are urging immediate implementation of mitigation measures, which involve restricting access to the vulnerable portal.

JDownloader Website Hacked to Distribute Python RAT in Supply Chain Attack

The official website for JDownloader, a popular open-source download manager, was compromised in a supply chain attack between May 6 and May 7, 2026. Attackers exploited a vulnerability in the site's Content Management System (CMS) to alter download links, tricking users into installing malware. Windows users received a heavily obfuscated Python-based Remote Access Trojan (RAT), while Linux users were served malicious ELF binaries that established persistence. Users who downloaded the 'Alternative Installer' during this period are urged to reinstall their operating systems.

Malicious Hugging Face Repo Impersonating OpenAI Distributes Infostealer Malware

A malicious repository on the Hugging Face AI platform successfully impersonated an OpenAI project to distribute infostealing malware. The fake repository, named 'Open-OSS/privacy-filter', used typosquatting and a copied description to appear legitimate, briefly reaching the #1 trending spot on the platform. It amassed over 244,000 downloads before being removed. The malware was designed to steal credentials, browser tokens, and crypto wallets from infected Windows systems, highlighting a significant supply chain threat targeting the AI and machine learning community.

KillSec Ransomware Group Targets Nigerian Oil and Gas Firm MRS Holdings

The ransomware group KillSec has claimed a cyberattack on MRS Holdings, a major Nigerian oil and gas company, on May 9, 2026. The group has listed the company on its data leak site and is threatening to release confidential data if its ransom demands are not met. Initial threat intelligence suggests the attack may have been enabled by prior infostealer malware infections that compromised employee and user credentials, highlighting a common attack chain where stolen credentials serve as the entry point for ransomware gangs.

"Road Trap" Smishing Campaign Targets Switzerland with Fake Toll Notices

A sophisticated global SMS phishing (smishing) campaign known as "Road Trap" is increasingly targeting mobile users in Switzerland. The attacks use realistic-looking text messages and high-quality phishing websites that impersonate transportation authorities. Victims are tricked into paying fake road tolls, traffic fines, and parking invoices, with the ultimate goal of stealing their banking details and credit card information. The campaign's success is amplified by its professional design, use of HTTPS, and mobile-optimized pages, posing a significant financial threat to the Swiss public.

Fake TronLink Chrome Extension Deploys Double-Layer Phishing to Steal Crypto Keys

Security firm SlowMist has uncovered a malicious Google Chrome extension that impersonates the official TronLink crypto wallet to steal users' funds. The fake extension uses Unicode obfuscation to spoof the real extension's name and executes a two-layer phishing attack. It tricks TRON users into entering their sensitive mnemonic phrases, private keys, and passwords on a convincing fake interface. The stolen credentials are then immediately exfiltrated to a Telegram bot controlled by the attackers, giving them full access to drain the victim's wallet.

Critical cPanel Zero-Day (CVE-2026-41940) Actively Exploited, Over 40,000 Servers Compromised

A critical authentication bypass vulnerability in cPanel & WebHost Manager (WHM), tracked as CVE-2026-41940, is under active and widespread exploitation. The zero-day flaw, with a CVSS score of 9.8, allows unauthenticated attackers to gain complete administrative control over servers. Threat intelligence from The Shadowserver Foundation indicates that over 40,000 unique IP addresses associated with compromised servers have been observed. The vulnerability, added to CISA's KEV catalog, is being used to deploy 'Sorry' ransomware. Attackers are exploiting the flaw by injecting malicious parameters into session files. All users of cPanel & WHM are urged to patch immediately to mitigate this severe threat.

Critical Unpatched 'Dirty Frag' Linux Zero-Day Allows Instant Root Access

A critical, unpatched zero-day vulnerability in the Linux kernel, dubbed 'Dirty Frag' and tracked as CVE-2026-43284, has been publicly disclosed. The flaw, which has reportedly existed for nine years within the kernel's `algif_aead` cryptographic interface, allows a local attacker to achieve immediate root privilege escalation on all major Linux distributions. The disclosure was made without a patch at the request of the Linux Distros Openwall maintainers, placing immense pressure on system administrators to find mitigations. The vulnerability is described as more severe than the recently discovered 'Copy Fail' (CVE-2026-31431) flaw and highlights a worrying trend of long-dormant, high-impact bugs in the Linux kernel.

CISA KEV Alert: Actively Exploited Ivanti EPMM Flaw (CVE-2026-1340) Allows Full Server Takeover

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1340, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which has a CVSS score of 9.8, allows an unauthenticated attacker to achieve full server compromise with no user interaction. Given the evidence of active exploitation, CISA has mandated that federal agencies patch the vulnerability promptly, and strongly urges all private sector organizations using the affected software to apply the available security updates immediately.

PAN-OS Zero-Day CVE-2026-0300 Actively Exploited for Unauthenticated RCE

A critical buffer overflow vulnerability, CVE-2026-0300, has been discovered in the Palo Alto Networks PAN-OS Captive Portal, allowing for unauthenticated remote code execution with root privileges. The flaw is being actively exploited in limited, targeted attacks by a state-sponsored threat actor tracked as CL-STA-1132. Post-compromise, the attackers deploy open-source tunneling tools like EarthWorm and ReverseSocks5, perform Active Directory enumeration, and meticulously destroy forensic evidence. Palo Alto Networks has issued an emergency patch and threat signatures to mitigate the risk.

Estonia Reports 1,100+ Cyber Incidents in April, Driven by Phishing and Service Outages

Estonia's Information System Authority (RIA) reported 1,138 cyber incidents in April 2026, highlighting a month of significant digital disruption. The incidents included repeated outages of critical services like the Health Insurance Fund's digital prescription system and the DigiDoc4 digital signature application. Simultaneously, Estonia was hit by a wave of phishing campaigns. These attacks impersonated LHV Bank to steal banking credentials and targeted cryptocurrency users of MetaMask and Ledger, leading to financial losses in the thousands of euros. Officials noted a trend towards attacks that exploit human behavior over purely technical flaws.

German Defense Industry Under Siege from Supply Chain Attacks, Cyber Chief Warns

Germany's cyber warfare commander, Vice-Admiral Thomas Daum, has warned of a significant increase in cyberattacks targeting the country's defense industry and its supply chain. This surge coincides with Germany's major rearmament efforts and public support for Ukraine. Daum noted that attacks, often from Russia, spike immediately following announcements of aid to Ukraine. A prime example is the ransomware attack on defense contractor Rheinmetall by the Russian-speaking Black Basta gang, which occurred after Rheinmetall announced plans for a tank factory in Ukraine and cost the company over $10 million in recovery and lost sales.

Cybersecurity Stocks Tumble as Fears Mount Over AI's Hacking Prowess

On April 9, 2026, the software and cybersecurity stock market experienced a massive selloff, wiping out nearly $1 trillion in value. The plunge was catalyzed by an announcement from AI company Anthropic regarding its powerful, unreleased 'Claude Mythos' model, which demonstrated an exceptional ability to discover long-hidden software vulnerabilities. The news fueled investor fears that advanced AI could automate and commoditize vulnerability discovery, potentially disrupting the business models of established cybersecurity and software companies. Major cybersecurity stocks like Qualys, Cloudflare, and Zscaler saw sharp declines.

Silver Fox APT Targets India and Russia with New 'ABCDoor' Backdoor

The Chinese APT group Silver Fox has expanded its cyber-espionage operations with a new campaign targeting organizations in India and Russia since December 2025. The attackers use sophisticated, regionally-timed, tax-themed phishing lures to trick victims into opening malicious archives. The infection chain delivers the known ValleyRAT and a new, previously undocumented Python-based backdoor named ABCDoor. The campaign has targeted organizations in the industrial, consulting, retail, and transportation sectors, sending over 1,600 phishing emails in early 2026 alone.

OpenAI Launches GPT-5.4-Cyber, a Specialized AI Model for Defensive Cybersecurity

OpenAI has introduced GPT-5.4-Cyber, a specialized version of its latest large language model fine-tuned for defensive cybersecurity tasks. The model features fewer restrictions than its public counterpart, enabling security professionals to perform complex operations like binary reverse engineering. This capability allows analysts to examine compiled code for malware and vulnerabilities without access to the source. Access to GPT-5.4-Cyber is being granted through an expanded 'Trusted Access for Cyber' (TAC) program to a select group of vetted organizations, including major financial institutions and cybersecurity firms like CrowdStrike and Palo Alto Networks. The initiative aims to empower cyber defenders and scale security capabilities in response to the growing use of AI by adversaries.

DAEMON Tools Installers Trojanized in Sophisticated Supply Chain Attack

A large-scale supply chain attack has compromised the official website and installers of DAEMON Tools, a popular utility software. Since at least April 8, 2026, legitimate-looking, digitally signed installers have been bundled with a backdoor. The attack, attributed to a Chinese-speaking threat actor, deploys an initial info-stealer to thousands of machines globally. A select dozen victims, including government, scientific, and manufacturing entities in Belarus, Russia, and Thailand, were then targeted with a more advanced backdoor and the sophisticated QUIC RAT. The compromised binaries were signed with a valid certificate, allowing them to bypass security checks.

Palo Alto Networks Firewall Zero-Day Exploited in the Wild, CISA Orders Urgent Patch

Palo Alto Networks has disclosed a critical zero-day vulnerability, CVE-2026-0300, in its PAN-OS software that is under active exploitation. The flaw is a buffer overflow in the Captive Portal feature that allows an unauthenticated attacker to achieve remote code execution with root privileges on affected firewalls. The vulnerability impacts PA-Series and VM-Series firewalls with an exposed User-ID Authentication Portal. In response to the threat, CISA has added CVE-2026-0300 to its Known Exploited Vulnerabilities (KEV) catalog and mandated that federal agencies patch by May 9, 2026. Palo Alto Networks is developing patches and strongly urges customers to mitigate the risk by restricting access to the Captive Portal.

Russian APT28 Exploits Windows Shell Zero-Click Flaw for NTLM Theft

The Russian state-sponsored group APT28 (Fancy Bear) is actively exploiting CVE-2026-32202, a zero-click vulnerability in the Windows Shell, to steal NTLM authentication hashes. The attack uses malicious .LNK shortcut files delivered via email. When a user simply opens the folder containing the file, the exploit triggers, forcing the victim's machine to connect to an attacker-controlled server and leak its NTLM hash. The campaign is targeting European, Ukrainian, and NATO-affiliated entities. CISA has added the flaw to its KEV catalog and mandated a patch deadline of May 12 for federal agencies, but non-federal and European targets remain at high risk.

New 'BARADAI' Ransomware Emerges, Demanding Up to $80,000

Researchers at CYFIRMA have identified a new ransomware strain named BARADAI that is actively targeting Windows systems. The malware encrypts files on local and network drives, appending a unique extension and dropping a ransom note with contact instructions. Observed victims are located in the USA, Brazil, France, Australia, Italy, Israel, and Malaysia, with a focus on the education, manufacturing, retail, and logistics sectors. Ransom demands have ranged from $10,000 to $80,000. BARADAI establishes persistence via `CurrentVersion\Run` registry keys and manipulates system settings for defense evasion. Currently, no public decryption tool is available, and experts warn that future versions may adopt double extortion tactics.

Fraudulent 'CallPhantom' Apps on Google Play Scammed 7.3 Million Users

ESET researchers have exposed a massive fraud operation on the Google Play Store named 'CallPhantom.' The campaign involved 28 fraudulent apps that were collectively downloaded over 7.3 million times, primarily targeting users in India and the Asia-Pacific region. The apps promised the ability to access anyone's call history, SMS records, and WhatsApp logs for a subscription fee. However, after payment, the apps only provided fake, randomly generated data. One app was even published under the deceptive developer name 'Indian gov.in' to appear legitimate. Google has since removed the fleeceware applications from the Play Store.

New Cloud Worm 'PCPJack' Steals Secrets, Eradicates Rival Malware

Researchers at SentinelLabs have discovered a new modular cloud worm named 'PCPJack' that actively steals credentials and secrets from a wide range of cloud services. The malware targets secrets for AWS, GitHub, Slack, Kubernetes, and various cryptocurrency exchanges. In a unique twist, PCPJack is programmed to first detect and remove any existing infections from a rival threat actor, 'TeamPCP,' before installing itself. For propagation, the worm uses stolen secrets for lateral movement via SSH, Kubernetes, and Docker, and also downloads data from Common Crawl to identify new, exposed cloud services to attack. This behavior indicates a competitive and sophisticated threat targeting cloud environments.

CISO Role Crisis: Demands, Legal Risks, and Shortages Make Position Untenable

The role of the Chief Information Security Officer (CISO) is becoming increasingly untenable in 2026, according to a new report from the United States Cybersecurity Institute. A severe shortage of qualified professionals is being exacerbated by expanding job scopes, the growing threat of personal legal liability in the wake of breaches, and inadequate budgets. A Cybersecurity Ventures report estimates there is only one CISO for every 10,000 businesses globally. With Gartner predicting that 50% of CISOs will also be responsible for disaster recovery by 2028, the report calls on corporate boards to treat cybersecurity as a fundamental leadership issue and invest in the role before a major incident occurs.

Microsoft Details Phishing Campaign Targeting 35,000 Users

Microsoft has detailed a large-scale and sophisticated phishing campaign that targeted over 35,000 users in 26 countries between April 14 and 16, 2026. The attack used polished 'code of conduct' lures and an adversary-in-the-middle (AiTM) phishing kit to steal session tokens and bypass multi-factor authentication. The campaign primarily targeted organizations in the United States, with the healthcare, financial services, and professional services sectors being the most affected. The report also highlights a 146% surge in QR code phishing attacks in Q1 2026.

CISA Considers Slashing Critical Vulnerability Patching Deadline to 72 Hours

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reportedly considering a drastic policy change that would shorten the remediation timeline for critical vulnerabilities from 14 days to just 72 hours for federal agencies. This potential move applies to flaws listed in the Known Exploited Vulnerabilities (KEV) catalog. The primary driver for this proposal is the growing concern among federal officials that advanced AI models, like Anthropic's 'Claude Mythos', will dramatically accelerate the speed at which exploits are developed, collapsing the window between disclosure and mass exploitation. The proposal has been met with debate, as experts question the feasibility of such a rapid turnaround for testing and deployment in large government systems.

Actively Exploited Windows Zero-Day (CVE-2026-32202) Steals NTLM Hashes Without User Clicks

Microsoft and CISA are warning of active, zero-click exploitation of a Windows Shell spoofing vulnerability, CVE-2026-32202. The flaw, which stems from an incomplete patch for a bug previously used by APT28, allows attackers to steal Net-NTLMv2 hashes simply by having a user open a folder containing a malicious file. This enables NTLM relay and pass-the-hash attacks. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. federal agencies apply the patch immediately.

Mirai Variant 'xlabs_v1' Builds DDoS Botnet by Hijacking IoT Devices with Exposed ADB Ports

A new DDoS botnet derived from the Mirai source code, named 'xlabs_v1', is actively compromising internet-exposed IoT and Android devices. The malware exploits open Android Debug Bridge (ADB) ports on TCP port 5555 to infect devices like Android TV boxes, smart TVs, and routers. Researchers at Hunt.io discovered the botnet's infrastructure, which hosts multi-architecture builds of the malware, indicating a wide range of targets. The botnet, operated by an actor named 'Tadashi', appears to be a DDoS-for-hire service, with specific attack vectors designed for gaming servers like Minecraft. The malware employs evasion techniques, including renaming itself to common system processes and terminating competing malware, to maintain control over the compromised devices.

Malicious PyPI Packages Use Zulip Chat App for C2 to Deploy 'ZiChatBot' Malware

Researchers have discovered three malicious packages on the Python Package Index (PyPI) that deploy a novel malware called 'ZiChatBot' on both Windows and Linux systems. The malware distinguishes itself by using the REST APIs of the Zulip team chat application for its command-and-control (C2) communications, a technique that helps it evade detection by blending in with legitimate traffic. The malicious packages, named `uuid32-utils`, `colorinal`, and `termncolor`, were active on PyPI in July 2025. Based on code analysis, the campaign is suspected to be the work of the OceanLotus APT group, suggesting a possible shift in their tactics towards supply chain attacks. The packages and the associated Zulip organization have since been removed.

A Dozen Critical Sandbox Escape Flaws Found in Popular 'vm2' Node.js Library

A dozen critical security vulnerabilities have been discovered in 'vm2', a popular Node.js library used for running untrusted code in a sandboxed environment. The flaws, several of which are rated 9.8 (Critical) on the CVSS scale, allow an attacker to bypass the sandbox's protections and execute arbitrary code on the host system. The affected versions are up to 3.10.4. The maintainer has released patches in version 3.11.2 and is urging all users to update immediately. Key vulnerabilities include CVE-2026-24118, CVE-2026-24120, CVE-2026-24781, and CVE-2026-26332. This discovery highlights the inherent difficulty and risk associated with creating secure JavaScript sandboxes.

IBM's Italian Subsidiary, a Key Infrastructure Provider, Hit by Cyberattack; China-Linked Salt Typhoon Suspected

Sistemi Informativi, an Italian IT infrastructure provider wholly owned by IBM, was hit by a significant cyberattack in late April 2026. The company manages IT systems for numerous Italian public agencies and private sector clients, making the incident a serious threat to national digital infrastructure. While IBM has confirmed and contained the breach, the full scope remains undisclosed. Investigative reports and intelligence sources suggest the attack may have been carried out by Salt Typhoon, a sophisticated cyber espionage group linked to China. Salt Typhoon is known for targeting critical infrastructure and leveraging exploits in network devices, aligning with the profile of this attack.

ESA Hosts Industry Workshop to Develop Standardized Cybersecurity for Space Systems

The European Space Agency (ESA) is holding a cybersecurity workshop on May 7, 2026, to address the escalating cyber threats against space infrastructure. As space systems increasingly use commercial off-the-shelf components and are more interconnected, their vulnerability to attack has grown. The workshop, part of ESA's General Support Technology Programme (GSTP), aims to foster collaboration between the agency and industry partners to create a security reference architecture. The goal is to develop a set of standardized, modular cybersecurity 'building blocks' that can be used in future space missions to improve security, reduce costs, and ensure compliance with emerging regulations like the EU Space Act.

Accenture Invests in AI-Powered Offensive Security Platform XBOW

Accenture has made a strategic investment in XBOW, a platform that utilizes agentic AI to perform autonomous cybersecurity testing and exposure management. The investment, made through Accenture Ventures, also establishes a partnership to integrate XBOW's capabilities into Accenture's Cyber.AI solution. The collaboration aims to help clients proactively manage their security posture against the backdrop of increasingly sophisticated AI-driven cyber threats. By combining human expertise with AI agents, Accenture seeks to shift security operations from human-speed to a continuous, machine-speed model, addressing the gap between the rapid adoption of AI and the slower pace of securing it.

Orange Cyberdefense Becomes an Authorized CVE Numbering Authority (CNA)

Orange Cyberdefense, a major European cybersecurity services firm, has been officially authorized as a CVE Numbering Authority (CNA). This designation, granted by the international Common Vulnerabilities and Exposures (CVE) Program, empowers Orange Cyberdefense to assign CVE identifiers to vulnerabilities. The company can now issue CVE IDs for flaws found in its own products and, significantly, for vulnerabilities its research teams discover in third-party products. This move enhances the company's role in the global security ecosystem, allowing it to streamline the coordinated disclosure process and provide greater risk visibility to its clients and the broader community.

Vimeo Data Exposed in Supply-Chain Attack on Vendor Anodot; ShinyHunters Implicated

Video hosting platform Vimeo has confirmed a data breach that exposed user and customer data as a result of a supply-chain attack on its analytics vendor, Anodot. The attackers reportedly stole authentication tokens from Anodot and used them to access customer environments, including Vimeo's Snowflake and BigQuery instances. The exposed Vimeo data includes technical information, video titles, metadata, and some customer email addresses. Vimeo has stressed that no video content, login credentials, or payment information was compromised. The notorious extortion group ShinyHunters has been linked to the broader campaign, also listing Rockstar Games as a victim of the Anodot compromise.

CloudZ RAT Exploits Windows Phone Link to Intercept SMS and OTPs from Phones

A novel attack campaign is using the CloudZ remote access tool (RAT) and a custom plugin called "Pheno" to abuse the legitimate Microsoft Phone Link application on Windows. By compromising a Windows PC, attackers can access the synchronized mobile data stored locally, allowing them to read SMS messages and notifications containing one-time passwords (OTPs). This technique enables them to bypass two-factor authentication without ever needing to infect the victim's Android or iOS device. The campaign, active since January 2026, begins with a fake ConnectWise ScreenConnect update that drops the CloudZ RAT.

China-Nexus APT 'UAT-8302' Uses Shared Malware Toolkit to Target Governments

Cisco Talos has identified a sophisticated China-linked APT group, dubbed UAT-8302, that has been conducting espionage campaigns against government entities in South America and Southeastern Europe since late 2024. The group's primary objective is intelligence gathering through persistent access. A key finding is UAT-8302's use of a diverse malware toolkit, including NetDraft and an updated version of CloudSorcerer, which is shared among several other China-nexus threat actors like LongNosedGoblin and Earth Estries. This shared infrastructure suggests a high degree of collaboration within China's state-sponsored cyberespionage ecosystem, complicating attribution.

Critical RCE Flaw in Apache HTTP Server's HTTP/2 Module Patched

The Apache Software Foundation has patched a critical vulnerability, CVE-2026-23918, in the Apache HTTP Server. The flaw is a 'double free' memory corruption bug in the `mod_http2` module affecting version 2.4.66. With a CVSS score of 8.8, the vulnerability can be trivially triggered by a remote, unauthenticated attacker to cause a denial-of-service (DoS) by crashing a worker process. More significantly, security researchers have developed a working proof-of-concept (PoC) demonstrating that the flaw can be exploited for remote code execution (RCE). Users are urgently advised to upgrade to the patched version, 2.4.67.

North Korean APT ScarCruft Hits Gaming Platform in Supply-Chain Attack

The North Korea-aligned APT group ScarCruft (APT37) has executed a multi-platform supply-chain attack by compromising a regional gaming platform, `sqgame[.]net`. Active since late 2024, the campaign targets the ethnic Korean community in China's Yanbian region. The attackers distributed trojanized Windows and Android game installers embedded with a new Android version of the 'BirdCall' backdoor. This powerful spyware harvests contacts, call logs, messages, and can record ambient audio, exfiltrating the data via legitimate cloud services like pCloud and Yandex Disk. The campaign's goal is likely surveillance of individuals of interest to the North Korean regime.

High-Severity Redis Flaw (CVE-2026-25243) Allows for Potential RCE

A high-severity vulnerability, CVE-2026-25243, has been discovered in Redis, a popular in-memory data store. The flaw is a heap-based buffer overflow within the `RESTORE` command, which fails to properly validate serialized data. An authenticated attacker with permission to use the `RESTORE` command can supply a crafted payload to trigger invalid memory access, leading to a server crash or potential remote code execution. The vulnerability, rated CVSS 7.7, affects all Redis server versions up to 8.6.3. Users are advised to upgrade immediately or restrict access to the `RESTORE` command using ACLs.

89% of IT Leaders Struggle with Identity Sprawl Amid AI Expansion: Report

A new global report from Keeper Security, "Identity Security at Machine Speed," reveals that 89% of IT leaders find it difficult to manage their organization's expanding identity footprint. The rapid adoption of AI is a key driver, multiplying the number of non-human identities (NHIs) that require governance. The survey of 3,200 IT decision-makers highlights major security gaps, with 96% citing disconnected tools as a problem and 72% admitting that credential misuse is not detected in real-time. The report also points to the risks of "shadow AI" and employees inadvertently exposing data to AI systems.

China-Based Silver Fox APT Expands Espionage Campaign Across Asia with Fake Tax Audits

The China-based threat group Silver Fox has launched a new wave of attacks targeting businesses and individuals across Asia. The group, which has been active since at least 2022, uses fake tax audit notifications and counterfeit software update alerts to deliver malware. According to analysis by S2W, Silver Fox has evolved from financially motivated attacks within China to a dual-purpose operation involving both espionage and profit-driven campaigns. The group's focus has expanded from Taiwan and Japan to include targets in Malaysia, Indonesia, Singapore, Thailand, and the Philippines, with a recent focus on medical institutions and financial companies.

New 'CloudZ' Malware Abuses Microsoft Phone Link to Steal Mobile Data

A novel malware campaign is leveraging a remote access trojan (RAT) named CloudZ and a custom plugin, Pheno, to abuse the Microsoft Phone Link feature in Windows. This attack, identified by Cisco Talos, allows threat actors to steal sensitive data from a user's smartphone, including SMS messages and one-time passwords (OTPs), by accessing the Phone Link database on a compromised PC. This innovative technique bypasses mobile device security entirely, shifting the attack vector to enterprise-managed Windows systems and undermining the security of SMS-based multi-factor authentication.

DAEMON Tools Installers Compromised in Ongoing Supply-Chain Attack

An ongoing supply chain attack, active since April 8, 2026, has been compromising the official installers for DAEMON Tools, a popular disk emulation utility. Researchers at Kaspersky discovered that installers downloaded from the company's legitimate website were bundled with malware. These trojanized files, including versions 12.5.0.2421 to 12.5.0.2434, are signed with a valid digital certificate from the developer, AVB Disc Soft, allowing them to evade detection. The malware establishes a backdoor, collects system information, and in targeted cases, deploys an advanced implant called QUIC RAT on machines in Russia, Belarus, and Thailand.

Critical MetInfo CMS Vulnerability Under Active Exploitation

A critical unauthenticated remote code execution (RCE) vulnerability in the MetInfo Content Management System, tracked as CVE-2026-29014, is being actively exploited in the wild. The flaw, which carries a CVSS score of 9.8, allows attackers to inject and execute arbitrary PHP code by sending crafted requests to a WeChat integration script. Exploitation has surged since May 1, 2026, primarily targeting servers in China and Hong Kong. With exploit code publicly available and around 2,000 MetInfo instances online, there is a high risk of widespread server compromise.

SANS and SERC Partner to Bolster Grid Cybersecurity Training

The SANS Institute and the SERC Reliability Corporation have formed a strategic partnership to deliver advanced cybersecurity training to electric utilities across the United States. This initiative aims to strengthen the reliability of the bulk electric system, improve readiness for NERC CIP compliance, and accelerate workforce development. The partnership will begin with SANS teaching its ICS456: NERC CIP course in August 2026, preparing professionals for the GIAC Critical Infrastructure Protection (GCIP) certification.

CISA Launches 'CI Fortify' to Bolster Critical Infrastructure Resilience

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched a new initiative, 'CI Fortify,' to help critical infrastructure (CI) entities enhance their resilience against cyberattacks. The guidance focuses on preparing organizations to maintain operations during a crisis or conflict by developing proactive isolation and recovery capabilities. CISA is urging CI entities to review the guidance and implement its recommendations to ensure the continuity of vital services.

Cybersecurity Vendor Trellix Confirms Breach of Source Code Repository

Cybersecurity vendor Trellix, formed from the merger of McAfee Enterprise and FireEye, has confirmed a security breach involving unauthorized access to a portion of its internal source code repository. The company stated it has engaged forensic experts and notified law enforcement. While the investigation is ongoing, Trellix has found no evidence that its source code release process was compromised or that the code has been altered or exploited. This incident places Trellix in a growing list of security companies, including Okta and LastPass, that have suffered source code breaches, highlighting the significant threat of supply chain attacks targeting the security industry itself.

CrowdStrike's 'Project QuiltWorks' Unites Industry to Tackle AI-Driven Vulnerability Surge

CrowdStrike has launched 'Project QuiltWorks,' a new industry coalition designed to address the security risks arising from the accelerated discovery of software vulnerabilities by frontier AI models. Recognizing that models like those from OpenAI and Anthropic can find bugs at an unprecedented rate, the initiative brings together AI developers, cybersecurity leaders, and systems integrators to create a structured approach for remediation. Key partners include OpenAI, Anthropic, Accenture, EY, and IBM Cybersecurity Services. As part of the project, CrowdStrike is also launching a 'Frontier AI Readiness and Resilience Service' to provide expert-led assessments and guided remediation for customers, helping them determine their exposure to these newly found flaws.

CISA Warns of 'ShadowProxy' Phishing-as-a-Service that Bypasses MFA

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have issued a joint advisory about the growing threat from 'ShadowProxy,' a sophisticated Phishing-as-a-Service (PhaaS) platform. Sold on dark web forums, ShadowProxy enables even low-skilled criminals to launch large-scale phishing campaigns capable of defeating multi-factor authentication (MFA). The platform uses an adversary-in-the-middle (AiTM) technique, acting as a reverse proxy to intercept credentials and, crucially, the session cookie generated after a successful MFA login. This allows attackers to hijack active sessions and gain full access to accounts like Microsoft 365 and Google Workspace.

Ameriprise Financial Hit by Data Breach, Exposing Data of Nearly 48,000 Customers

Ameriprise Financial, a major U.S. financial services firm, has reported a data breach that exposed the personal and financial information of approximately 48,000 customers. The incident, which began on March 2, 2026, involved unauthorized access to stored data and was not detected for 16 days. Exposed data includes names, addresses, and financial account details, with potential compromise of Social Security numbers. This is the company's second breach in under six months. While not officially confirmed by Ameriprise, the ShinyHunters hacking group was allegedly linked to the attack in now-dropped lawsuits, claiming to have exfiltrated over 200GB of data. Ameriprise is offering credit monitoring services to affected individuals.

Sandhills Medical Foundation Faces Class Action Probe Over Ransomware Attack Affecting 169,000 Patients

A ransomware attack on Sandhills Medical Foundation in 2025 has triggered a class action investigation announced on May 3, 2026. The breach, claimed by the 'Inc Ransom' group, exposed the personal and protected health information (PHI) of 169,017 patients. The attack itself was discovered in May 2025, with data exfiltration occurring in November 2025. However, the healthcare provider did not begin notifying affected patients until April 2026, a significant delay that has drawn legal scrutiny and criticism for potentially violating data protection laws. The exposed data includes highly sensitive information such as Social Security numbers, financial details, and medical records.

New Ransomware Group 'Mnt6' Surfaces, Claims Attack on New Zealand Contractor McKay

A new ransomware group, identifying itself as 'Mnt6', has claimed responsibility for a cyberattack against McKay, a major New Zealand-based electrical contractor. The attack occurred in January 2026, but the nascent threat group only listed McKay on its darknet leak site on April 30. McKay confirmed the incident, stating it detected and contained unauthorized access to a single internal device. In response to the threat of data disclosure, McKay has obtained a High Court injunction to block the publication of any stolen data. Little is known about Mnt6, which has only two other victims listed, suggesting it may be a new player in the ransomware ecosystem.

MoneyForward GitHub Breach Exposes Customer Data, Hardcoded Secrets

Japanese fintech leader MoneyForward Inc. has disclosed a data breach resulting from a compromise of its corporate GitHub account. The incident, which occurred between May 1 and May 3, 2026, led to the exposure of company source code and the personal data of 370 business card users. In a transparent disclosure, MoneyForward admitted to critical security failures, including hardcoding authentication keys directly in the source code and inadvertently committing a file containing sensitive production data to the GitHub repository during a service update. The company temporarily suspended connections to bank accounts as a precaution while it investigates and remediates the issue.

Florida Physician Specialists Breach Exposes Extensive Patient Data, Prompts Legal Probe

Florida Physician Specialists, a medical practice based in Jacksonville, has disclosed a data breach that exposed a wide array of sensitive patient information. The incident, which took place between November 27 and 29, 2025, involved an unauthorized third party gaining access to the practice's network. A comprehensive review to determine the scope of the breach was not completed until April 2026, and notification letters were sent out late that month. The exposed data includes names, Social Security numbers, financial account details, medical information, and health insurance data. The significant delay between the breach and notification has prompted a class-action law firm to launch an investigation.

NSW Government Downgrades Treasury Cyber Incident, Cites Containment

The New South Wales (NSW) Government has officially downgraded the 'significant cyber incident' declared in April following an alleged internal data breach at NSW Treasury. On May 4, 2026, officials confirmed the incident is now contained and has moved to the recovery phase. The breach, believed to be an insider threat, involved a Treasury staff member who allegedly transferred a large number of confidential documents to an external server. The matter was reported to NSW Police, leading to criminal charges. The government stated that there was no external compromise of Treasury systems and believes all allegedly stolen data has been secured.

IBM Executive Tom Parker Reportedly a Top Candidate for CISA Director

Tom Parker, a cybersecurity executive at IBM, is reportedly a leading candidate to be the next director of the U.S. Cybersecurity and Infrastructure Security Agency (CISA). According to sources familiar with the matter, Parker's extensive private-sector background is a key attribute favored by the current administration and Homeland Security Secretary Markwayne Mullin. Parker, who has no prior government experience, founded the cyber solutions firm Hubble and is a regular speaker at the Black Hat conference. The CISA leadership position has been without a permanent director since the previous nominee withdrew, and while Parker is seen as a frontrunner, the selection process remains fluid.

AI-Enabled Cybercrime Fuels 389% Surge in Ransomware Victims, Fortinet Reports

The 2026 Global Threat Landscape Report from Fortinet's FortiGuard Labs reveals a dramatic industrialization of cybercrime, heavily augmented by artificial intelligence. The report highlights a staggering 389% year-over-year increase in confirmed ransomware victims, a surge attributed to the proliferation of AI-powered crime-as-a-service tools like WormGPT and FraudGPT. Furthermore, AI is enabling attackers to move with unprecedented speed, shrinking the average time-to-exploit for critical vulnerabilities to just 24-48 hours. This acceleration leaves defenders with a dangerously small window to respond and underscores a fundamental shift in the threat landscape towards faster, more sophisticated, and scalable attacks.

Anodot Breach Leads to Supply Chain Attack on Snowflake Customers; ShinyHunters Claims Responsibility

A security breach at Israeli AI analytics firm Anodot has resulted in a significant downstream supply chain attack targeting customers of the cloud data platform Snowflake. The 'ShinyHunters' extortion gang claimed responsibility on April 7, 2026, stating they leveraged stolen authentication tokens from Anodot's systems to gain unauthorized access to their customers' Snowflake instances. This allowed the attackers to bypass traditional defenses and steal data from multiple companies. High-profile victims, including Rockstar Games, have been named on the gang's leak site, with ransom demands issued to prevent the data from being published.

cPanel Zero-Day Auth Bypass (CVE-2026-41940) Actively Exploited for Months Before Patch

A critical authentication bypass vulnerability, CVE-2026-41940, in the widely used cPanel & WHM web hosting platform was actively exploited as a zero-day for at least two months before a patch was released. The flaw, which has a CVSS score of 9.8, allows a remote, unauthenticated attacker to gain full administrative access to a vulnerable server. The vulnerability is a CRLF injection weakness that allows an attacker to manipulate session files and create an administrator-level session without credentials. Hosting providers observed exploitation as early as February 2026, long before the official advisory on April 28. With an estimated 1.5 million cPanel instances exposed online, administrators are urged to patch immediately.

Critical Flaw in VECT 2.0 Ransomware Turns It Into a Destructive Wiper, Permanently Destroying Large Files

Check Point Research has discovered a critical implementation flaw in the VECT 2.0 ransomware that causes it to permanently destroy any file larger than 128KB, effectively turning it into a data wiper. The bug, found in all variants targeting Windows, Linux, and ESXi, relates to improper handling of cryptographic nonces. This means that even if a victim pays the ransom, recovery of most valuable enterprise data is impossible, as the keys required for decryption are discarded during the encryption process.

"Living Within SaaS": Cordial & Snarky Spider Groups Use Vishing, SSO Abuse for Rapid Extortion

Two cybercrime groups, Cordial Spider and Snarky Spider, linked to "The Com" ecosystem, are conducting swift data theft and extortion campaigns. They use voice phishing (vishing) and fake Single Sign-On (SSO) pages to steal credentials, gain access to identity providers, and then move laterally across victims' SaaS applications like Google Workspace and Salesforce to exfiltrate data for seven-figure ransoms.

NightSpire Ransomware Group Matures Into Significant Double-Extortion Threat

The NightSpire ransomware group, first seen in early 2025, has rapidly evolved into a full double-extortion operation. A May 1st report details its use of CVE-2024-55591 for initial access, Go-based payloads, and aggressive tactics, including a dedicated data leak site and extremely short ransom deadlines to pressure victims.

Robinhood Flaw Abused to Send Phishing Emails From Company's Own Address

A vulnerability in Robinhood's account creation process was exploited to send highly convincing phishing emails from the company's own `noreply@robinhood.com` address. Attackers injected malicious HTML into the device metadata field of new account confirmation emails. This created a fake security warning with a link to a credential-harvesting site, bypassing standard email security checks like SPF and DKIM.

FulcrumSec Ransomware Group Claims Attack on Colombian Healthcare Firm IMEVI

The ransomware group FulcrumSec has claimed responsibility for a cyberattack on IMEVI, a Colombian healthcare and engineering services company. The group announced the breach on its leak site on May 1, 2026, threatening to publish a "full leak" of stolen data if the company does not enter negotiations, consistent with a double-extortion campaign.

Microsoft Patches Entra ID Flaw That Allowed Service Principal Takeover

A design flaw in Microsoft's Entra ID "Agent ID Administrator" role allowed for privilege escalation and the takeover of arbitrary service principals, including highly privileged ones. An attacker assigned this role could add themselves as an owner to any service principal, inject credentials, and potentially escalate to Global Administrator. Microsoft patched the vulnerability in April 2026 after a responsible disclosure.

ClickUp API Key Leak Exposes Corporate and Government Emails for 15 Months

A hardcoded API key in a public JavaScript file on ClickUp's website exposed 959 email addresses of employees at major corporations and government agencies for over 15 months. The flaw, first reported via HackerOne in January 2025, allowed unauthenticated access to a 4.5MB file of internal data, including emails from Home Depot, Fortinet, Tenable, and various government workers.

Qilin Ransomware Group Claims Attack on U.S. Contractor Jayeff Construction

The Qilin ransomware group has claimed responsibility for an attack on Jayeff Construction, a U.S.-based general contractor. The breach was announced on the group's data leak site around May 1, 2026. Qilin, a prominent Ransomware-as-a-Service (RaaS) operation, is known for its double-extortion tactics and use of cross-platform malware written in Go and Rust.

Ransomware Civil War: KryBit RaaS Hacks and Leaks Rival Gang 0APT

In an unusual turn of events within the cybercrime underworld, the new KryBit ransomware-as-a-service (RaaS) group has hacked and publicly leaked the entire operational infrastructure of a rival gang, 0APT. The leak appears to be retaliation for 0APT previously leaking some of KryBit's data. The exposed data revealed that 0APT had been fabricating victim claims and was running its leak site from a shockingly amateur setup: an Android device. While 0APT is left exposed, KryBit continues its own attacks, employing double extortion tactics against at least 20 victims across multiple sectors and countries, including the US, Germany, and Japan.

UK Cyber Survey: 43% of Businesses Breached, But Only 25% Have an IR Plan

The UK government's latest Cyber Security Breaches Survey for 2025/2026 reveals a landscape of persistent risk, with 43% of businesses (an estimated 612,000) experiencing a breach in the past year. Phishing remains the dominant attack vector, implicated in 85% of successful breaches. Despite the high frequency of attacks, the report exposes critical gaps in organizational readiness: only 25% of businesses have a formal incident response plan. The survey also highlights major weaknesses in supply chain risk management and a lack of security practices for adopting AI, prompting criticism that current UK policy is insufficient to address national cyber risk.

Palo Alto Networks to Acquire Portkey, an AI Gateway Startup, to Secure Autonomous AI Agents

Palo Alto Networks has announced its planned acquisition of Portkey, a startup specializing in AI Gateway technology. The move is a strategic effort to address the emerging security challenges posed by the rise of autonomous AI agents in the enterprise. Portkey provides a centralized control plane to manage, monitor, and secure AI agent traffic. Its technology will be integrated into Palo Alto Networks' Prisma AIRS platform, creating a 'central nervous system' to inspect AI transactions, enforce governance, and apply least-privilege controls. This acquisition reflects a growing industry focus on securing the new, unmanaged attack surface created by highly privileged AI agents.

That AI Extension Helping You Write? It's Actually a RAT Stealing Your Data

Palo Alto Networks' Unit 42 has discovered at least 18 malicious browser extensions masquerading as Generative AI productivity tools. These extensions, some downloaded by thousands, are not enhancing productivity but are instead functioning as Remote Access Trojans (RATs), infostealers, and search hijackers. The attackers leverage the broad permissions users grant to these 'AI assistants' to intercept sensitive data, including credentials, proprietary code shared in AI prompts, and private communications. The research provides technical case studies, including an extension that establishes a persistent command-and-control channel to execute arbitrary code within a user's authenticated sessions, highlighting a severe risk to both individuals and enterprises.

Ransomware Negotiator Admits to Conspiring with BlackCat Gang

Angelo Martino, a former ransomware negotiator, has pleaded guilty to conspiring with the notorious BlackCat (ALPHV) ransomware gang. Martino abused his position at a crypto brokerage firm, using his insider knowledge of his clients' negotiating strategies and insurance limits to help BlackCat maximize their extortion demands. He also conspired to deploy ransomware against victims, leading to multi-million dollar ransom payments. Law enforcement has seized $10 million in illicit proceeds.

TeamPCP Weaponizes npm with Malicious Bitwarden CLI in Sophisticated Supply Chain Attack

A sophisticated supply chain attack targeting the npm ecosystem has been uncovered by Unit 42, attributed to the threat actor group TeamPCP. The attackers published a malicious package, `@bitwarden/cli` version `2026.4.0`, which perfectly impersonates the legitimate Bitwarden command-line tool. Upon installation, the package executes a multi-stage, heavily obfuscated payload designed to harvest credentials from developer workstations, cloud environments (AWS, Azure, Google Cloud), and CI/CD pipelines. The malware exhibits worm-like capabilities, inspired by the 2025 "Shai-Hulud" worm, by automatically backdooring and republishing other npm packages to which the compromised developer has access, ensuring its rapid propagation. The campaign, which also targeted other distribution channels like a VS Code extension, utilized a centralized C2 infrastructure at `audit.checkmarx[.]cx`, indicating a coordinated effort to compromise developer tooling.

Ransomware Turf War: 0APT and KryBit Groups Hack Each Other in Public Feud, Leaking Ops Data

A rare public conflict has erupted between two rival ransomware groups, 0APT and KryBit. The feud, which played out between March 28 and April 12, 2026, involved both groups hacking each other and leaking sensitive operational data. 0APT initiated the spat by leaking KryBit's admin panel. KryBit retaliated by hacking 0APT, defacing their leak site, and dumping their entire operational dataset. The leak revealed that 0APT had fabricated over 190 victim listings and was running its infrastructure on an Android phone. Security experts believe the mutual doxing will likely force both amateurish groups to rebuild and rebrand.

Fortinet Report: AI-Enabled Attacks Fuel 389% Surge in Ransomware Victims

Fortinet's 2026 Global Threat Landscape Report reveals a staggering 389% year-over-year increase in confirmed ransomware victims in 2025, attributing the surge in part to AI-enabled cybercrime. The report highlights how tools like WormGPT and FraudGPT are making attacks more sophisticated and scalable. A key finding is the dramatic reduction in the time-to-exploit for critical vulnerabilities, which has shrunk to between 24 and 48 hours, demanding a more agile and industrialized defense.

Critical 'Copy Fail' Linux Flaw (CVE-2026-31431) Gives Instant Root on Major Distros

A critical logic flaw in the Linux kernel, dubbed 'Copy Fail' and tracked as CVE-2026-31431, has been disclosed, affecting nearly all major distributions since 2017. Discovered by Theori, the vulnerability allows any unprivileged local user to gain full root privileges with a simple, highly reliable exploit that does not depend on race conditions. This poses a severe risk to multi-tenant environments like cloud hosting, Kubernetes, and CI/CD pipelines. A public proof-of-concept exists, and major Linux vendors are rushing to release patches.

Critical GitHub RCE Flaw (CVE-2026-3854) Allowed Full Server Compromise via Single 'git push'

A critical remote code execution (RCE) vulnerability in GitHub, tracked as CVE-2026-3854, has been disclosed by security firm Wiz. The flaw allowed any authenticated user with push access to a repository to execute arbitrary commands on GitHub's backend servers using a specially crafted `git push` command. The bug affected both GitHub.com and self-hosted GitHub Enterprise Server (GHES) instances, potentially leading to the compromise of millions of repositories or full server takeovers. Patches are available, but a high percentage of internet-facing GHES instances remain vulnerable.

CISA and Partners Release Joint Guidance for Applying Zero Trust Principles to OT Environments

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in partnership with the Department of War, DOE, FBI, and DOS, has published a comprehensive guide for implementing Zero Trust security principles within Operational Technology (OT) environments. The guidance provides a roadmap for securing critical infrastructure, addressing the unique challenges of OT such as legacy systems, uptime requirements, and the paramount need for physical process safety, especially in the face of threats like Volt Typhoon.

ShinyHunters Leaks 1.4 Million Udemy User Records, Including Financial Data, After Failed Extortion

The ShinyHunters cybercrime group has publicly leaked a database containing 1.4 million records from the online learning platform Udemy after a 'pay or leak' extortion attempt failed. The compromised data is extensive, including user and instructor PII, contact information, and sensitive financial payout details like PayPal accounts and bank information. The breach places affected individuals at a high risk of phishing, fraud, and identity theft. Users are advised to reset passwords and enable 2FA.

New Stealthy Python Backdoor 'DEEP#DOOR' Steals Credentials Using Legitimate Tunneling Service

Security researchers from Securonix have discovered a sophisticated, multi-stage Python backdoor named DEEP#DOOR. The malware operates as a full-featured Remote Access Trojan (RAT), beginning with an obfuscated batch script that embeds the Python payload. It disables Windows security controls, establishes persistence through multiple methods (Startup folder, Run keys, Scheduled Tasks, WMI), and uses the legitimate 'bore.pub' tunneling service for stealthy command-and-control and data exfiltration, focusing on browser and cloud credentials.

Decade-Old OpenSSH Flaw (CVE-2026-35414) Allows Full Root Access, Exploits Hard to Detect

A critical remote code execution vulnerability, CVE-2026-35414, has been discovered in OpenSSH, affecting versions released over the last 15 years. The flaw, which carries a CVSS score of 8.1, resides in the parsing of SSH certificate principal names. An attacker with a valid certificate from a trusted Certificate Authority (CA) can craft a principal name with a comma (e.g., 'deploy,root') to trick the server into granting root-level access. A major concern is that successful exploitation is logged as a legitimate authentication, making detection through log analysis nearly impossible. The vulnerability affects OpenSSH versions prior to 10.3, and administrators are urged to update to the patched version 10.3p1 immediately to prevent full system compromise.

Patching Windows Collapse as Time-to-Exploit for Vulnerabilities Shrinks Dramatically

The window of opportunity for IT security teams to apply patches is collapsing, according to a new report from Rapid7. The median time from a vulnerability's disclosure to its active exploitation has been cut nearly in half, dropping from 8.5 to just 5.0 days for inclusion in CISA's KEV catalog. This acceleration is driven by the industrialization of cybercrime and the use of AI to rapidly develop exploits. The trend signifies a major shift in the threat landscape, where 'n-day' vulnerabilities (known flaws with patches available) now pose a greater practical threat than zero-days, putting immense pressure on defenders to automate and accelerate their patching cycles.

CISA Adds Actively Exploited Windows Flaw to KEV Catalog After Botched Patch for APT28 Zero-Day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a new Microsoft Windows vulnerability, CVE-2026-32202, to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch it. The vulnerability, which is being actively exploited, is an authentication coercion flaw resulting from an incomplete patch for a previous zero-day, CVE-2026-21510. The original flaw was exploited by the Russian APT group APT28 (Fancy Bear) in attacks against Ukraine and the EU. The new zero-click vulnerability can be used to steal credentials via specially crafted LNK files and was fixed in Microsoft's April 2026 security updates.

VECT 2.0 Ransomware Flaw Means Paying the Ransom is Pointless—Large Files are Wiped Forever

Security researchers at Check Point have uncovered a critical design flaw in the VECT 2.0 ransomware that causes it to permanently destroy files larger than 128 KB instead of encrypting them. This bug, present in the Windows, Linux, and ESXi variants, discards essential decryption keys (nonces) during the encryption process for larger files. Consequently, victims who pay the ransom have no hope of recovering significant enterprise data like databases, virtual machine disks, or backups, as the data required for decryption is lost forever. The ransomware, marketed as a triple-threat operation, is associated with the TeamPCP group and the BreachForums marketplace but has been assessed as technically unsophisticated.

ShinyHunters Ransomware Spree: Carnival, Zara's Parent, and 40+ Firms Breached in Massive Campaign

The ShinyHunters ransomware group has claimed responsibility for a large-scale attack campaign that has compromised more than 40 organizations worldwide. The victims, listed on the group's data leak site, span the retail, insurance, and hospitality sectors. High-profile targets include Carnival Corporation, which confirmed a breach affecting 8.7 million records from its Holland America Line subsidiary, as well as Mytheresa, Pitney Bowes, and Inditex, the parent company of Zara. The attackers are using double-extortion tactics, threatening to publicly release stolen personally identifiable information (PII) and corporate data unless ransoms are paid. The campaign, with victim listings dating back to January 2026, poses a significant threat of follow-on phishing attacks.

Europol Warns of AI-Powered 'Industrialized Cybercrime' in IOCTA 2026 Report

Europol's 2026 Internet Organised Crime Threat Assessment (IOCTA) highlights a major shift towards the 'industrialization' of cybercrime, significantly accelerated by the use of Artificial Intelligence. The report states that AI is being used to increase the scale, speed, and efficiency of attacks. Ransomware remains the dominant threat in the EU, but with a strategic shift from data encryption to data theft and extortion. The IOCTA also notes a blurring of lines between financially motivated cybercriminals and state-sponsored hybrid actors, who increasingly use criminal networks as proxies for disruptive operations. Europol calls for greater collaboration to combat this new era of technologically advanced cybercrime.

MITRE Warns of New Cyber Risks in AI and Cloud-Connected Medical Devices

A new discussion paper from MITRE warns that the rapid integration of emerging technologies like AI, cloud computing, and post-quantum cryptography into medical devices is creating new and complex cybersecurity risks that could directly impact patient safety. The report, "Cybersecurity Risk Analysis for Medical Devices in the Era of Evolving Technologies," stresses that traditional security controls are insufficient. It highlights that as devices move from clinical settings to patient homes, risk management becomes a shared responsibility across manufacturers, healthcare providers, and patients. MITRE calls for cybersecurity to be a core design principle, not an afterthought, for this increasingly interconnected and diverse ecosystem.

Entertainment Industry Failing on Security Basics, MPA Report Reveals Widespread Risks

The Motion Picture Association's (MPA) Trusted Partner Network (TPN) has released its first TPN STAR Report, revealing systemic security vulnerabilities across the global entertainment supply chain. The report finds that while most organizations have security policies, inconsistent execution of basic technical controls, such as MFA and timely patching, is creating easily exploitable risks. TPN issued more security alerts in Q1 2026 than in all of 2025, driven by a surge in credential-based attacks and misconfigurations. The report calls for urgent action to strengthen identity protections and vulnerability management, especially within the complex web of third-party vendors used in modern productions.

GlassWorm Campaign Evolves, Uses Zig-Based Dropper to Infect All Developer IDEs

The ongoing GlassWorm cyber-espionage campaign has adopted a new, sophisticated tool: a dropper written in the Zig programming language. This new malware component was discovered hidden within a malicious Open VSX extension masquerading as a legitimate WakaTime activity tracker. The dropper's primary function is to stealthily infect all Integrated Development Environments (IDEs) installed on a compromised developer's machine. This technique allows the attackers to achieve deep, persistent access to the developer's workflow, posing a significant software supply chain risk by enabling the potential injection of malicious code into any project the developer touches.

Rituals Cosmetics Data Breach Exposes Personal Info of 'My Rituals' Members

Amsterdam-based luxury cosmetics company Rituals has confirmed a data breach impacting members of its 'My Rituals' loyalty program, which has over 40 million members. The company began notifying affected customers on April 22, 2026, after discovering the incident earlier in the month. Compromised data includes full names, addresses, phone numbers, email addresses, dates of birth, and gender. Rituals has assured customers that no passwords or financial information were exposed. The company has contained the breach, reported it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), and is working with external security specialists to monitor for the data's appearance on the dark web. Customers are advised to be cautious of potential phishing attacks leveraging their stolen personal information.

Germany Accuses Russia of Orchestrating Large-Scale Signal Phishing Attack on Politicians

The German government has officially stated its belief that Russia was behind a widespread and sophisticated phishing campaign targeting the Signal messenger accounts of hundreds of high-profile individuals. The targets included Members of Parliament, government officials, diplomats, and journalists. The attack, which has reportedly been stopped, aimed to take over accounts by tricking victims with messages pretending to be from Signal support. German prosecutors have launched an espionage investigation, and the incident marks a significant escalation in cyber tensions between Berlin and Moscow.

Microsoft Confirms Windows Shell Flaw (CVE-2026-32202) Is Actively Exploited

Microsoft has updated its advisory for CVE-2026-32202, a Windows Shell spoofing vulnerability, to confirm it is being actively exploited in the wild. The flaw, patched in the April 2026 Patch Tuesday, is the result of an incomplete fix for a previous vulnerability, CVE-2026-21510. That earlier flaw was weaponized by the Russian state-sponsored group APT28 (Fancy Bear) as part of an exploit chain, indicating sustained interest from sophisticated actors in this area of Windows.

Open Source Under Siege: Axios, Trivy, and LiteLLM Hit by Supply Chain Attacks

A series of sophisticated supply chain attacks in March and April 2026 compromised several widely used open-source developer tools, exposing the fragility of the software ecosystem. The Axios JavaScript library, with nearly 100 million weekly downloads, was compromised by a suspected North Korean actor who published malicious versions. In a separate campaign, the criminal group TeamPCP targeted the Trivy vulnerability scanner, deploying the SANDCLOCK credential stealer to harvest CI/CD secrets. These stolen secrets were then used to inject malware into other projects like KICS and LiteLLM, demonstrating a cascading supply chain compromise.

Critical Unpatched RCE Flaw in Hugging Face's LeRobot AI Platform Puts Robotics Systems at Risk

A critical, unpatched remote code execution (RCE) vulnerability, tracked as CVE-2026-25874 with a CVSS score of 9.3, has been discovered in Hugging Face's popular open-source robotics platform, LeRobot. The flaw stems from an insecure data deserialization practice using `pickle.loads()` over unauthenticated gRPC channels. An unauthenticated attacker on the same network can exploit this to execute arbitrary code on the host machine, posing a severe risk to AI and robotics systems that rely on the platform.

Singapore Plans Major Cybersecurity Overhaul, Mandating PQC and Expanding CII Oversight

Singapore is set to significantly strengthen its national cybersecurity posture with a series of regulatory updates announced by the government. The changes, to be rolled out over the next two years, will expand cybersecurity obligations to systems connected to Critical Information Infrastructure (CII), mandate Post-Quantum Cryptography (PQC) as the national standard, enhance rules for telecom operators, and broaden the adoption of the Cyber Trust Mark certification for government vendors and CII operators.

AI-Driven Attacks Fueling MSP Supply Chain Risk, Guardz Report Finds

A new report from cybersecurity firm Guardz reveals a grim reality for SMBs, with nine out of ten having compromised users, largely due to AI-accelerated attacks. The 2026 State of MSP Threat Report highlights a massive surge in losses from Business Email Compromise (BEC) and identifies the abuse of legitimate Remote Monitoring and Management (RMM) tools as the top endpoint threat. This trend creates a significant supply chain risk, as a single compromised MSP can lead to the breach of all its clients.

Checkmarx Details Supply Chain Attack Stemming from Trivy Scanner Vulnerability

Application security firm Checkmarx has provided a detailed timeline of a supply chain attack that began with the exploitation of a vulnerability in the Trivy scanner. The attack, which started on March 23, 2026, led to unauthorized access to Checkmarx's GitHub environment. Attackers published malicious code artifacts, exfiltrated data, and later leaked the stolen information on the dark web. The incident highlights the complex and cascading nature of modern software supply chain attacks.

Wisconsin Hospital Mile Bluff Medical Center Hit by Ransomware, Enters Downtime Procedures

Mile Bluff Medical Center in Mauston, Wisconsin, has confirmed it is recovering from a ransomware attack that occurred in April 2026. The attack encrypted files on the medical center's network, causing temporary disruptions to computer and phone systems. Clinical teams were forced to revert to established downtime procedures to ensure continuity of patient care while the incident is investigated and systems are restored.

Foxit PDF Reader Flaw (CVE-2026-5942) Could Lead to Information Disclosure

A use-after-free vulnerability, tracked as CVE-2026-5942, has been disclosed in affected versions of Foxit PDF Reader. The flaw, which requires a user to open a malicious file, can be exploited to disclose sensitive information from the system's memory. While rated with a CVSS score of 3.3, security researchers note that such vulnerabilities can potentially be chained with other exploits to achieve remote code execution. Foxit has released an update to address the issue.

UK's NCSC Unveils 'SilentGlass' Hardware to Block Cyberattacks via HDMI and DisplayPort

The UK's National Cyber Security Centre (NCSC) has announced its first-ever branded hardware security device, named 'SilentGlass'. Developed to counter a growing threat vector, the plug-and-play device protects against cyberattacks targeting vulnerable display connections like HDMI and DisplayPort. These connections can be exploited for espionage or as an entry point for network intrusion. SilentGlass works by creating a hardware-level block that ensures only video data can pass between a computer and its monitor, preventing any malicious data transmission. The NCSC developed the intellectual property and has licensed it to Goldilock Labs for manufacturing and global distribution. The device is already in use in UK government systems and is now commercially available.

CISA Discovers 'FIRESTARTER' Backdoor on Federal Cisco Firewall; Malware Survives Patches

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that a Cisco Firepower device at an unnamed federal agency was compromised with a new, sophisticated backdoor named FIRESTARTER. An Advanced Persistent Threat (APT) actor exploited two critical vulnerabilities, CVE-2025-20333 and CVE-2025-20362, to deploy the malware. The most alarming feature of FIRESTARTER is its persistence mechanism, which allows it to survive firmware updates and security patches by hooking into the device's core processing engine. The attackers used this persistent access to deploy a post-exploitation toolkit called LINE VIPER and re-entered the network months after the initial compromise.

APT28 Unleashes New 'PRISMEX' Malware on Ukraine and NATO Allies

The Russian state-sponsored group APT28 (aka Forest Blizzard) is deploying a new, previously undocumented malware suite named 'PRISMEX' in a widespread espionage campaign. According to Trend Micro, the campaign, active since September 2025, targets Ukraine and its NATO allies, including Poland, Romania, and Turkey. PRISMEX uses advanced techniques such as steganography to hide payloads in images, COM hijacking for persistence, and abuses legitimate cloud services for C2. The campaign targets strategic sectors like defense, government, and transportation. Notably, APT28 demonstrated its ability to weaponize vulnerabilities rapidly, potentially using CVE-2026-21513 as a zero-day before Microsoft issued a patch.

Iran-Affiliated Hackers Weaponize PLCs, Disrupting US Water and Energy Sectors

A joint advisory from the FBI and CISA warns that threat actors affiliated with Iran are actively exploiting internet-exposed Rockwell Automation programmable logic controllers (PLCs) to disrupt US critical infrastructure. The campaign, targeting water, energy, and government facilities, has resulted in operational disruptions and financial losses. Attackers are using legitimate Rockwell configuration software from overseas IPs to manipulate PLCs and HMI displays, leveraging the significant exposure of nearly 3,900 vulnerable devices in the US. The advisory urges immediate action to disconnect all industrial control systems from the public internet to mitigate this escalating threat.

Utility Tech Giant Itron Discloses Breach of Internal IT Network

Itron, a major American technology provider for energy and water utilities, has disclosed a cybersecurity incident in an SEC filing. The company reported on April 13, 2026, that an unauthorized third party had gained access to a segment of its internal IT systems. Upon discovery, Itron activated its incident response plan, involving external cybersecurity experts and notifying law enforcement. The company stated it has since removed the unauthorized access and has not observed further malicious activity. Crucially, Itron emphasized that customer-hosted systems, which are often part of critical infrastructure, were not affected. While the investigation is ongoing, Itron does not believe the incident will have a material impact on its operations or financial condition.

Trigona Ransomware Evolves, Using Custom Exfiltration Tool for Stealthier Data Theft

Affiliates of the Trigona ransomware group are increasing their sophistication by using a custom-built data exfiltration tool named 'uploader_client.exe'. This move, identified by Symantec's Threat Hunter Team, marks a tactical shift from using common, easily-detected utilities like Rclone. The new command-line tool is designed for speed, precision, and stealth, featuring capabilities like multi-threaded uploads, connection rotation to evade network monitoring, and granular file-type exclusion to focus on high-value data. The tool communicates with a hardcoded, attacker-controlled server and uses a shared key for authentication. This development indicates that Trigona's affiliates are becoming more technically proficient and are investing in custom tooling to improve their operational success and evade detection.

Hackers Impersonate IT on Microsoft Teams to Deploy 'SNOW' Malware

A newly identified threat actor, UNC6692, is conducting sophisticated attacks using a novel social engineering vector. As detailed by Google's Mandiant group, the attackers first create a distraction by flooding a target's inbox with spam emails. They then contact the victim via a Microsoft Teams chat from an external account, impersonating IT help desk staff offering to fix the spam issue. This pretext is used to lure the victim into visiting a phishing page and running a malicious script. This script initiates an infection chain that deploys the 'SNOW' malware ecosystem, which includes a JavaScript-based backdoor (SNOWBELT), a Python tunneler (SNOWGLAZE), and a persistent backdoor (SNOWBASIN). The malware is used for credential theft, data harvesting, and lateral movement.

US Cracks Down on Southeast Asia Cyberscam Networks, Sanctions Cambodian Senator

The U.S. government has launched a major, multi-agency crackdown on transnational cyberscam networks operating from Southeast Asia. The initiative, described as a 'new theater of war' against Chinese organized crime, involves sanctions, criminal charges, and asset seizures. The U.S. Treasury has sanctioned Kok An, a prominent Cambodian senator and businessman, labeling him a 'scam center kingpin,' along with 28 other individuals and companies. Simultaneously, the Department of Justice has filed criminal charges against two Chinese nationals in a related case and is seizing illicit assets and online recruitment channels. These scam operations, often involved in human trafficking, are responsible for billions of dollars in losses for victims worldwide, including nearly $21 billion from Americans in 2025 alone.

Cyber Sovereignty and Supply Chain Risk Become Top Concerns for Critical Infrastructure

Amid rising geopolitical tensions, the concepts of cyber sovereignty and supply chain security have become paramount for critical infrastructure operators. The recognition that any third-party vendor can be a weak link exploited by adversaries is driving a strategic shift away from cost-based sourcing to 'trust-driven sourcing'. Cyber sovereignty is being defined as the ability to operate and defend systems without reliance on technology beholden to a foreign adversary. This has led to increased regulatory scrutiny and a greater demand for transparency through mechanisms like the Software Bill of Materials (SBOM), which helps illuminate hidden dependencies in the software supply chain. Organizations are now treating supply chain security not as a compliance checkbox, but as a core component of operational resilience and strategic autonomy.

Critical Unauthenticated Path Traversal Flaw Found in CrowdStrike LogScale

CrowdStrike has patched a critical, unauthenticated path traversal vulnerability, CVE-2026-40050, in its self-hosted LogScale (formerly Humio) log management platform. The vulnerability, discovered internally by CrowdStrike, could allow a remote, unauthenticated attacker to read arbitrary files from the server's filesystem by exploiting a specific cluster API endpoint. This could lead to the exposure of sensitive data, including configuration files and credentials. Customers of the CrowdStrike-hosted LogScale SaaS are not affected, as the company has already applied mitigations. Self-hosted customers are urged to upgrade to a patched version immediately.

Microsoft's April Patch Tuesday Fixes 164 Flaws, Including Actively Exploited SharePoint Zero-Day

Microsoft has released its April 2026 Patch Tuesday update, a massive release that fixes 164 vulnerabilities across its product portfolio. The update includes patches for eight critical flaws and two zero-days. One zero-day, a spoofing vulnerability in Microsoft SharePoint Server (CVE-2026-32201), is confirmed to be actively exploited. The second zero-day (CVE-2026-33825) is a publicly disclosed privilege escalation flaw in Microsoft Defender. Other critical fixes address a 9.8 CVSS RCE in the IKE service and an 8.8 CVSS RCE in the Remote Desktop Client.

UK's NCSC Unveils 'SilentGlass' Hardware to Block Malware via HDMI and DisplayPort

The UK's National Cyber Security Centre (NCSC) has developed its first commercial hardware product, 'SilentGlass,' designed to physically prevent cyberattacks delivered through display cables. The small, plug-and-play device acts as a data diode for HDMI and DisplayPort connections, blocking any malicious data or malware from being transferred from a computer to a monitor or vice-versa. While attacks via display cables are rare, the NCSC considers monitors an attractive espionage target. The device's intellectual property has been licensed to Goldilock Labs for commercial production. SilentGlass has already been in use within the UK government for several years and is now available for purchase by businesses and consumers.

Adobe Scrambles to Patch Critical, Actively Exploited RCE Flaw in Commerce and Magento

Adobe has released an emergency, out-of-band security update for a critical remote code execution (RCE) vulnerability, CVE-2026-11234, affecting Adobe Commerce and Magento Open Source. The flaw, which has a CVSS score of 9.8, is being actively exploited in the wild. An unauthenticated attacker can exploit the vulnerability to execute arbitrary code and achieve a full server takeover. Security firm SwiftSentry reported that attackers are using the flaw to inject credit card skimming malware and install backdoors on compromised e-commerce sites. All administrators are urged to apply the patch immediately.

Global Wings Airline Breach Exposes Personal Data of 5 Million Passengers via Third-Party Vendor

Global Wings Airline has disclosed a major data breach affecting approximately 5 million of its passengers. The breach originated not within the airline's own systems, but from a third-party service provider responsible for managing the 'SkyMiles' loyalty program database. The exposed data includes sensitive personally identifiable information such as names, dates of birth, contact details, physical addresses, and passport numbers. The unauthorized access occurred over a nearly month-long period between March and April 2026. While financial data was reportedly not compromised, the stolen information is sufficient for identity theft and targeted phishing attacks.

APT 'ChronoDragon' Deploys New 'CoinThief' Backdoor in Financial Sector Espionage Campaign

The state-sponsored threat group 'ChronoDragon' is behind a new economic espionage campaign targeting major financial institutions in North America and Europe, according to a report from Mandiant. The advanced persistent threat (APT) actor is using a new, custom backdoor named 'CoinThief' to infiltrate banks, investment firms, and cryptocurrency exchanges. The campaign's primary goal is not direct financial theft but to steal sensitive data on market strategies, mergers and acquisitions, and proprietary trading algorithms. The attack begins with spear-phishing emails and leverages a sophisticated, stealthy backdoor to maintain long-term access and exfiltrate intelligence.

US Treasury Sanctions Crypto Exchange and Mixers for Laundering Ransomware Proceeds

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has taken decisive action against the financial infrastructure supporting cybercrime by sanctioning a virtual currency exchange, 'Cortexchange', and two cryptocurrency mixing services, 'ChainScrub' and 'HelixMix'. These entities were added to the Specially Designated Nationals (SDN) list for their role in laundering hundreds of millions of dollars for ransomware groups like LockBit and Qilin, as well as other illicit actors. The move blocks the entities from the U.S. financial system and prohibits any U.S. persons from transacting with them, aiming to disrupt the profitability of cybercrime.

Log4j Deja Vu: Critical RCE Flaw in 'LogSpresso' Library Averts Major Supply Chain Crisis

A potential Log4j-level crisis has been averted with the emergency patching of CVE-2026-23456, a critical (10.0 CVSS) remote code execution vulnerability in the popular open-source Java logging library 'LogSpresso'. Discovered by researchers at Checkmarx, the flaw was alarmingly similar to the infamous Log4Shell vulnerability, allowing an unauthenticated attacker to achieve RCE by sending a specially crafted string to be logged. Given LogSpresso's use in thousands of enterprise applications, the vulnerability posed a massive supply chain risk. Thanks to responsible disclosure and swift action by the library's maintainers, a patch was released before any evidence of in-the-wild exploitation emerged.

Cura360 HealthTech Startup Leaks 250,000 Patient Records via Public AWS S3 Bucket

A severe data leak at health-tech startup Cura360 has exposed the protected health information (PHI) and personal data of over 250,000 patients. The cause was a misconfigured Amazon Web Services (AWS) S3 bucket that was left publicly accessible, allowing anyone on the internet to view and download its contents. The exposed data is highly sensitive, including full names, addresses, insurance details, and detailed medical records such as X-rays, MRIs, and lab results. The incident, discovered by a security researcher, is a major breach of patient privacy and a likely violation of HIPAA regulations.

Researchers Detail 'GlacierRAT,' a New Modular Malware Targeting Linux Servers

Cybersecurity firm CrowdStrike has released a detailed report on 'GlacierRAT,' a new and sophisticated modular Remote Access Trojan (RAT) designed specifically to compromise Linux-based servers. The malware, which is being sold on dark web forums, targets the backbone of cloud and data center environments. GlacierRAT's modular architecture allows attackers to load various plugins for a wide range of activities, including data exfiltration, command execution, and launching DDoS attacks. It typically gains access by exploiting vulnerable web applications and establishes persistence through systemd services or cron jobs.

Qilin Ransomware Group Targets City of Napoleon, Ohio, Threatening Municipal Data Leak

The City of Napoleon, Ohio, has become the latest government entity to be targeted by the Qilin ransomware group. The group claimed responsibility for the cyberattack on April 23, 2026, adding the city to its data leak site. Qilin is employing a double extortion tactic, threatening to publish sensitive municipal data if the city does not enter into negotiations for a ransom payment. This incident highlights the persistent and escalating threat that ransomware poses to U.S. municipalities and critical local government services.

LockBit and ShinyHunters Claim Major Breaches at Citizens Bank, Canada Life, and Law Firm

Prominent threat groups LockBit and ShinyHunters have claimed responsibility for several high-profile data breaches, according to dark web monitoring services. The LockBit ransomware gang has allegedly exfiltrated and posted data from Bardehle Pagenberg, a major European patent law firm, raising alarms about the potential exposure of intellectual property. Concurrently, the data broker group ShinyHunters claimed a breach at Canada Life, a large insurance provider, while another group named Everest claimed an attack on Citizens Bank, a major U.S. retail bank. While the claims are still being verified, the history of these groups suggests a high probability of legitimacy, placing customers and clients of the affected organizations at significant risk of fraud and identity theft.

ADT Confirms Data Breach by ShinyHunters After Vishing Attack Compromises Okta and Salesforce

Home security giant ADT has confirmed a data breach orchestrated by the notorious ShinyHunters extortion group. The attackers gained initial access by compromising an employee's Okta single sign-on (SSO) account through a sophisticated voice phishing (vishing) attack. This access allowed them to pivot to ADT's Salesforce environment and exfiltrate a large volume of customer data. ShinyHunters listed ADT on its data leak site, claiming to have stolen 10 million records and threatening to release them if a ransom is not paid. ADT's investigation revealed that the compromised information includes names, phone numbers, addresses, and in some cases, dates of birth and the last four digits of Social Security numbers. The company has assured that no financial data or customer security system information was affected and is notifying all impacted individuals.

26 Malicious 'FakeWallet' Crypto Apps Found on Apple App Store, Stealing Seed Phrases

A coordinated malware campaign dubbed "FakeWallet" has been discovered on Apple's official App Store, involving 26 fraudulent applications that impersonated popular cryptocurrency wallets. Active since at least fall 2025, these malicious apps were designed to steal users' sensitive recovery phrases, seed phrases, and private keys. The campaign primarily targeted users in China, where many legitimate wallet apps are restricted, but posed a global risk. The apps, which mimicked well-known wallets like MetaMask and Coinbase, have since been removed by Apple following disclosure from Kaspersky researchers.

Indian Finance Minister Warns of AI-Driven Cyberattacks and Deepfakes Threatening Financial Markets

At the 38th Foundation Day of the Securities and Exchange Board of India (SEBI), Union Finance Minister Nirmala Sitharaman delivered a stark warning about the growing threat of sophisticated cyberattacks on India's financial markets. She highlighted the risks posed by AI-led attacks, deepfake videos used for investment fraud, and unlicensed 'fin-fluencers'. Sitharaman called for exceptional vigilance from the regulator and launched "Mission Jagrook," a nationwide investor awareness campaign to combat misinformation and protect the country's rapidly growing investor base.

Pre-Stuxnet Cyber Sabotage Malware 'fast16' Discovered, Dating Back to 2005

Security researchers at SentinelOne have unearthed 'fast16', a previously unknown malware framework from 2005 designed for industrial sabotage. This Lua-based malware predates the infamous Stuxnet worm by at least five years and was engineered to subtly manipulate the output of high-precision calculation software in engineering environments. The discovery rewrites the timeline of state-sponsored cyber-physical attacks, showing that the concepts behind digital weapons like Stuxnet were developed and deployed much earlier than previously thought.

Cherokee Federal Achieves CMMC Level 2 Certification, Preparing for Upcoming DoD Contract Requirements

Cherokee Federal, the federal contracting division of Cherokee Nation Businesses, has successfully achieved Cybersecurity Maturity Model Certification (CMMC) Level 2. This critical certification, which is aligned with NIST SP 800-171, validates the company's implementation of 110 rigorous security controls. The achievement, assessed by an authorized C3PAO, positions Cherokee Federal as a secure partner for the Department of Defense (DoD) and gives it a competitive advantage as the DoD begins to phase in CMMC Level 2 as a contract requirement starting in November 2026.

Coinbase Cartel Ransomware Group Claims Attack on Engineering Firm Aptim, Threatens Data Leak

The ransomware group known as 'Coinbase Cartel' has claimed responsibility for a cyberattack against Aptim, a U.S.-based engineering, program management, and construction firm. On April 23, the group posted the claim on its leak site, threatening to release confidential data if its ransom demands are not met. The attackers also included a technical detail—what appears to be a Kerberos pre-authentication hash—suggesting they may have compromised account credentials within Aptim's network through a Kerberoasting attack.

Actively Exploited SharePoint Zero-Day Prompts Urgent Patching

A critical spoofing vulnerability in Microsoft SharePoint Server, tracked as CVE-2026-32201, is being actively exploited in the wild. The flaw allows an unauthenticated remote attacker to view and modify information on targeted sites. Due to its active exploitation prior to Microsoft's April 2026 patch release, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent patching for federal agencies.

Apple Rushes Fix for iOS Flaw That Let FBI Recover Deleted Signal Messages

Apple has issued an emergency security update for iOS and iPadOS to address a significant privacy vulnerability, CVE-2026-28950. The flaw caused the operating system to improperly retain notifications from secure messaging apps like Signal, even after the messages and the app itself were deleted. The issue came to light following court documents revealing the FBI had successfully used forensic methods to recover supposedly deleted Signal message content from a defendant's iPhone. The vulnerability was not in Signal's encryption but in Apple's notification handling. The patch, included in iOS 26.4.2 and 18.7.8, resolves the issue by improving data redaction and ensures that previously retained notifications are deleted upon update.

Kyber Ransomware Debuts with Post-Quantum Encryption, Targeting Windows and ESXi

A new ransomware operation named 'Kyber' is targeting both Windows and VMware ESXi environments, but with a notable difference in its encryption schemes. Security firm Rapid7 discovered that the Rust-based Windows variant uses a hybrid encryption method employing Kyber1024, a post-quantum cryptography (PQC) algorithm, to protect the AES symmetric keys used for file encryption. This marks a significant, albeit currently tactical, evolution in ransomware development. In contrast, the Linux-based ESXi variant, despite claiming PQC usage in its ransom note, was found to use the traditional ChaCha8 cipher with RSA-4096 for key protection. The move is seen as a psychological tactic to intimidate victims, as current quantum computing capabilities do not threaten existing encryption standards. The group is already active, listing a U.S. defense contractor as a victim.

Ten Nations Warn of China-Linked Threat Actors Using Covert SOHO Botnets for Espionage

An international coalition of cybersecurity agencies from ten nations, including the U.S. NSA, CISA, and FBI, has issued a joint advisory on the evolving tactics of China-nexus threat actors. The advisory warns that these groups are increasingly leveraging large-scale 'covert networks' composed of compromised small office/home office (SOHO) routers, firewalls, and IoT devices. This tactic allows multiple state-sponsored groups to obfuscate their origins, making attribution difficult while conducting espionage and cyberattacks. The advisory specifically links the 'KV Botnet' to the Volt Typhoon group's attacks on U.S. critical infrastructure and notes that these botnets are dynamically managed, rendering static IP blocklists ineffective. The agencies urge organizations to harden edge devices, use strong credentials, and improve network traffic monitoring.

Tropic Trooper APT Targets Chinese Speakers with Trojanized PDF Reader, Uses GitHub for C2

The cyber-espionage group Tropic Trooper (also known as APT23 or Pirate Panda) has been linked to a new campaign targeting Chinese-speaking individuals in Taiwan, South Korea, and Japan. According to Zscaler's ThreatLabz, the attack, first seen in March 2026, uses a military-themed ZIP archive containing a trojanized version of the SumatraPDF reader. Upon execution, the malware displays a decoy document while deploying a multi-stage payload. This payload includes the TOSHIS loader and the AdaptixC2 Beacon, which uses GitHub issues and repository APIs for command and control. For high-value targets, the threat actors also leverage Microsoft Visual Studio Code tunnels to establish persistent remote access, showcasing a sophisticated approach to blending in with legitimate developer traffic.

NATO's Locked Shields 2026 Cyber Exercise Tests 4,000 Defenders Against 8,000 Live-Fire Attacks

The world's largest and most complex live-fire cyber defense exercise, Locked Shields 2026, has concluded in Tallinn, Estonia. Organized by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), the exercise involved over 4,000 participants from 41 NATO and partner nations. The multinational teams were tasked with defending the critical infrastructure of a fictional country against a barrage of approximately 8,000 real-time cyberattacks over several days. This year's scenario was expanded to include the defense of an electronic voting system for the first time, alongside traditional targets like power grids, 5G networks, and military systems. The exercise tests not only technical skills but also strategic decision-making, legal considerations, and crisis communication.

Celerium Launches 'DIB CyberDome' to Automate CMMC Compliance for Defense SMBs

Celerium has launched the DIB CyberDome, a cybersecurity platform tailored for the thousands of small and mid-sized businesses (SMBs) in the U.S. Defense Industrial Base (DIB). The platform is designed to help these contractors meet the complex requirements of the Cybersecurity Maturity Model Certification (CMMC) Level 2 and defend against advanced threats without the need for a large security team. Its core 'Cyber Interceptor' component provides continuous network boundary monitoring and automated threat blocking, re-optimizing every 15 minutes. This automates compliance with difficult CMMC controls that typically require expensive SIEM and SOAR solutions. The platform also features a collective defense system to share threat intelligence across the DIB ecosystem.

New 'GopherWhisper' APT Group Linked to China Targets Mongolian Government

ESET researchers have uncovered a previously unknown, China-aligned APT group named 'GopherWhisper.' Active since at least November 2023, the group was discovered targeting a Mongolian governmental institution with a sophisticated, Go-based malware toolkit. This toolset includes multiple backdoors like LaxGopher, RatGopher, and BoxOfFriends. A key characteristic of GopherWhisper is its extensive use of legitimate commercial services for command and control (C2) to evade detection. The LaxGopher backdoor uses a private Slack workspace, RatGopher uses Discord, and BoxOfFriends uses Microsoft Graph API to communicate via Outlook draft emails. This 'living off the trusted service' approach makes their C2 traffic extremely difficult to distinguish from legitimate user activity.

Mirai Botnet Exploits Critical Flaw in Discontinued D-Link Routers for DDoS Attacks

A new variant of the Mirai botnet is actively exploiting a year-old, high-severity command injection vulnerability (CVE-2025-29635, CVSS 8.8) affecting discontinued D-Link DIR-823X routers. According to Akamai, attackers are using the flaw to achieve remote code execution, download a shell script, and install a Mirai variant named 'tuxnokill.' This enlists the vulnerable, end-of-life devices into a botnet for launching DDoS attacks. The affected routers reached their end-of-life in November 2024 and no longer receive security patches from D-Link, leaving them permanently vulnerable. The campaign highlights the significant risk posed by unpatched IoT devices, as threat actors continuously scan for and exploit them to build their botnet armies.

UK Biobank Breach: Health Data of 500,000 Volunteers Found for Sale on Alibaba

The UK government has confirmed a severe data breach involving the UK Biobank, where de-identified but confidential health data from all 500,000 of its volunteers was listed for sale on e-commerce platforms owned by Alibaba. The breach originated from three Chinese research institutions that had legitimately downloaded the data for research purposes but subsequently leaked it. The UK government worked with Chinese authorities and Alibaba to remove the listings. While the data did not include direct identifiers like names or full addresses, the incident represents a major breach of trust and a failure of data governance by a trusted research partner. In response, UK Biobank has revoked access for the responsible institutions and temporarily suspended its entire research platform to implement stricter security controls, including restrictions on data downloads.

UK's NCSC Launches 'SilentGlass' Hardware to Block HDMI-Based Cyber Espionage

The UK's National Cyber Security Centre (NCSC) has developed a new hardware device called 'SilentGlass' to protect against cyberattacks transmitted through video display cables. Unveiled at the CYBERUK conference, the plug-and-play device secures HDMI and DisplayPort connections by ensuring only the video signal is transmitted, actively blocking any malicious or unexpected data. The NCSC highlighted that monitors are an attractive target as they can process and store sensitive data, yet their interfaces are often overlooked as a security boundary. The technology, already deployed in UK government systems, has been licensed to UK firm Goldilock Labs for global manufacturing and distribution in partnership with Sony UK Technology Centre, making high-assurance security available to commercial businesses.

Ransomware Shifts to Infrastructure: 73% of Attacks Exploit VPNs, At-Bay Reports

A new report from cyber insurance provider At-Bay reveals a dramatic shift in ransomware tactics, with attackers increasingly targeting core infrastructure like Virtual Private Networks (VPNs). The report, based on over 6,500 claims, found that a staggering 73% of ransomware incidents in 2025 initiated through a compromised VPN, a figure that has nearly doubled in two years. The Akira ransomware group was a major driver of this trend, accounting for over 40% of claims in At-Bay's dataset and heavily targeting SonicWall VPN appliances. The average ransom demand from Akira was $1.2 million, 50% higher than other groups. The report also highlights that smaller businesses were disproportionately affected and that technical controls like EDR alone were often insufficient, emphasizing the need for 24/7 managed detection and response (MDR).

Major US Cement Producer Taps Aria Cybersecurity to Protect Critical Plant Operations

Aria Cybersecurity, a business unit of CSPi, has announced an agreement to deploy its AZT PROTECT™ solution to secure the critical operational technology (OT) environments of a major, unnamed US cement producer. The cement industry is considered a high-value target for cyberattacks, including state-sponsored ransomware. The deployment follows successful lab testing and a plant pilot, where the solution demonstrated its ability to 'lock down' critical systems by preventing any unauthorized or malicious executables from running. A key feature for the selection was AZT PROTECT's ability to operate effectively without an internet connection or constant updates, making it ideal for protecting sensitive and often isolated OT systems from threats like unpatched vulnerabilities.

Actively Exploited Microsoft Defender Zero-Days 'RedSun' and 'UnDefend' Remain Unpatched

Threat actors are actively exploiting three zero-day vulnerabilities in Microsoft Defender, collectively known as BlueHammer, RedSun, and UnDefend. The exploits were publicly released by a security researcher in protest of Microsoft's disclosure process. While Microsoft patched BlueHammer (CVE-2026-33825) in its April Patch Tuesday, the RedSun privilege escalation and UnDefend denial-of-service flaws remain unpatched, leaving fully updated Windows 10, 11, and Server systems vulnerable. Security firm Huntress Labs has observed targeted, hands-on-keyboard attacks leveraging these exploits to gain SYSTEM-level privileges.

Anthropic's 'Mythos' AI Deemed Too Dangerous for Public Release After Finding Novel Exploits

AI safety company Anthropic has made the unprecedented decision to withhold its new AI model, Claude Mythos Preview, from public release, judging it too dangerous due to its powerful capabilities in cybersecurity. Reports on April 11, 2026, reveal that Mythos can quickly and easily discover high-severity, unknown vulnerabilities in major operating systems and browsers with simple prompts. Citing the risk of democratizing advanced hacking capabilities, Anthropic is instead sharing the model with a select group of 11 tech giants, including Google, Apple, and Microsoft, under a new initiative called 'Project Glasswing.' The goal is for these companies to use Mythos to proactively find and patch critical flaws in global digital infrastructure before such AI tools are weaponized by malicious actors.

Vercel Breach: Supply Chain Attack via AI Tool Exposes Customer Credentials

Web infrastructure provider Vercel has confirmed a significant security incident where a threat actor gained unauthorized access to internal systems by compromising a third-party AI tool, Context.ai. The attack, which began with a hijacked Google Workspace OAuth application, allowed the actor to pivot into Vercel's environment and access a limited subset of customer environment variables. Vercel has stated that variables marked as 'sensitive' were not accessed, but urges all customers to rotate any credentials stored in non-sensitive variables as a precaution. The incident highlights the growing risk of sophisticated supply chain attacks that exploit trust relationships and OAuth integrations to bypass traditional security perimeters.

Destructive 'Lotus Wiper' Malware Strikes Venezuelan Energy Sector

Researchers from Kaspersky have uncovered 'Lotus Wiper,' a new data-wiping malware used in targeted attacks against Venezuela's energy and utilities sector. The malware is purely destructive, designed to render systems inoperable by erasing recovery mechanisms, overwriting drive contents, and deleting files. The attack chain involves batch scripts and the abuse of legitimate Windows utilities, indicating the threat actor's sole intent was to cause maximum disruption without any financial motive.

Everest Ransomware Claims Attacks on Citizens and Frost Banks

The Everest ransomware gang has listed two major U.S. financial institutions, Citizens Financial Group and Frost Bank, on its dark web leak site. The group claims to have stolen sensitive customer data, including Social Security numbers and financial details, and has threatened to release it. Citizens Bank confirmed a breach involving a third-party vendor, stating that while some customer information was involved, most of the data was masked. The full impact on Frost Bank remains unconfirmed.

'BRIDGE:BREAK' Vulnerabilities Expose Thousands of Serial-to-IP Converters

Researchers at Forescout have discovered 22 vulnerabilities, collectively named 'BRIDGE:BREAK,' in popular serial-to-IP converters from Lantronix and Silex. These devices, which bridge legacy OT/ICS equipment to modern IP networks, are affected by flaws that could lead to remote code execution, authentication bypass, and device takeover. With nearly 20,000 such devices exposed online, the vulnerabilities pose a significant risk to critical industries like manufacturing, healthcare, and energy.

Google Patches Critical Prompt Injection Flaw in Antigravity IDE

Google has patched a critical vulnerability in its Antigravity IDE, an AI-powered development environment. The flaw allowed a prompt injection attack to achieve arbitrary code execution, bypassing the IDE's security sandbox. Researchers found that by injecting a specific flag into a file search tool, an attacker could trick the IDE into executing a malicious binary, highlighting the emerging security challenges in securing agentic AI systems.

Fake 'TradingClaw' Website Spreads 'Needle Stealer' Malware

A malware campaign is using a sophisticated lure—a fake website for an AI trading tool called 'TradingClaw'—to distribute 'Needle Stealer,' a potent info-stealing malware. The malware aims to harvest sensitive data from victims, including browser data, login sessions, and cryptocurrency wallets. The campaign uses DLL hijacking for evasion and a C2 panel with features planned for more advanced phishing, indicating an evolving threat to users in the financial trading and crypto spaces.

ENISA Updates Framework for National Cybersecurity Assessment

The European Union Agency for Cybersecurity (ENISA) has released version 2.0 of its National Capabilities Assessment Framework (NCAF). The updated framework and online tool provide a methodology for EU member states to assess the maturity of their National Cybersecurity Strategies (NCSS). Aligned with the new NIS2 Directive, NCAF 2.0 aims to help national authorities identify strengths, gaps, and priorities, thereby fostering a higher common level of cybersecurity across the EU.

ShinyHunters Breach at Canada Life Exposes Data of 70,000 Customers

Insurance giant The Canada Life Assurance Company has confirmed a data breach affecting up to 70,000 individuals after being targeted by the ShinyHunters extortion group. The attackers gained initial access through a compromised employee account. The stolen data, which includes full names, addresses, and annual income levels, primarily belongs to members of a single large corporate benefits plan. ShinyHunters had threatened to leak the data if a ransom was not paid by April 21, 2026. Canada Life has contained the incident and is offering credit monitoring to those affected.

Vercel Hit by Supply Chain Attack; ShinyHunters Claims Responsibility, Demands $2M

Cloud platform Vercel has confirmed a security breach stemming from a supply chain attack involving the compromise of a third-party AI tool, Context.ai. Attackers exploited a Vercel employee's Google Workspace account via a compromised OAuth token, gaining access to internal systems and non-sensitive environment variables. The threat actor group ShinyHunters has claimed responsibility for the attack, offering stolen Vercel data, including source code and access keys, for $2 million on a hacking forum. Vercel has stated that only a limited subset of customers were affected and has engaged Mandiant for incident response.

EU Proposes 'Cybersecurity Act 2.0' to Counter Hybrid Threats and Regulate ICT Suppliers

The European Commission has introduced a major legislative package, 'Cybersecurity Act 2.0,' aimed at significantly strengthening the European Union's defenses against rising cyber and hybrid threats. The proposal includes a revised Cybersecurity Act and targeted amendments to the NIS2 Directive. A key and potentially controversial element is the power for the Commission to designate third countries that pose a security risk and to impose restrictions on high-risk ICT suppliers from those countries, a clear move to address supply chain vulnerabilities and foreign interference. The new act also seeks to enhance the role of ENISA, the EU's cybersecurity agency, and streamline compliance for an estimated 28,700 companies by clarifying risk-management requirements under NIS2.

Ransomware Industrialized: Vect RaaS Partners with BreachForums and TeamPCP

The Vect ransomware-as-a-service (RaaS) group has formed a strategic alliance with the BreachForums cybercrime marketplace and the TeamPCP hacking group. This partnership aims to industrialize ransomware deployment by leveraging credentials from TeamPCP's supply chain attacks and recruiting affiliates on a massive scale through BreachForums. The collaboration has already resulted in confirmed attacks, with victims like Guesty and USHA International listed on Vect's leak site, representing a new, highly scalable model for RaaS operations.

Nearly 600,000 Patients Affected by Data Breaches at Three U.S. Healthcare Providers

Three U.S. healthcare providers have disclosed significant data breaches affecting a combined total of nearly 600,000 individuals. The North Texas Behavioral Health Authority reported a network intrusion impacting 285,000 people. In Illinois, Southern Illinois Dermatology disclosed a breach affecting 160,000, an incident previously claimed by the Insomnia ransomware group. Additionally, Saint Anthony Hospital in Chicago revealed a compromised email incident affecting 146,000. These events highlight the persistent targeting of the healthcare sector and the exposure of sensitive patient data.

Progress Patches Critical Command Injection Flaws in MOVEit WAF and LoadMaster

Progress Software has released patches for a suite of vulnerabilities in its Application Delivery Controller (ADC) products, including MOVEit WAF and LoadMaster. The patched flaws include several authenticated command injection vulnerabilities (CVE-2026-3517, CVE-2026-3519, CVE-2026-3518, CVE-2026-4048) that could lead to remote code execution. Additionally, a WAF policy bypass flaw (CVE-2026-21876) was addressed. While the command injection bugs require authentication, they pose a significant risk, allowing privileged users to execute arbitrary OS commands. Customers are urged to apply the updates immediately.

Qilin Ransomware Blinds Defenses with Advanced EDR Killer, Abusing Vulnerable Drivers

The Qilin ransomware group is using a sophisticated, multi-stage attack to neutralize endpoint security solutions before encrypting systems. According to analysis by Cisco Talos, the attack uses DLL side-loading and a "bring your own vulnerable driver" (BYOVD) technique to gain kernel-level access. By abusing a legitimately signed driver (`rwdrv.sys`), the malware manipulates kernel memory to unregister the monitoring callbacks of over 300 different EDR products, effectively blinding them. This advanced defense evasion highlights a significant escalation in ransomware tactics.

Gentlemen RaaS Expands with SystemBC Botnet for Covert Attacks

The Gentlemen ransomware-as-a-service (RaaS) operation is now leveraging the SystemBC proxy malware botnet to enhance its attacks, according to research from Check Point. Affiliates of the group have been observed deploying SystemBC to create covert SOCKS5 tunnels, hiding their C2 traffic and staging ransomware payloads. The associated botnet comprises over 1,570 compromised corporate systems. Gentlemen RaaS provides multi-platform lockers for Windows, Linux, and ESXi, and the addition of SystemBC to its toolkit signals a move towards more sophisticated and evasive attack methods.

Semperis Extends Purple Knight AD Security Tool to US Government Clouds

Semperis has announced that its free identity security assessment tool, Purple Knight, now fully supports Microsoft's Government Community Cloud High (GCC High) environments. This update allows U.S. federal agencies and defense contractors to scan their Entra ID tenants within the specialized, high-compliance cloud for misconfigurations and vulnerabilities. Purple Knight, which is recommended by the Five Eyes intelligence alliance, can now provide these organizations with a unified view of their security posture across both on-premises Active Directory and cloud-based Entra ID.

Ex-FBI Official Urges Terror Designations for Ransomware Gangs Attacking Hospitals

A former high-ranking FBI cyber official, Cynthia Kaiser, has called for the U.S. government to consider designating ransomware groups that target hospitals as terrorist organizations. In testimony before the House Homeland Security Committee, she argued that such attacks, which knowingly disrupt critical patient care, could fall under existing counter-terrorism legal frameworks like Executive Order 13224. Kaiser also proposed exploring homicide charges under the federal felony murder rule in cases where a ransomware attack directly leads to a patient's death, signaling a major potential escalation in the legal fight against cybercrime.

CISA Mandates Urgent Patching for Eight Actively Exploited Flaws in Cisco, JetBrains, and More

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding eight new security flaws affecting a range of enterprise products. The vulnerabilities, found in software from Cisco, PaperCut, JetBrains, Kentico, Quest, and Synacor, are confirmed to be under active exploitation. This action mandates that Federal Civilian Executive Branch (FCEB) agencies apply patches by a specified deadline to mitigate significant risk. The additions include critical issues such as improper authentication, path traversal, and exposure of sensitive information, highlighting a persistent threat to both public and private sector networks. CISA strongly advises all organizations to prioritize the remediation of these vulnerabilities to defend against ongoing cyberattacks.

Attackers Exploit Flaws Weeks Before CVEs Are Published, Report Finds

A new report from internet intelligence firm GreyNoise reveals a concerning trend: significant spikes in scanning and exploitation activity for software vulnerabilities often occur weeks, and sometimes over a month, before the flaws are publicly disclosed. The research, analyzing traffic from late 2025 to early 2026, found that approximately half of the observed activity surges were followed by a corresponding CVE disclosure within three weeks. High-profile examples include vulnerabilities in Cisco, VMware, and MikroTik products being exploited 39, 36, and 24 days respectively before public announcement. This 'pre-disclosure' exploitation gives attackers a significant head start and suggests that monitoring for anomalous network traffic can serve as a crucial early warning system for defenders, enabling proactive defense even before patches are available.

Sophisticated 'DarkSword' iPhone Zero-Day Exploit Found For Sale on Hacked Ukrainian Websites

A sophisticated, fileless iPhone zero-day exploit framework named 'DarkSword' has been discovered hosted on two compromised Ukrainian websites, including the official site of the Seventh Administrative Court of Appeals. A joint investigation by iVerify, Lookout, and Google's Threat Intelligence Group uncovered the framework, which is described as 'cleanly organized' and designed for easy repurposing and distribution. The exploit affects a wide range of iPhone models and its fileless nature makes it extremely difficult to detect. Most alarmingly, the framework appeared to be for sale to any interested buyer, posing a severe threat to high-risk individuals like journalists, activists, and government officials worldwide who rely on iPhones for secure communication.

Columbia Bank Discloses Three-Month Data Breach After Unauthorized System Access

Columbia Bank, a prominent financial institution in the Western U.S., has begun notifying customers of a prolonged data breach that occurred in late 2025. According to notification letters, an unauthorized third party had access to certain internal bank applications from October 2 to December 22, 2025. After discovering the intrusion, the bank hired an external forensics firm, but the investigation to determine the full scope of compromised data was not completed until March 6, 2026. This significant delay between the incident and notification has raised concerns. While the bank has not publicly detailed the specific data types exposed, the lengthy access period suggests a risk of exposure for sensitive personal and financial information. Attorneys are now investigating the incident for a potential class-action lawsuit.

Tennessee Hospital Notifies 337,000 Patients of Data Breach, Nine Months After Rhysida Ransomware Attack

Cookeville Regional Medical Center (CRMC) in Tennessee has begun notifying 337,917 individuals that their sensitive personal and medical data was stolen in a ransomware attack that occurred in July 2025. The notification letters, sent out nine months after the breach, confirm an attack by the Rhysida ransomware group. In August 2025, Rhysida claimed responsibility on its dark web leak site, stating it had stolen 500GB of data, including over 370,000 files. The compromised information is highly sensitive, potentially including Social Security numbers, financial details, and medical records. Despite the group's attempt to sell the data and later leaking it for free, the hospital stated it has 'no evidence' of data misuse, a claim met with skepticism by security experts. CRMC is offering 12 months of identity protection services.

Massive Basic-Fit Data Breach Exposes Personal and Financial Data of 1 Million Members

Basic-Fit, Europe's largest fitness chain, has admitted to a massive data breach affecting approximately one million members across several European countries. The compromised data includes sensitive personal information such as full names, addresses, phone numbers, and bank account details. The attack targeted the system used for member visit registration. While the company claims its monitoring tools detected and stopped the intrusion 'within minutes,' the attackers had already exfiltrated a large volume of data. Basic-Fit has notified the Dutch Data Protection Authority and is in the process of informing affected members, who now face a significant risk of targeted phishing campaigns and financial fraud.

Microsoft's Colossal April 2026 Patch Tuesday: 167 Flaws Patched, Two Zero-Days Under Fire

Microsoft has released one of its largest security updates ever for April 2026, patching 167 vulnerabilities across its product ecosystem. The update is critically important, as it addresses two zero-day vulnerabilities: an actively exploited spoofing flaw in SharePoint Server (CVE-2026-32201) which has been added to CISA's KEV catalog, and a publicly disclosed privilege escalation flaw in Microsoft Defender (CVE-2026-33825). The update also fixes eight critical vulnerabilities, including a near-perfect CVSS 9.8 RCE flaw in the Windows IKE Service (CVE-2026-33824), underscoring the urgent need for organizations to apply these patches immediately.

Anthropic's "Claude Mythos" AI Discovers Thousands of Zero-Days, Public Release Withheld Over Security Risks

Artificial intelligence firm Anthropic has announced that its unreleased frontier model, 'Claude Mythos Preview,' has autonomously discovered thousands of high-severity zero-day vulnerabilities in major operating systems and software. Due to the immense security risks, the model is being withheld from public release. Instead, Anthropic has launched 'Project Glasswing,' a coalition with tech giants including Amazon Web Services, Apple, Google, and Microsoft, to use the AI for defensive purposes to secure critical software. The model has already identified decades-old flaws, including a critical remote code execution vulnerability (CVE-2026-4747) in FreeBSD's NFS server, fundamentally altering the landscape of vulnerability discovery.

Shinyhunters Ransomware Targets Zara and Aman Resorts with Data Theft Claims

The Shinyhunters ransomware group has resurfaced, claiming responsibility for cyberattacks against luxury hotel chain Aman Resorts and global fashion retailer Zara. On April 19, 2026, the group alleged it had stolen over 500,000 Salesforce records containing PII from Aman Resorts and compromised Zara's Google BigQuery data, attributing the latter to a vulnerability in the Anodot.com platform. Shinyhunters has issued a 'Pay or Leak' ultimatum to both companies, setting an April 21 deadline to establish contact before the allegedly stolen data is published. These claims, if verified, represent significant data breaches at two major international brands.

Investigation Launched into P3 Global Intel Breach Exposing 8 Million+ Sensitive Law Enforcement Tips

The law firm Edelson Lechtzin LLP has initiated an investigation into a massive data breach at P3 Global Intel, a cloud platform used by law enforcement and schools for managing anonymous safety tips. The breach, which reportedly occurred around March 18, 2026, involved a hacker exfiltrating 93 GB of data, including over 8 million sensitive tip records. The compromised information could contain personal details of individuals named in the tips and potentially the informants themselves, placing them at high risk of identity theft, fraud, and physical harm. The law firm is exploring a class action lawsuit to seek remedies for those affected by this severe compromise of sensitive public safety data.

Germany Unmasks Key REvil and GandCrab Ransomware Suspects

German law enforcement has publicly identified two Russian nationals, Daniil Shchukin (alias 'UNKN') and Anatoly Kravchuk, as key figures in the notorious REvil and GandCrab ransomware operations. The pair is allegedly responsible for at least 24 attacks, extorting approximately $2.3 million and causing an estimated $40 million in damages. This public identification is part of a wider European effort to dismantle Russian cybercrime networks. While the REvil group was officially dismantled in 2021, many of its members remain at large, and legal proceedings in Russia against such suspects have reportedly stalled, highlighting the challenges of international cybercrime prosecution.

Healthcare Breach: Aligned Orthopedic Partners Exposes SSNs, Medical and Financial Data

Aligned Orthopedic Partners has begun notifying patients about a data breach that occurred in late 2025. An unauthorized actor had access to the healthcare provider's corporate email system for a full month, between November 16 and December 16, 2025. An investigation confirmed that a vast amount of sensitive patient data may have been exposed, including names, Social Security numbers, driver's license numbers, financial account details, and extensive Protected Health Information (PHI). The exposed PHI includes medical diagnoses, treatment information, prescriptions, and health insurance data. The company is now offering identity protection services to affected individuals.

Sanctioned Crypto Exchange Grinex Halts Operations After $13.74M Hack

Grinex, a Kyrgyzstan-based cryptocurrency exchange sanctioned by the U.S. and U.K., is suspending all operations following a hack that resulted in the theft of over $13.74 million. The attack, which occurred around April 15, 2026, saw thieves steal Tether (USDT) and immediately swap it for non-freezable assets like TRX and ETH to launder the funds. Blockchain analytics firms TRM Labs and Chainalysis tracked the 'frantic swapping' of assets to evade freezing. Grinex has controversially blamed the attack on Western intelligence agencies, claiming the sophistication points to a state-level actor aiming to undermine Russia's financial sovereignty. A related exchange, TokenSpot, was also hit in a smaller, simultaneous attack.

Ransomware Attacks Surge in Q2 2026, Black Nevas Group Leads Latest Wave

Real-time threat intelligence from PurpleOps indicates that ransomware attacks are continuing at an alarming pace in the second quarter of 2026. A total of 456 victims have been reported for the quarter so far, bringing the year-to-date total to 3,077. In a single 24-hour period, 23 new victims were posted on leak sites, with the Black Nevas ransomware group being the most active, claiming 9 of the attacks. Other active groups included CoinbaseCartel and Blackwater. The attacks were geographically widespread, hitting the United States, India, Turkey, and Germany, and targeted industries such as Manufacturing, Real Estate, and Healthcare, demonstrating the indiscriminate nature of these campaigns.

Cybersecurity Consulting Demand Surges as Cybercrime Losses Top $10.5 Trillion

A new report highlights the surging demand for expert cybersecurity consulting services as businesses grapple with an increasingly hostile digital landscape and a persistent global talent shortage. With cybercrime losses estimated to have reached a staggering $10.5 trillion in 2025 and human error remaining a primary cause of breaches, organizations are shifting from a reactive to a proactive security posture. This has fueled the need for specialized expertise in areas like threat modeling, detection engineering, and strategic cyber resilience to ensure business survival and operational continuity in the face of inevitable attacks.

Phishing Campaign Abuses Legitimate SimpleHelp RMM Tool via Fake DHL 'Shipment Arrived' Emails

A new phishing campaign is targeting businesses with convincing emails impersonating the shipping company DHL. The emails, with subject lines like 'Your shipment has arrived,' trick recipients into opening a malicious PDF attachment. Clicking a button within the PDF downloads a Windows screensaver file (.scr) which is a disguised installer for SimpleHelp, a legitimate remote monitoring and management (RMM) tool. The installer is pre-configured to connect to an attacker-controlled server, effectively giving the threat actors a persistent backdoor into the victim's network for further malicious activity.

New 'ZionSiphon' Malware Specifically Targets Israeli Water Infrastructure for Sabotage

Security researchers have analyzed ZionSiphon, a new malware strain specifically engineered to target Israeli water infrastructure. The malware, which explicitly references Israel's national water company and major desalination plants, combines data exfiltration and reconnaissance features with capabilities designed for sabotage of industrial control systems (ICS). ZionSiphon can propagate via USB drives to infect air-gapped networks and contains logic to tamper with critical processes like chlorine levels and water pressure, highlighting a dangerous trend of politically motivated attacks on critical OT environments.

UAC-0247 Espionage Campaign Targets Ukrainian Government and Healthcare with Data-Stealing Malware

The Computer Emergency Response Team of Ukraine (CERT-UA) is warning of an ongoing cyber-espionage campaign by the threat actor UAC-0247. Active since March 2026, the campaign targets Ukrainian government bodies and healthcare facilities with phishing emails. The attack uses a multi-stage infection chain involving LNK and HTA files to deploy a data-stealing payload that injects into legitimate processes like RuntimeBroker.exe. The malware, similar to the RAVENSHELL backdoor, is designed to exfiltrate data from web browsers and the WhatsApp desktop application.

McGraw Hill Data Breach Exposes 13.5 Million Accounts After Salesforce Misconfiguration

Educational publishing giant McGraw Hill has confirmed a significant data breach exposing the personal information of 13.5 million unique email accounts. The incident was caused by a misconfigured webpage hosted on the Salesforce platform. The cybercrime group 'ShinyHunters' claimed responsibility, initially threatening to leak 45 million records before publicly distributing a 100GB dataset containing names, physical addresses, and phone numbers. The breach highlights the critical risk of supply chain and third-party platform security, as McGraw Hill's core internal systems were not compromised.

New 'NBLOCK' Ransomware Emerges, Using AES-256 Encryption and Tor for Anonymous Extortion

Security researchers at CYFIRMA have identified a new ransomware family named 'NBLOCK.' The malware encrypts victim files using AES-256, appends a '.NBLock' extension, and drops a ransom note named 'README_NBLOCK.txt'. Unlike some modern ransomware that focuses on data exfiltration, NBLOCK appears to be a more traditional file-encrypting strain, coercing victims to pay for a decryption key. All communication with the threat actors is handled through an anonymous Tor-based negotiation portal. Its distribution vectors are believed to be standard methods like phishing and malicious downloads.

Stealthy 'PowMix' Botnet Targets Czech Workforce with Evasive C2 Communications

Researchers at Cisco Talos have uncovered a new botnet named 'PowMix,' which has been targeting the workforce in the Czech Republic since at least December 2025. The malware is delivered via phishing emails containing malicious LNK files and uses PowerShell for in-memory execution. PowMix is designed for stealth, employing randomized command-and-control (C2) beaconing intervals and embedding encrypted data into URL paths to mimic legitimate API traffic and evade network signature-based detection. The campaign targets professionals in HR, legal, and recruitment with compliance-themed lures.

Mozambique Passes Sweeping Cybersecurity and Cybercrime Laws to Combat Rising Digital Threats

Mozambique's Parliament, the Assembly of the Republic, has approved two landmark laws to establish a national cybersecurity framework and combat cybercrime. The legislation comes in response to a sharp increase in cyberattacks, with over 173,000 incidents recorded in 2024. The new framework will create a national regulatory authority, mandate specific security measures for both public and private sector entities, and introduce fines for non-compliance. The move is a significant step in securing the nation's digital infrastructure and aligning with international standards.

Two U.S. Senior Care Providers Disclose Data Breaches by Sinobi and Worldleaks Ransomware Gangs

Two providers of senior care services, Windward Life Care in California and Legend Senior Living in Kansas, have disclosed data breaches resulting from ransomware attacks that occurred in 2025. The ransomware groups Sinobi and Worldleaks have claimed responsibility, respectively. Both incidents involved data exfiltration followed by encryption, with the stolen data later being leaked on the dark web. The compromised information is highly sensitive, including names, Social Security numbers, financial data, and protected health information (PHI) of a vulnerable population.

Critical 'NomShub' Vulnerability in Cursor AI Editor Allows for Complete Developer Machine Hijacking

A critical set of vulnerabilities in the Cursor AI coding editor, collectively named 'NomShub' by researchers at Straiker, could allow an attacker to gain full remote shell access to a developer's machine. The attack requires no user interaction beyond the victim opening a malicious code repository in the editor. The vulnerability chain combines a prompt injection with a command sandbox bypass, allowing the attacker to write malicious code and then abuse Cursor's remote tunnel feature for RCE. The attack is particularly stealthy as it routes traffic through legitimate Microsoft Azure infrastructure.

Iranian APTs Target US Critical Infrastructure, Exploiting Internet-Exposed Rockwell PLCs

A coalition of U.S. federal agencies, including CISA, the FBI, and the NSA, has issued a joint advisory (AA26-097A) warning of ongoing disruptive attacks by Iranian-affiliated APT actors against U.S. critical infrastructure. The campaign specifically targets internet-connected operational technology (OT) devices, with a focus on Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs). These attacks have already caused operational disruptions in the Water and Wastewater Systems (WWS) and energy sectors. The threat actors, known by aliases such as Hydro Kitten and Storm-0784, are manipulating the PLCs to disrupt industrial processes. The advisory strongly urges organizations to disconnect OT devices from the public internet and apply hardening measures recommended by Rockwell Automation to prevent further compromises.

Researcher Leaks 'BlueHammer' Windows Zero-Day Exploit on GitHub After Dispute with Microsoft

A security researcher has publicly released a functional proof-of-concept exploit on GitHub for an unpatched Windows zero-day vulnerability dubbed 'BlueHammer.' The exploit, released following a dispute with the Microsoft Security Response Center (MSRC), allows a local attacker with low privileges to escalate to full SYSTEM-level privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The vulnerability is a logic bug, not a memory corruption flaw, making it difficult to patch and leaving billions of users exposed until Microsoft releases an official fix.

Booking.com Warns Customers of Data Breach Exposing Reservation Details and Personal Info

Online travel giant Booking.com has confirmed a data breach, notifying an undisclosed number of customers that their personal and reservation data were accessed by unauthorized parties. The compromised information includes names, contact details, addresses, and specific booking details, including any notes shared with accommodation providers. The company has stated that financial data and customer accounts were not compromised. In response, Booking.com has reset the PINs for all affected reservations. While the company claims the issue is 'fully contained,' this incident exposes customers to a significant risk of highly convincing and targeted phishing attacks, as criminals can use the detailed booking information to craft credible scams.

Critical Auth Bypass in nginx-ui (CVE-2026-33032) Actively Exploited for Full Nginx Takeover

A critical authentication bypass vulnerability (CVSS 9.8), tracked as CVE-2026-33032, in the open-source nginx-ui management tool is being actively exploited in the wild. The flaw, codenamed 'MCPwn,' allows an unauthenticated attacker to gain complete control of the underlying Nginx service by sending requests to an improperly secured API endpoint. Successful exploitation enables attackers to modify Nginx configurations, intercept traffic, and achieve remote code execution. Users are urged to update to version 2.3.4 or later immediately.

Ransomware Market Consolidation: Qilin, Akira, and DragonForce Dominate March 2026 Attacks

The ransomware ecosystem is showing significant consolidation, with a new report from Check Point revealing that just three groups—Qilin, Akira, and DragonForce—were responsible for 40% of all publicly claimed attacks in March 2026. Qilin led the pack, accounting for 20% of incidents, followed by Akira at 12% and DragonForce at 8%. This concentration of power in a few highly active Ransomware-as-a-Service (RaaS) and 'cartel' operations highlights a trend towards more organized and impactful threat groups, even as the total number of active gangs remains high. The report underscores the continued focus on high-value sectors like business services and manufacturing.

Massive Hospitality Breach: 5 Million Guests' Data Exposed via Leaky Server Tied to Chekin, Gastrodat

A significant data breach in the hospitality industry has exposed the personal and booking information of nearly 5 million travelers. Researchers from Cybernews discovered an unprotected server operated by an unknown threat actor, which contained 6.5GB of data harvested from Chekin, a Spanish check-in service, and Gastrodat, an Austrian hotel management provider. The data, scraped using compromised hotel accounts, includes full names, contact information, dates of birth, and detailed booking records, placing millions of individuals at high risk of targeted phishing and social engineering attacks.

Readiness Reality Check: 73% of CISOs Admit They Are Unprepared for a Major Cyberattack

A new report from cybersecurity firm Sygnia paints a grim picture of enterprise cyber readiness. Despite 99% of organizations having a formal incident response (IR) plan, nearly three-quarters (73%) of senior security leaders feel their organization is not adequately prepared to handle a major cyberattack. The survey of over 600 leaders points to organizational friction, lack of senior leadership involvement, and legal delays as key obstacles. With 76% of firms hit by an attack in the past year, the gap between planning and operational confidence is a critical business risk.

Adware with Fangs: 25,000 Systems Exposed to $10 Supply Chain Hijack by Dragon Boss Solutions

Security firm Huntress has exposed a dangerous operation where adware signed by 'Dragon Boss Solutions' went far beyond typical potentially unwanted programs (PUPs). The software, found on over 25,000 endpoints, used SYSTEM privileges to disable antivirus products and establish persistence. Critically, it used an unregistered domain for updates, `chromsterabrowser[.]com`, which could have been purchased for $10 by any attacker to push ransomware or other malware to all infected systems, including those in government, healthcare, and critical infrastructure networks. Huntress defensively registered the domain to prevent a widespread supply chain attack.

Barracuda Warns of Rapid Qilin Ransomware and Spike in Brute-Force Attacks from Middle East

Barracuda's April 2026 SOC Threat Radar report reveals two alarming trends: a massive spike in brute-force authentication attacks against SonicWall and FortiGate devices, with 88% originating from the Middle East, and the incredible speed of the Qilin ransomware group. The report highlights that modern ransomware gangs like Qilin can compromise and disrupt an entire organization in minutes, not days. Barracuda urges organizations to strengthen remote access security with MFA and strong passwords to defend against these parallel threats.

Black Shrantac Ransomware Targets Industrial Sector with Double Extortion and Living-off-the-Land Tactics

A new analysis from Marlink details the operations of the Black Shrantac ransomware group, a threat actor active since September 2025. The group employs a double extortion strategy, exfiltrating sensitive data before encrypting systems. They have been observed exploiting critical vulnerabilities like the PAN-OS flaw (CVE-2024-3400) for initial access and heavily rely on legitimate administrative tools and living-off-the-land (LOTL) techniques to evade detection while moving through victim networks, posing a significant risk to industrial and corporate environments.

Springfield Hospital Data Breach Exposes Patient Info, Triggers Class-Action Lawsuit Probe

Springfield Hospital in Vermont has notified patients of a data breach that occurred after an employee's email account was compromised. The incident, discovered in December 2025, exposed sensitive patient information including names, Social Security numbers, medical record numbers, and reasons for medical visits. The investigation concluded in February 2026, and notifications are now being sent to affected individuals. The breach has already attracted the attention of law firms, which are investigating the possibility of a class-action lawsuit against the hospital.

UK Civil Service Pension Scheme Suffers Data Breach Under Capita's Troubled Administration

The UK's Civil Service Pension Scheme (CSPS) has suffered a data breach under the administration of outsourcer Capita. On March 30, a technical glitch on the scheme's online portal allowed 138 members to view or download the Annual Benefit Statements of other members. The incident, which Capita said lasted for 35 minutes, has been reported to the Information Commissioner's Office (ICO). This breach adds to a series of 'serious issues' and performance failures that have plagued Capita's management of the pension scheme since it took over the contract in late 2025.

Mirax Android RAT Infects 220,000+ Devices via Meta Ads, Sold as Exclusive MaaS

A new Android Remote Access Trojan (RAT) named Mirax is being distributed through malicious advertisements on Meta's platforms, including Facebook and Instagram, primarily targeting Spanish-speaking users. Researchers at Outpost24 report that the malware has infected over 220,000 devices. Mirax gives attackers full remote control and turns the infected device into a SOCKS5 proxy to anonymize other malicious traffic. The malware is being sold as a private, high-end Malware-as-a-Service (MaaS) on underground forums, with subscriptions starting at $2,500.

Booking.com Breach Exposes Traveler Data, Fueling Fears of Targeted Scams

Global travel giant Booking.com has confirmed a data breach that exposed sensitive customer booking information. Unauthorized third parties gained access to data including customer names, contact details, and specific reservation details. While the company states financial data was not compromised, the stolen information is highly valuable for crafting sophisticated and convincing phishing attacks against travelers. Booking.com has taken steps to secure affected reservations by updating PINs and is notifying impacted users, urging them to be cautious of fraudulent communications that may leverage their legitimate travel plans.

Open-Source Devs Targeted in Sophisticated Phishing Attack Using Slack and Google Sites

A sophisticated social engineering campaign is targeting open-source developers on Slack, with attackers impersonating a Linux Foundation official to gain trust. Victims are lured to a fake login page hosted on Google Sites to harvest their credentials. The attack then escalates by tricking the developer into installing a fake 'security certificate,' which is a malicious root certificate enabling the attacker to intercept encrypted traffic. The campaign, which targets members of prominent projects like CNCF, highlights the increasing focus of threat actors on compromising developers as a gateway into the software supply chain.

OneDigital Discloses Supply-Chain Breach from 2025, 28,000 Individuals Impacted

Financial advisory firm OneDigital Investment Advisors has disclosed a data breach that occurred in August 2025, impacting 28,414 individuals. The incident was a supply-chain attack stemming from a vulnerability in the Drift online chat application, which was integrated into their former CRM platform, Salesloft. The breach, which exposed sensitive data including names and Social Security numbers, was discovered after their current CRM provider, Salesforce, alerted them. The significant delay between the breach in August 2025 and the notification in April 2026 highlights the complex and often delayed discovery process in supply-chain security incidents.

Hack-for-Hire Espionage Campaign Linked to BITTER APT Targets Phones in MENA Region

A large-scale, long-running cyber-espionage campaign is targeting journalists, activists, and officials, primarily in the Middle East and North Africa (MENA) region. The 'hack-for-hire' operation, linked by researchers to the BITTER APT group, uses sophisticated phishing and social engineering rather than zero-day exploits. Attackers use fake login pages to steal Apple ID credentials and deploy spyware disguised as legitimate apps on Android devices. The goal is espionage, with the attackers offering surveillance services to clients. The campaign highlights the continued effectiveness of credential phishing for compromising even high-value targets.

Utah Surgical Practice Data Leaked by 'PEAR' Ransomware; 50,000 Patients' SSNs and Financial Info Exposed

Rocky Mountain Associated Physicians (RMAP), a Utah-based surgical practice, has reported a data breach affecting 50,640 patients. A threat group calling itself 'PEAR' (Pure Extortion and Ransom) has claimed responsibility, and after its ransom demands were not met, it leaked the stolen data on the dark web. The compromised information is highly sensitive, including patient names, Social Security numbers, medical diagnoses, and in some cases, debit/credit card numbers with PINs. The public release of this data places affected patients at extreme risk of identity theft and fraud.

CISA KEV Update: Six Flaws Added, Including Critical Fortinet SQLi and Adobe RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active attack. The list includes a critical SQL injection flaw in Fortinet FortiClient EMS (CVE-2026-21643) with a 9.1 CVSS score, and an older but still targeted use-after-free bug in Adobe Acrobat Reader (CVE-2020-9715). Federal agencies are mandated to patch these flaws by April 27, 2026, and CISA strongly urges all organizations to prioritize these updates to defend against ongoing threats.

Microsoft 365 Admins Locked Out of Tenant After Attacker Removes All Global Admin Roles

An organization has reported a 'business-critical security incident' after a malicious actor gained access to their Microsoft 365 tenant and systematically removed the 'Global Administrator' role from all assigned user accounts. This action resulted in a complete administrative lockout, preventing legitimate administrators from accessing the Microsoft 365 Admin Center and Microsoft Entra ID. The attack highlights a potent technique where attackers, after compromising a single privileged account, can cement their control and prevent remediation by decapitating the tenant's administrative structure. The organization is now reliant on Microsoft's Data Protection team to verify ownership and restore access.

CISA Mandates Federal Agencies Patch Actively Exploited Ivanti EPMM Flaw by April 11

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical code injection vulnerability in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1340, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which has a CVSS score of 9.8, allows for unauthenticated remote code execution and is confirmed to be actively exploited in the wild. CISA has issued a directive requiring all federal civilian agencies to apply patches by April 11, 2026, and strongly urges all organizations using the affected product to remediate immediately.

Marimo RCE Flaw Exploited in Under 10 Hours of Public Disclosure

A critical, unauthenticated remote code execution (RCE) vulnerability in the Marimo Python notebook, CVE-2026-39987, was exploited in the wild just 9 hours and 41 minutes after its public disclosure on April 8, 2026. The flaw, which has a CVSS score of 9.3, allows an unauthenticated attacker to gain a full interactive shell on the server running the notebook. Security firm Sysdig observed an attacker developing a working exploit directly from the advisory's technical details and using it to steal credentials, demonstrating the rapidly shrinking window between vulnerability disclosure and exploitation.

Critical 13-Year-Old RCE Flaw in Apache ActiveMQ (CVE-2026-34197) Actively Exploited

A critical remote code execution (RCE) vulnerability, CVE-2026-34197, has been discovered in Apache ActiveMQ Classic and is under active exploitation. The flaw, which has reportedly existed for 13 years, allows an authenticated attacker to execute arbitrary code by abusing the Jolokia JMX-HTTP bridge. The risk is severely amplified as this flaw can be chained with a separate vulnerability, CVE-2024-32114, which removes authentication requirements from the API endpoint, allowing for unauthenticated RCE. Apache has released patches, and administrators are urged to update immediately to versions 6.2.3 or 5.19.4 to prevent system compromise.

Massive 7.7TB Data Breach Hits LAPD, Exposing Sensitive Officer and Internal Affairs Files

The Los Angeles Police Department (LAPD) has suffered a colossal data breach involving a digital storage system used by the L.A. City Attorney's Office. The breach exposed an enormous 7.7 terabytes of data, encompassing over 337,000 files. The compromised information is highly sensitive, including unredacted personal information of LAPD officers, confidential personnel records, and internal affairs materials. The exposure of this data poses a grave risk to officer safety, the integrity of ongoing investigations, and public trust. The cause of the breach and the responsible threat actor are currently unknown.

Bitcoin Depot Loses $3.6M in Crypto After Attackers Steal Settlement Account Credentials

Bitcoin Depot, a major US operator of cryptocurrency ATMs, has disclosed a cyberattack that resulted in the theft of more than 50 Bitcoin (BTC), valued at over $3.6 million. According to the company, threat actors managed to steal credentials linked to its digital asset settlement accounts. Using these credentials, the attackers transferred the cryptocurrency out of the company's wallets. Bitcoin Depot stated it was able to block the attackers' access, preventing further losses. The incident highlights the persistent and lucrative nature of targeting cryptocurrency firms, where a single credential compromise can lead to immediate and irreversible financial loss.

Qilin Ransomware Attacks German Party Die Linke, Threatens Data Leak

The Russia-speaking Qilin ransomware group has claimed responsibility for a cyberattack against the German political party Die Linke. The attack, detected on March 26, prompted the party to shut down parts of its IT infrastructure. Qilin is now threatening to publish stolen internal documents and employee data on its dark web leak site. While the main membership database was not compromised, Die Linke has suggested the attack may be politically motivated and part of a broader hybrid warfare campaign, not just a random criminal act.

DDoS Attacks Surge 150% with Record-Breaking 12 Tbps Volumes, Gcore Reports

A new report from infrastructure provider Gcore reveals a 150% increase in Distributed Denial-of-Service (DDoS) attacks between Q4 2024 and Q4 2025. Attack volumes have also exploded, reaching a record 12 Terabits per second (Tbps). The report highlights a trend towards faster, cheaper, and more frequent attacks, with 75% of network-layer attacks lasting less than a minute. The technology, financial services, and gaming industries remain the primary targets, while a significant portion of attack traffic originates from Latin America, particularly Mexico and Brazil.

Marcus & Millichap Hit by Phishing Attack, Limited Data Accessed

Marcus & Millichap, a leading commercial real estate brokerage, announced on April 12, 2026, that it recently experienced a cybersecurity incident. The company confirmed that an unauthorized party gained access to one of its systems after a successful phishing attack compromised an employee's credentials. Upon discovery, the firm initiated its incident response plan and engaged external cybersecurity experts. The investigation is ongoing, but the breach appears to be limited, with the accessed data confined to company forms, marketing materials, and general contact information. Marcus & Millichap reports that its business operations have not been disrupted.

Irish Healthcare Recruiter Healthdaq Probes Cyber Incident with Police

Healthdaq, a healthcare recruitment company operating in both the Republic of Ireland and Northern Ireland, has confirmed it was targeted by a 'cyber security incident' on April 11, 2026. The firm, which works closely with health and social care trusts, has reported the event to law enforcement in both jurisdictions, including the Garda National Cyber Crime Bureau in Dublin. An active criminal investigation is now underway. Healthdaq has not disclosed the nature or scope of the attack, nor has it confirmed whether sensitive data belonging to healthcare professionals or clients has been compromised.

Actively Exploited Chrome Zero-Day CVE-2026-2441 Prompts Emergency Google Patch

Google has released an emergency security update for its Chrome browser to address a critical vulnerability, CVE-2026-2441, which is being actively exploited in the wild. The company is currently withholding technical details about the flaw to prevent wider abuse, but it is believed to be a severe issue that could permit a sandbox escape or remote code execution. The active exploitation of this zero-day vulnerability poses a significant risk to all Chrome users. Security professionals are strongly advising that all instances of the browser, on all platforms, be updated to the latest version immediately to mitigate the threat.

North Dakota Water Treatment Plant Hit by Ransomware, Reverts to Manual Operations

A water treatment facility in Minot, North Dakota, serving approximately 80,000 people, was hit by a ransomware attack in March 2026. The attack compromised the plant's Supervisory Control and Data Acquisition (SCADA) system, forcing operators to shut it down and revert to manual processes for about 16 hours. City officials confirmed the incident, emphasizing that the water supply remained safe throughout. A ransomware note was found, but no specific demand was made, and no ransom was paid. The plant is currently using a backup server while a new, more secure system is prepared. The incident highlights the growing cyber threats targeting U.S. critical infrastructure.

Medusa Ransomware Group Strikes Within 24 Hours of Breach, Microsoft Warns

Microsoft research has uncovered the alarming operational velocity of Storm-1175, the cybercrime group deploying Medusa ransomware. The group can exploit newly disclosed N-day and even zero-day vulnerabilities to move from initial access to full ransomware deployment in as little as 24-48 hours. Targeting sectors like healthcare and education across the US, UK, and Australia, Storm-1175 leverages a wide array of vulnerabilities in web-facing assets and uses legitimate remote management tools to accelerate their attacks, putting immense pressure on defenders to patch in near real-time.

Hong Kong Hospital Authority Apologizes for Data Leak Affecting 56,000 Patients

The Hong Kong Hospital Authority (HA) is investigating a major data breach that exposed the sensitive personal and medical information of over 56,000 patients from its Kowloon East hospital cluster. The data, including HKID numbers and surgical details, was discovered on a third-party platform. While an external cyberattack has been ruled out, the breach is suspected to be linked to 'inappropriate access' by a contractor. The police and Hong Kong's privacy commissioner have launched formal investigations into the incident.

Active Zero-Day in Adobe Reader Steals Files by Abusing Privileged APIs

A previously unknown zero-day vulnerability in Adobe Acrobat and Reader is being actively exploited in targeted attacks to steal data from victims' computers. The flaw, a logic bug in the application's JavaScript engine, allows a specially crafted PDF to bypass the sandbox and invoke privileged APIs. Simply opening the malicious document is enough to trigger the exploit, which can read arbitrary local files and exfiltrate them to an attacker-controlled server. Adobe has not yet released a patch, and the campaign, which uses Russian-language lures, appears to be targeting the oil and gas sector.

Smart Buildings, Dumb Security: Claroty Warns New Standard Exposes BMS to Remote Attack

Research from Claroty's Team82 has uncovered significant cybersecurity risks stemming from the adoption of the CEA-852 standard, which connects traditionally isolated Building Management Systems (BMS) to IP networks. The standard, which allows legacy protocols like LonTalk to run over IP, introduces remote attack vectors into smart buildings and the critical infrastructure they support. Researchers found serious design weaknesses that could allow attackers to remotely compromise BMS gateways and servers, potentially gaining control over entire building ecosystems, including HVAC, lighting, and security systems.

Hundreds of Unauthenticated ICS Devices, Including for Power Grids, Found Exposed Online

New research from Comparitech reveals a startling lack of security in critical infrastructure, with at least 179 industrial control system (ICS) devices found exposed to the internet without any authentication. These devices, using the insecure-by-design Modbus protocol on its default port, are tied to critical entities including a national railway and two national power grids. The findings reinforce urgent warnings from government agencies about the growing threat of nation-state actors targeting operational technology (OT) and highlight a severe visibility gap, with fewer than 10% of OT networks having adequate monitoring.

Citizen Lab Uncovers 'Webloc' - A Global Surveillance Tool Using Ad Data to Track Phones

A new report from the University of Toronto's Citizen Lab has exposed a global geolocation surveillance system named "Webloc." Developed by the Israeli firm Cobwebs Technologies, the tool leverages data from the digital advertising ecosystem to track the location of up to 500 million devices worldwide. The investigation revealed that Webloc has been used by law enforcement and intelligence agencies in multiple countries, including the United States, Hungary, and El Salvador, raising significant privacy concerns about the government use of commercial surveillance technology.

Hacking Group 'FlamingChina' Claims 10 Petabyte Military Data Heist from Chinese Supercomputer

A previously unknown hacking entity calling itself 'FlamingChina' has claimed responsibility for a colossal data breach targeting a Chinese supercomputer. The group alleges it has stolen 10 petabytes of highly sensitive military data and is now offering it for sale. The purported data includes schematics and simulations for advanced weaponry like aircraft, missiles, and bombs. The data is said to originate from top-tier Chinese state-run defense and technology institutions, including the Aviation Industry Corporation of China. If verified, the breach would represent a catastrophic loss of state secrets for China.

Hims & Hers Data Breach: ShinyHunters Steals Support Tickets via Compromised Zendesk Access

Telehealth company Hims & Hers has disclosed a data breach that exposed customer support tickets. The attackers, reportedly the ShinyHunters extortion group, gained unauthorized access to the company's instance on a third-party customer service platform, identified as Zendesk. The breach, which occurred in early February 2026, was achieved using a compromised Okta single sign-on (SSO) account. Exposed data includes customer names, contact information, and details from their support requests. Medical records were not compromised, and the company is offering free credit monitoring to affected individuals.

Global Takedown Disrupts 'Tycoon 2FA' Phishing Service That Bypassed MFA for 100k Orgs

An international law enforcement operation, led by Microsoft and Europol, has successfully disrupted 'Tycoon 2FA,' a major Phishing-as-a-Service (PhaaS) platform responsible for enabling multi-factor authentication (MFA) bypass attacks on a massive scale. Active since August 2023, the service provided low-skilled cybercriminals with a toolkit using adversary-in-the-middle (AitM) techniques to steal credentials, one-time passcodes, and session cookies in real-time. The platform facilitated attacks against nearly 100,000 organizations globally, including schools and hospitals, and was linked to tens of millions of phishing emails per month. The takedown involved seizing over 330 domains that formed the service's core infrastructure, striking a significant blow against the cybercrime economy that preys on enterprise identity security.

EU Commission Data Breach Linked to Trivy Supply Chain Attack by TeamPCP Hackers

The EU's cybersecurity agency, CERT-EU, has attributed a significant data breach at the European Commission to the hacking group TeamPCP. The attackers exfiltrated approximately 92GB of data from the Commission's Amazon Web Services (AWS) account. The investigation revealed that the breach was a downstream consequence of a supply chain attack targeting Trivy, a popular open-source vulnerability scanner. The Commission had unknowingly installed a compromised version of Trivy, which contained a backdoor providing the attackers with an Amazon API key. The stolen data, including names and email information from numerous EU entities, was later advertised for sale on a dark web forum associated with the ShinyHunters group, suggesting a possible collaboration between the two threat actors.

CPUID Website Hijacked in Supply Chain Attack to Distribute STX RAT Infostealer

Between April 9 and April 10, 2026, the official website of popular utility software provider CPUID was compromised in a supply chain attack. For up to 19 hours, attackers hijacked a website API to redirect download links for the widely-used CPU-Z and HWMonitor tools. Unsuspecting users were served trojanized installers that used a DLL side-loading technique to deploy the STX RAT, a potent information-stealing malware. The attack, which reused infrastructure from a previous campaign, successfully infected over 150 victims across multiple countries, primarily targeting individuals but also impacting organizations in retail, manufacturing, and telecommunications.

Minnesota's Winona County Suffers Second Crippling Ransomware Attack This Year

Winona County, Minnesota, is grappling with its second major cyberattack of 2026 after detecting a ransomware incident on April 7. The attack has severely disrupted government functions, taking many critical systems and digital services offline. Due to the incident's complexity, Minnesota's governor deployed the National Guard's cyber protection team to assist with response and recovery. While 911 services remain operational, other functions like the DMV are unavailable. This is the second time the county has been targeted this year, with a preliminary investigation suggesting a different threat actor is responsible for the latest attack.

Google Issues Urgent Chrome Update to Patch 60 Flaws, Including Two Critical Bugs

Google has released an urgent security update for its Chrome browser, version 147, patching a total of 60 vulnerabilities. The update, announced around April 9, 2026, addresses two critical flaws, CVE-2026-5858 (a heap buffer overflow) and CVE-2026-5859 (an integer overflow), both in Chrome's WebML component. These vulnerabilities could be exploited for remote code execution, and Google awarded researchers a combined $86,000 in bug bounties for their discovery. The update also fixes 14 high-severity flaws affecting components like WebRTC and the V8 JavaScript engine. Users are strongly advised to update their browsers immediately.

AI-Powered Attacks Now a Top Concern for 79% of IT Leaders, Armis Report Finds

According to the fourth annual 'State of Cyberwarfare Report' by Armis, 79% of global IT decision-makers now consider artificial intelligence a significant security threat. The report, which surveyed 1,900 IT leaders, highlights a new phase of cyber conflict where AI is being weaponized by attackers to automate reconnaissance, vulnerability discovery, and lateral movement. Experts warn that AI compresses the 'critical risk window' between vulnerability discovery and exploitation, outpacing the response capabilities of many security teams. In response, 49% of security leaders are making AI and automation their top investment priority for 2026 to keep pace with these accelerated threats.

Ransomware Attack on Dutch Health-Tech Giant ChipSoft Disrupts 70% of Hospitals

A crippling ransomware attack has struck ChipSoft, a dominant provider of electronic health record (EHR) software in the Netherlands, causing widespread disruption across the nation's healthcare system. The attack, confirmed on April 7, 2026, forced ChipSoft to take its platforms offline and prompted at least 11 hospitals to sever connections as a precaution. The incident has created significant logistical challenges and raised concerns that sensitive patient data may have been compromised, highlighting the systemic risk posed by supply chain attacks in the healthcare sector.

Silent Ransom Group Claims Phishing Attack on Law Firm Jones Day, Demands $13M

The prominent global law firm Jones Day has disclosed it was the victim of a targeted phishing attack that resulted in unauthorized access to files for ten clients. The Silent Ransom Group (SRG), a sophisticated threat actor believed to be a splinter group from the notorious Conti syndicate, has claimed responsibility. The group allegedly published negotiation chats demanding a US$13 million ransom to prevent the public leak of stolen confidential client data and internal communications, highlighting the persistent targeting of the legal sector by high-stakes extortion groups.

Atomic Stealer Malware Bypasses macOS Warnings with New 'ClickFix' Attack Vector

A new malware campaign is delivering the Atomic Stealer (AMOS) infostealer to macOS users by evolving the 'ClickFix' social engineering technique. To bypass recent security warnings Apple added to the Terminal application, threat actors are now tricking users into launching Apple's built-in Script Editor and pasting malicious code. The attack, identified by Jamf Threat Labs, uses convincing browser pop-ups to guide victims through a fake troubleshooting workflow, ultimately leading to the installation of the AMOS infostealer and a persistent backdoor.

Job Seekers Targeted in Phishing Scam Impersonating Palo Alto Networks Recruiters

Threat actors are conducting a sophisticated phishing campaign targeting senior-level professionals by impersonating recruiters from cybersecurity giant Palo Alto Networks. According to the company's own Unit 42 threat intelligence team, the scam uses data scraped from LinkedIn for highly personalized lures. The attackers trick victims by creating a sense of urgency, claiming the candidate's CV failed an automated screening, and then referring them to a paid 'CV expert' to fix the fake formatting issue, ultimately scamming them out of several hundred dollars.

Fake Windows Update Site Tricks French-Speaking Users into Installing Infostealer

A malvertising campaign is directing French-speaking users to a highly convincing but fake Microsoft support website hosted on a typosquatted domain. The site, designed to mimic an official Windows update page, tricks users into downloading what they believe is a cumulative update for Windows. The downloaded file is actually a Windows Installer package that deploys a potent information-stealing malware. Researchers at Malwarebytes, who discovered the campaign, suggest it may be leveraging recent large-scale data breaches in France to enhance the believability of related scams.

New 'LucidRook' Malware Uses Lua and Rust in Targeted Attacks on Taiwan

Security researchers at Cisco Talos have discovered a new, sophisticated malware family named 'LucidRook' used in targeted spear-phishing campaigns. Attributed to a threat cluster known as UAT-10362, the attacks primarily target non-governmental organizations (NGOs) and universities in Taiwan. LucidRook is a complex stager delivered as a DLL that embeds a Lua interpreter and Rust-compiled libraries. It uses a dropper component, 'LucidPawn,' which performs an anti-analysis check to ensure it only runs on systems configured for the Traditional Chinese language. The malware downloads and executes Lua bytecode payloads from a C2 server, and is accompanied by a reconnaissance tool called 'LucidKnight' used for initial system profiling.

APT28 'FrostArmada' Campaign Hijacks SOHO Routers for Global DNS Espionage

The Russian-linked threat group APT28 (aka Forest Blizzard) has been identified as the actor behind 'FrostArmada,' a large-scale cyber espionage campaign compromising insecure Small Office/Home Office (SOHO) routers. According to Lumen's Black Lotus Labs and Microsoft, the campaign, active since at least May 2025, exploits vulnerable MikroTik and TP-Link routers. The attackers modify the devices' DNS settings to redirect traffic from victims—including government agencies and cloud service users—to attacker-controlled infrastructure. This allows for passive credential harvesting and data collection. At its peak, the campaign's infrastructure communicated with over 18,000 IPs across 120 countries before being disrupted by a law enforcement operation.

Singapore's CSA Issues Advisory on Securing Software Supply Chains

The Cyber Security Agency of Singapore (CSA) has published an advisory on the increasing threat of software supply chain attacks. The guidance warns that threat actors are targeting third-party software dependencies and automated development pipelines to compromise internal corporate systems. The CSA highlights that a single compromised tool can grant attackers deep access, leading to data theft and operational downtime. The advisory cites recent incidents like the hijacking of the popular 'Axios' npm package as examples of this growing threat. The CSA urges organizations to enforce strict governance over development environments, identify dependencies, and have incident response plans ready.

Southern Illinois Dermatology Breach Exposes Data of Over 150,000 Patients

Southern Illinois Dermatology has started notifying patients of a data breach that occurred in November 2025. An unauthorized party gained access to its network and exfiltrated files containing patient data, including names, Social Security numbers, and medical information. The 'Insomnia' threat group has claimed responsibility for the attack, alleging they stole data from over 150,000 patients. The group has since followed through on its threats by leaking the entire stolen dataset on its data leak site, amplifying the impact on affected individuals.

Samsung's April 2026 Patch Fixes 47 Vulnerabilities in Galaxy Devices

Samsung has released its April 2026 security patch, which addresses a total of 47 vulnerabilities affecting its Galaxy line of smartphones, tablets, and wearables. The update is a combination of patches from Google and Samsung itself. It includes 33 fixes from Google's Android Security Bulletin, 14 of which are rated critical. Additionally, Samsung has included 14 of its own Samsung Vulnerabilities and Exposures (SVEs), addressing high-severity flaws in both its software and underlying semiconductor firmware. Users are advised to install the update as soon as it becomes available for their device and region.

US Data Breach Costs Hit Record $10.2M, Fueled by AI and Supply Chain Attacks

A new report from insurance provider Chubb reveals that the average cost of a data breach in the United States has reached a record high of $10.2 million, more than double the global average. The 2026 Cyber Claims Report identifies three key drivers for this surge: the weaponization of Artificial Intelligence (AI) by cybercriminals, an increase in immediate litigation following breach announcements, and the cascading impact of software supply chain compromises. The report notes that hostile AI is being used for self-rewriting malware and deepfake-based social engineering, while supply chain issues are now seen as the top cyber challenge by 65% of large companies.

TeamPCP's Sophisticated Supply Chain Attack on Trivy and LiteLLM Hits 1,000+ SaaS Environments

A multi-stage supply chain attack by the threat group TeamPCP has caused a significant security crisis, beginning with the compromise of the popular open-source scanner Trivy and expanding to other developer tools, including Checkmarx KICS and LiteLLM. The attackers exploited a previously stolen GitHub token to poison official software releases and CI/CD pipelines, injecting credential-stealing malware. The campaign has already compromised over 1,000 SaaS environments, exfiltrating cloud credentials, SSH keys, and other secrets. The attack, tracked under CVE-2026-33634, highlights the systemic risk in modern software supply chains, with experts warning the full impact could affect up to 10,000 organizations.

Healthcare IT Firm CareCloud Probes Patient Data Access in EHR Breach

Healthcare technology provider CareCloud is investigating a security breach that gave an unauthorized third party access to one of its electronic health record (EHR) environments for eight hours on March 16, 2026. The company, which serves over 45,000 healthcare providers, has not yet confirmed if protected health information (PHI) was exfiltrated but has hired a leading cyber response team to assess the scope. The incident has been reported to the SEC, highlighting the potential for significant legal, regulatory, and reputational fallout if a large-scale patient data leak is confirmed.

Pro-Iranian Hacktivists "Handala" Claim Attack on US Medical Tech Firm Stryker

A pro-Iranian hacktivist group known as Handala has claimed responsibility for a cyberattack against Stryker, a prominent US-based medical technology company. This incident is part of a broader, politically motivated campaign by Iranian-linked threat actors targeting the US healthcare sector. Unlike financially motivated attacks, the primary goal of these operations appears to be disruption, intimidation, and causing chaos, reflecting the use of cyber operations as a tool in geopolitical conflicts. The attack on Stryker highlights the vulnerability of critical infrastructure sectors to state-aligned hacktivism.

AI Model Discovers RCE Zero-Days in Vim and Emacs with Simple Prompts

A security researcher has demonstrated the power of AI in vulnerability discovery by using Anthropic's Claude Code model to find critical zero-day flaws in the source code of the popular Vim and GNU Emacs text editors. With a simple prompt—"Somebody told me there is an RCE 0-day when you open a file. Find it"—the AI model identified a remote code execution (RCE) vulnerability in Vim within minutes. This flaw, now patched and tracked as CVE-2026-34714 (CVSS 9.2), allowed command execution when opening a malicious file. The AI subsequently found a similar issue in GNU Emacs, which its maintainers have reportedly not yet addressed. The findings highlight the dual-use nature of advanced AI, capable of dramatically accelerating both defensive security research and malicious exploit development.

Hackers Actively Exploit Critical RCE Flaw in Ninja Forms WordPress Add-on

A critical remote code execution (RCE) vulnerability, CVE-2026-0740, in the 'File Uploads' add-on for the popular Ninja Forms WordPress plugin is being actively exploited in the wild. The flaw, rated 9.8 out of 10 for severity, allows an unauthenticated attacker to upload malicious files, such as PHP web shells, and achieve complete website takeover. The vulnerability stems from insufficient file type validation, enabling attackers to bypass security checks and place executable files in sensitive directories. The plugin developer has released a patch in version 3.3.27. Security firm Wordfence, which helped disclose the issue, reported blocking thousands of exploitation attempts, underscoring the urgent need for users to update immediately.

SparkCat Mobile Malware Returns, Stealing Crypto Phrases from Photos on iOS and Android

A new variant of the SparkCat mobile trojan has been discovered on both the Apple App Store and Google Play Store, disguised as legitimate applications like enterprise messengers. Security researchers at Kaspersky report that the malware, which primarily targets users in Asia, uses a novel technique to steal cryptocurrency. After gaining access to a user's photo gallery, SparkCat employs Optical Character Recognition (OCR) to scan all images, searching for text that matches the format of a cryptocurrency wallet recovery phrase. If a potential phrase is found, the image is exfiltrated to an attacker-controlled server, giving the threat actor complete control over the victim's crypto assets. The malware's ability to bypass the security vetting of both major app stores highlights a significant threat to mobile users.

Anthropic's Project Glasswing Uses New AI to Find Thousands of Critical Flaws

AI research company Anthropic has launched Project Glasswing, a major cybersecurity initiative that uses a new AI model, Claude Mythos, to proactively discover vulnerabilities in critical software. In partnership with a consortium of tech giants including Google, Microsoft, and Apple, the project aims to secure the digital ecosystem by finding and fixing flaws before they can be exploited. In early testing, Claude Mythos has already demonstrated remarkable capabilities, identifying thousands of high-severity vulnerabilities. Notable discoveries include a 16-year-old bug in the FFmpeg library, a remote crash vulnerability affecting major operating systems, and a privilege escalation chain in the Linux kernel. The project signals a new era of AI-driven defensive security, aiming to put powerful vulnerability discovery tools in the hands of defenders.

Fortinet Scrambles to Patch Actively Exploited FortiClient EMS Zero-Day (CVE-2026-35616)

Fortinet has released an emergency hotfix for a critical zero-day vulnerability, CVE-2026-35616, affecting its FortiClient Endpoint Management Server (EMS). The flaw, rated 9.1 on the CVSS scale, is an improper access control issue that allows an unauthenticated remote attacker to achieve remote code execution. Fortinet confirmed the vulnerability is being actively exploited in the wild, prompting the U.S. CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog and mandate a swift patching deadline for federal agencies.

Critical Cisco IMC Flaw (CVE-2026-20093) Allows Full Server Takeover

Cisco has patched a critical authentication bypass vulnerability, CVE-2026-20093, in its Integrated Management Controller (IMC) firmware. The flaw, rated 9.8 on the CVSS scale, allows an unauthenticated, remote attacker to reset any user's password, including the administrator's, by sending a single crafted HTTP request. A successful exploit grants complete hardware-level control over a wide range of Cisco UCS servers and appliances. Cisco has released patched firmware and advises customers to update immediately, as there are no workarounds.

North Korean Hackers Abuse GitHub for C2 in Campaign Targeting South Korea

A sophisticated, multi-stage phishing campaign attributed to North Korean state-sponsored actors is targeting organizations in South Korea. The attackers use malicious Windows shortcut (LNK) files disguised as business documents to deliver a PowerShell-based payload. A key feature of the campaign is the abuse of GitHub as a command-and-control (C2) channel, allowing the malware to exfiltrate data and receive commands by communicating with attacker-controlled repositories. This tactic helps the malicious traffic blend in with legitimate web activity, evading detection. The campaign shows links to known North Korean groups like Kimsuky and Lazarus.

Critical RCE Chain in Progress ShareFile Allows Unauthenticated Takeover

Security researchers have publicly disclosed a critical vulnerability chain in the on-premise version of Progress ShareFile Storage Zones Controller. The chain combines an authentication bypass (CVE-2026-2699, CVSS 9.8) and a file upload flaw (CVE-2026-2701, CVSS 9.1), allowing an unauthenticated attacker to achieve remote code execution (RCE) and take over the server. Although Progress patched the flaws in March, the public disclosure of technical details increases the risk for the nearly 30,000 internet-exposed instances that remain unpatched.

Unpatched Windows Zero-Day 'BlueHammer' Exploit Leaked, Allows SYSTEM-Level Access

A security researcher has publicly released a proof-of-concept (PoC) exploit for an unpatched Windows zero-day vulnerability dubbed "BlueHammer." The leak, which occurred after a dispute with the Microsoft Security Response Center (MSRC), exposes a local privilege escalation (LPE) flaw. The exploit allows a local attacker with limited access to gain full SYSTEM-level permissions on a compromised machine, significantly increasing the risk for Windows users as the vulnerability remains unpatched.

Cybercriminals Exploit Tax Season with Over 100 Unique Phishing and Malware Campaigns

As tax season intensifies, a surge of over one hundred distinct cyber campaigns are exploiting the urgency of filing deadlines, according to a report from Proofpoint. Threat actors are using a variety of tax-themed lures, such as fake W-8BEN, W-2, and W-9 forms, to conduct credential phishing, Business Email Compromise (BEC), and malware distribution. A notable trend is the use of these phishing emails to trick victims into installing legitimate Remote Monitoring and Management (RMM) tools, which provides attackers with persistent access to compromised systems. Campaigns have been observed globally, with a newly identified actor, TA2730, focusing on targets in Asia.

Toy Giant Hasbro Hit by Cyberattack, Recovery to Take Weeks

The global toy and entertainment company Hasbro, Inc. has confirmed it was the victim of a cyberattack. The incident, detected on March 28, 2026, involved unauthorized access to its network and has caused significant operational disruption. The company immediately shut down affected systems and engaged external experts to investigate. In an SEC filing, Hasbro stated it was in its second week of limited operations and expects the recovery period to last several more weeks, suggesting a sophisticated intrusion with potential persistence. The specific nature of the attack, such as whether it involved ransomware or data theft, has not yet been disclosed.

F5 BIG-IP Flaw Escalated to Critical 9.8 RCE, Now Under Active Attack

F5 has urgently reclassified a vulnerability in its BIG-IP Access Policy Manager (APM), CVE-2025-53521, from a medium-severity Denial-of-Service (DoS) flaw to a critical 9.8 CVSS unauthenticated Remote Code Execution (RCE) vulnerability. Originally disclosed in October 2025, F5 updated its advisory on March 28, 2026, after discovering it could be exploited for full system compromise. The vulnerability is now under active attack in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog. Attackers can send crafted traffic to a virtual server with an APM policy to gain root access. F5 urges customers to apply the patches released in October 2025, which are confirmed to mitigate this severe RCE vector.

Anthropic Accidentally Leaks 'Claude Code' AI Source Code in Packaging Error

AI research company Anthropic experienced a significant intellectual property leak after the full source code for its flagship 'Claude Code' AI tool was accidentally published. The leak was caused by a packaging error where a JavaScript source map file, included in a public npm package, contained the entire agent architecture. For over three hours, 512,000 lines of proprietary TypeScript code were publicly accessible and were cloned thousands of times. Anthropic has stated it was a human error, not a security breach, and that no customer data was exposed.

Hyderabad Police Warn of WhatsApp Impersonation Fraud Leading to Major Corporate Losses

Police in Hyderabad, India, have issued an alert about a sophisticated new fraud scheme targeting corporations. The multi-stage attack begins with a phishing email that installs remote access malware on an employee's computer. The criminals then wait for an active WhatsApp Web session, which they hijack to impersonate a senior executive (like the CEO or CFO). Posing as the executive, they instruct finance staff to make urgent, fraudulent financial transfers. The use of the legitimate WhatsApp account lends credibility to the requests, leading to significant financial losses for several companies.

Trend Micro Uncovers Coordinated Malware Campaigns Targeting Seven Indian Banks

Cybersecurity firm Trend Micro has identified a large-scale, coordinated phishing campaign targeting the customers of seven major banks in India. The attackers are using five distinct families of banking malware to steal credit card data and personal credentials. The primary attack vector is phishing messages containing malicious links that redirect victims to fake login pages and other fraudulent websites. The report highlights a significant and ongoing threat to India's banking sector, though the specific banks and malware families were not disclosed.

Novel AI 'Feedback Loop' Attack Triggers 4-Hour Market Freeze at Financial Hub

A major global financial hub experienced a four-hour market freeze due to a novel cyberattack that turned an AI-powered defense system against itself. Attackers generated millions of fake, low-grade security alerts, overwhelming the institution's AI-driven Security Orchestration, Automation, and Response (SOAR) platform. The defensive AI, misinterpreting the flood of alerts as a massive assault, initiated its ultimate containment protocol: quarantining the entire primary trading floor network. The incident exposes a critical vulnerability in fully automated defense systems.

CISA Mandates Decommission of Medical IoT Gateways Due to 'Vitals Vapor' Zero-Day

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Emergency Directive 26-03, ordering the immediate decommissioning of specific legacy embedded IoT gateways used in medical facilities. The urgent action responds to a new zero-day exploit dubbed 'Vitals Vapor,' which poses a grave threat to patient safety. The exploit allows attackers to compromise patient monitoring systems, freeze the live data feed, and loop pre-recorded normal data to nursing stations, effectively hiding a patient's deteriorating condition or the effects of a cyberattack.

Australian Water Treatment Facilities Thwart Coordinated PLC Cyberattack

Multiple municipal water treatment facilities in Australia were the target of a coordinated cyberattack aimed at their chemical feed Programmable Logic Controllers (PLCs). The attackers attempted to breach the industrial control systems to override safety thresholds for chlorine distribution. A potential public health crisis was averted by the timely manual intervention of plant operators. The incident exposes significant vulnerabilities in internet-connected critical infrastructure and highlights the growing threat to operational technology (OT) in the water sector.

Cisco Patches Critical Unauthenticated RCE Flaw in Smart Software Manager

Cisco has released a security patch for a critical vulnerability, CVE-2026-20160, in its Smart Software Manager On-Prem (SSM On-Prem) product. The flaw, which has a CVSS score of 9.8, could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. The vulnerability is due to insufficient access control on a specific API. An attacker can exploit it by sending a crafted HTTP request. Cisco has released software updates and confirms there are no workarounds. The company's PSIRT is not aware of any malicious exploitation of this flaw, which was discovered during internal security testing.

Lapsus$ Claims Theft of 4TB of Data from AI Firm Mercor in LiteLLM Supply Chain Attack

AI recruiting firm Mercor has confirmed it was impacted by a recent supply chain attack targeting the open-source LiteLLM PyPI package. The incident occurred on March 27, when malicious versions `1.82.7` and `1.82.8` of LiteLLM were published for about 40 minutes. Following the incident, the notorious extortion group Lapsus$ claimed responsibility, listing Mercor on its data leak site and alleging the theft of over 4 terabytes of data. Mercor is currently investigating the breach with third-party forensic experts. The attack originated from a compromise of a dependency used in Mercor's CI/CD workflow, highlighting the cascading risks in the software supply chain.

Hims & Hers Faces Class Action Probe After Third-Party Vendor Breach

Telehealth company Hims & Hers, Inc. is under investigation for a data breach that originated from its third-party customer service provider, Zendesk. An unauthorized user gained access to the Zendesk platform between February 4 and February 7, 2026, exposing sensitive customer service tickets. These tickets contained personal information submitted by customers, including names and contact details. The national class action law firm Edelson Lechtzin LLP has launched an investigation into data privacy claims, highlighting the significant supply chain risks associated with third-party vendors.

EU Commission Hacked via Compromised Trivy Scanner in Major Supply Chain Attack

A significant data breach at the European Commission has been attributed to the hacking group TeamPCP, who leveraged a compromised version of the popular Trivy open-source vulnerability scanner. The supply chain attack allowed the threat actors to steal an AWS API key, gain management rights to the Commission's cloud environment, and exfiltrate 92 GB of compressed data, including sensitive email communications. The stolen data was later put up for sale on a dark web forum by the data broker ShinyHunters, underscoring a dangerous collaboration between cybercriminal groups.

Russian APTs Re-Exploiting Past Breaches for Renewed Attacks in Ukraine

Ukraine's computer emergency response team, CERT-UA, has issued a warning that Russian state-sponsored hacking groups like APT28 (Fancy Bear) and Void Blizzard are systematically revisiting networks they have previously compromised. This new tactic focuses on checking for persistent access, unpatched vulnerabilities, and still-valid credentials to launch follow-up operations. The attackers are also evolving their social engineering, using direct phone and video calls to build trust before sending malicious files, making their initial access attempts more effective.

Cyberattack Disrupts Emergency Communications in Massachusetts Towns

A cyberattack beginning April 2, 2026, has impacted the Patriot Regional Emergency Communications Center, which provides 911 dispatch services for several towns in northern Massachusetts. The attack has disrupted town and public safety computer systems, taking non-emergency and business phone lines offline. While critical 9-1-1 call systems remain operational, the incident has significantly hampered administrative and secondary communication channels. Federal law enforcement has been notified, and an investigation is underway to determine the scope of the attack.

Researchers Gain Access to Hacker Dashboard in React2Shell Campaign

Researchers at Cisco Talos gained access to the operational dashboard of a threat group, UAT-10608, that is actively exploiting the React2Shell vulnerability (CVE-2025-55182) in Next.js applications. A security lapse in the attackers' own infrastructure left a web application fronting their stolen data collection exposed. This allowed Talos to view a trove of stolen credentials, API keys, and access tokens harvested from hundreds of compromised servers, including credentials for AWS and GitHub. Talos is now notifying the affected victims.

Traffic Violation Scams Leverage QR Codes to Harvest Financial Data

A new wave of phishing scams is using QR codes embedded in fake traffic violation notices to trick victims into visiting malicious websites. This tactic bypasses user suspicion of malicious links in text messages and leverages the authority of government impersonation to create urgency. When scanned, the QR code directs the victim to a sophisticated phishing page designed to harvest personal and payment card details, contributing to the nearly $800 million in losses from government impersonation scams reported by the FBI in 2025.

Chinese Hackers Exploit TrueConf Zero-Day in 'Operation TrueChaos'

A suspected Chinese-nexus advanced persistent threat (APT) group is exploiting a zero-day vulnerability, CVE-2026-3502, in the TrueConf video conferencing application. The campaign, dubbed 'Operation TrueChaos' by Check Point, targets government entities in Southeast Asia. The attackers compromise on-premises TrueConf servers and hijack the software's update mechanism to deliver malicious updates to client machines. The final payload observed in these attacks is the Havoc open-source post-exploitation framework, giving the threat actors a persistent foothold inside the targeted government networks. TrueConf has patched the flaw in client version 8.5.3.

NightSpire Ransomware Claims Attack on French Org, Threatens to Leak Audit Data

The NightSpire ransomware group has claimed responsibility for a cyberattack against Association OCACIA, a French organization. On April 3, 2026, the group announced the breach on its leak site, threatening to publish sensitive internal documents if its ransom demands are not met. The allegedly exfiltrated data includes audit reports, non-compliance records, and corrective action plans, which could be highly damaging if released.

EU Commission Suffers Major Data Breach; TeamPCP Hackers Blamed for 92GB Data Heist

The European Union's cybersecurity agency, CERT-EU, has attributed a significant data breach at the European Commission to the hacking group TeamPCP. The attack involved the compromise of the Commission's Amazon Web Services (AWS) account, leading to the exfiltration of approximately 92 gigabytes of data, including emails and documents. The breach is believed to be linked to the use of a compromised version of the Trivy open-source vulnerability scanner, which provided the attackers with a secret Amazon API key. The incident has potentially exposed data from dozens of EU entities.

ShinyHunters Threatens to Leak Cisco Data, Claims Breach of Salesforce and AWS

The data extortion group ShinyHunters has issued a final ultimatum to networking giant Cisco, demanding contact by April 3, 2026, before it begins leaking a massive trove of allegedly stolen data. The group claims to have exfiltrated over three million Salesforce records, source code, and other internal files by compromising Cisco's Salesforce and AWS environments. The threat actor referenced 'UNC6040', linking the breach to a previously disclosed vishing campaign that targeted Cisco employees, suggesting social engineering was a key component of the attack.

REF1695 Campaign Spreads RATs and Cryptominers via Fake Software Installers

A long-running threat campaign, dubbed REF1695, has been active since November 2023, using counterfeit software installers to deliver a variety of malicious payloads. According to Elastic Security Labs, the operation uses ISO file lures to distribute malware including the PureMiner and PureRAT trojans, the CNB Bot implant, and various cryptominers like XMRig. The threat actor leverages GitHub as a content delivery network (CDN) to host its payloads, a tactic designed to evade detection by using a trusted platform.

Immigration Law Platform DocketWise Discloses Breach Affecting Over 116,000 People

DocketWise, a cloud-based case management platform for immigration lawyers, has reported a data breach that exposed the highly sensitive personal information of 116,666 individuals. The breach, discovered in October 2025, occurred when an unauthorized actor gained access to a third-party partner repository containing law firm records. The compromised data includes names, Social Security numbers, passport numbers, financial details, and medical information, posing a significant risk of identity theft and fraud.

T-Mobile Confirms Insider Data Breach, States Only One Customer Affected

T-Mobile USA has clarified that a recent data breach notification was the result of an isolated insider threat incident, not a large-scale attack. A vendor employee improperly accessed the account information of a single customer, exposing their name, address, account PIN, and Social Security Number. T-Mobile stated that no credentials were compromised in the incident and that it has reset the affected customer's PIN and notified law enforcement.

LinkedIn Accused of Secretly Scanning for 6,000+ Browser Extensions

A new report from the user association Fairlinked e.V. alleges that LinkedIn is secretly scanning visitors' browsers for the presence of over 6,000 installed browser extensions. The practice, dubbed "BrowserGate," reportedly involves injecting hidden JavaScript to fingerprint users. The report claims this data is linked to user profiles and used for competitive analysis against sales tool rivals. LinkedIn has refuted the claims, stating the scanning is a security measure to protect its platform and users from data scraping.

European Commission Confirms Data Breach After ShinyHunters Claims 350GB Theft

The European Commission (EC) has confirmed a cyberattack targeting its Europa.eu web portal, following a claim by the notorious hacking group ShinyHunters. The group alleges it breached one of the Commission's Amazon Web Services (AWS) accounts and exfiltrated over 350GB of sensitive data, including mail servers, databases, and confidential documents. ShinyHunters has reportedly leaked a 90GB archive as proof. While the EC acknowledged the intrusion and data theft, it sought to downplay the impact, stating that internal systems were not affected and the breach was limited to public-facing websites. This incident marks the second data breach for the EC in 2026, raising serious questions about the security posture of EU institutions.

Chinese APT Mustang Panda Renews Espionage Campaign Against European Governments

The Chinese state-sponsored threat group TA416, also known as Mustang Panda, has resumed its cyber-espionage operations against European government and diplomatic entities, including EU and NATO missions. According to Proofpoint, the group has been active since mid-2025, using evolving tactics to deliver its signature PlugX malware. Attack methods have included spoofed Cloudflare Turnstile pages, abuse of Microsoft Entra ID applications, and malicious archives containing a renamed MSBuild executable. The campaigns leverage phishing links distributed via compromised and newly created email accounts to deliver malware hosted on legitimate cloud services like Google Drive and Azure Blob Storage.

Microsoft Warns of Social Engineering Campaign Abusing WhatsApp for Windows

Microsoft has issued a warning about an ongoing social engineering campaign targeting users of the WhatsApp desktop application on Windows. Attackers send malicious Visual Basic Script (`.vbs`) files disguised as legitimate attachments. Once executed, the script uses 'living off the land' (LOTL) techniques, copying and renaming legitimate Windows tools to download and execute remote access software. The malware also attempts to bypass User Account Control (UAC) and establishes persistence through registry modifications, giving attackers full control over the victim's machine. This attack does not exploit a software vulnerability but relies entirely on tricking the user.

AI Now Leading Source of Friction for CISOs in Retail and Hospitality, Report Finds

A new CISO Benchmark Report from the Retail & Hospitality ISAC (RH-ISAC) and IANS reveals a significant shift in the threat landscape: Artificial Intelligence is now the top concern for security leaders in these sectors. 71% of surveyed CISOs identified AI as a primary source of friction, placing it ahead of traditional threats like ransomware and phishing. Key risks associated with AI include data leakage, insider misuse, and inadequate governance. While AI is also driving investment in security operations for improved threat detection, its rapid adoption is creating new and complex challenges for cybersecurity teams.

Iranian Hackers Launch Coordinated Password Spray Attacks on Middle East

The Iranian APT group Gray Sandstorm is suspected of conducting a large-scale password spray campaign against government and private sector organizations in Israel and the UAE. According to Check Point researchers, the cyberattacks, which began in early March 2026, targeted Microsoft 365 accounts and appear to be coordinated with physical military operations. The timing and targeting of municipalities responsible for damage response suggest the attacks were intended to support kinetic missile and drone strikes, likely for intelligence gathering and Bombing Damage Assessment (BDA). This campaign exemplifies the use of cyber operations in modern hybrid warfare.

Chinese-Nexus Actor Exploits TrueConf Zero-Day in "TrueChaos" Campaign

A zero-day vulnerability in the TrueConf video conferencing application, CVE-2026-3502, has been actively exploited in a targeted campaign named 'TrueChaos.' The campaign, attributed with moderate confidence to a Chinese-nexus threat actor, has targeted government entities in Southeast Asia. The CVSS 7.8 flaw exists in the update mechanism of the TrueConf Windows client, allowing an attacker who has compromised an on-premises TrueConf server to push malicious updates to all connected endpoints, thereby deploying malware like the Havoc C2 framework.

TeamPCP's Supply Chain Attack Cascade Hits LiteLLM, Stealing AI Credentials

The threat actor group 'TeamPCP' has executed a sophisticated, multi-stage supply chain attack, beginning with the compromise of the popular open-source vulnerability scanner Trivy. The attackers leveraged this access to poison downstream GitHub Actions, stealing credentials from CI/CD pipelines. They then pivoted to compromise other developer tools, including Checkmarx KICS, before publishing malicious versions of the widely-used LiteLLM AI gateway on PyPI. The trojanized LiteLLM packages were designed to steal sensitive AI API credentials, exfiltrating them to an attacker-controlled server. This cascading attack highlights the systemic risk in the open-source software supply chain, where a single point of failure can lead to widespread compromise across thousands of dependent projects.

Texas Hospital Data Breach Exposes Personal and Medical Info of 257,000 Patients

Nacogdoches Memorial Hospital (NMH) in Texas is notifying 257,073 patients of a data breach resulting from a cyberattack detected on January 31, 2026. An unauthorized party gained access to the hospital's network and may have exfiltrated a vast amount of sensitive patient data. The potentially compromised information includes names, Social Security numbers, dates of birth, medical record numbers, health plan details, and even full-face photographs. The hospital has begun mailing notification letters to affected individuals and is offering identity theft protection services. This incident adds to the growing list of healthcare organizations falling victim to cyberattacks, highlighting the sector's vulnerability.

Toy Giant Hasbro Investigating Cybersecurity Incident After Network Breach

Global toy and entertainment company Hasbro, Inc. has disclosed a cybersecurity incident in a Form 8-K filing with the SEC. The company detected unauthorized access to its network on March 28, 2026, and has since activated its incident response plan, which included proactively taking some systems offline for containment. Hasbro has engaged third-party cybersecurity experts to investigate the scope and impact of the breach. While the company's business continuity plans are active, it has warned that operational delays in taking orders and shipping products may occur for several weeks. Details about the nature of the attack or what data may have been compromised have not yet been released.

Two-Thirds of US State Legislators Have Had Data Leaked on Dark Web

A new investigation by privacy company Proton has revealed a startling lack of operational security among U.S. state legislators, with 67% having had their data exposed in past data breaches. The research found over 16,000 breach records linked to the officials' publicly listed email addresses, which were used to sign up for third-party services like LinkedIn, Adobe, and even dating sites that were later hacked. Alarmingly, 560 plaintext passwords were discovered among the leaked data, creating a direct path for attackers to compromise personal and potentially official accounts. The findings highlight a significant national security risk, as this exposed data could be used by foreign adversaries for espionage, blackmail, or targeted influence campaigns.

Microsoft to Include Security Copilot in M365 E5 Licenses at No Extra Cost

Microsoft has announced a significant change to its licensing model, bundling its AI-powered Security Copilot directly into Microsoft 365 E5 licenses at no additional cost. The phased rollout will begin on April 20, 2026, and is expected to complete by June 30, 2026. This move makes advanced AI-driven security operations accessible to a much wider range of enterprises. Security Copilot, which is embedded in Microsoft Defender, Entra, Intune, and Purview, helps security teams investigate threats and respond to incidents more efficiently. E5 customers will receive a monthly pool of Security Compute Units (SCUs) to power the tool, democratizing access to cutting-edge security AI.

Phishers Abuse No-Code Platform 'Bubble' to Bypass Email Security Filters

Security researchers at Kaspersky have identified a novel phishing technique that abuses the legitimate no-code development platform, Bubble.io. Attackers are creating malicious web applications on the platform that act as redirectors. Because these apps are hosted on Bubble's trusted domain (*.bubble.io), they are more likely to bypass email security filters that block links to known malicious sites. Phishing emails, often targeting Microsoft 365 users, contain a link to the Bubble-hosted app, which then forwards the victim to a credential harvesting page. This 'trust abuse' tactic makes it harder for both users and automated defenses to spot the attack, and is expected to be adopted by Phishing-as-a-Service (PhaaS) operators.

'DeepLoad' Malware Leverages AI-Generated Code and ClickFix Social Engineering to Steal Credentials

A new malware campaign dubbed 'DeepLoad' is using a potent combination of stealthy delivery and advanced obfuscation to steal credentials from enterprise environments. Researchers at ReliaQuest identified the malware, which is delivered using the 'ClickFix' social engineering technique that tricks users into running malicious commands. What sets DeepLoad apart is its use of what appears to be AI-generated code to create thousands of lines of meaningless variables and functions, effectively hiding its malicious PowerShell loader from static analysis tools and making detection extremely difficult.

UK Employee Data Breaches Hit Seven-Year High, Driven by Human Error in Hybrid Work

Reports of employee data breaches submitted to the UK's Information Commissioner's Office (ICO) have surged to a seven-year high, with 3,872 incidents recorded in 2025. An analysis by law firm Nockolds reveals that while cyber-related incidents fell, non-cyber incidents—primarily driven by human error—jumped by 15%. These errors, such as misaddressing emails or letters and losing paperwork, are being attributed to the complexities of hybrid work environments. The findings underscore the need for organizations to update their data protection policies and training to address the new risks posed by remote and flexible work.

Ransomware Attack on Spain's Port of Vigo Disrupts Cargo Operations, Forces Manual Processes

The Port of Vigo, a major fishing port in Spain, has been hit by a ransomware attack that disrupted its digital cargo management systems. The port authority detected the attack on Tuesday, immediately isolating affected servers to contain the threat. The incident, which involved a ransom demand, has forced some logistical operations to revert to manual, paper-based processes. While physical ship and cargo movements continue, the attack highlights the significant operational strain placed on critical infrastructure when digital systems are compromised.

Tax Season Phishing Frenzy: Scammers Use IRS and W-2 Lures to Spread Malware

Microsoft Threat Intelligence is warning of a significant increase in sophisticated phishing campaigns timed for the U.S. tax season. Attackers are impersonating the IRS and using lures related to tax forms like W-2 and 1099 to trick victims. These campaigns are used to distribute malware, including the remote access tool ScreenConnect, and various phishing-as-a-service kits like 'Energy365' and 'SneakyLog'. One notable campaign targeted over 10,000 organizations, while another used QR codes embedded in Word documents to bypass email security filters and lead victims to credential-harvesting sites.

GitHub Discussions Weaponized to Spread Malware via Fake VS Code Alerts

A large-scale, automated phishing campaign is abusing the GitHub Discussions feature to target developers. Attackers are spamming thousands of repositories with fake security alerts for Microsoft's Visual Studio Code, using fabricated CVEs to create a sense of urgency. The posts, often impersonating security researchers, trick users into downloading what they believe is a patched version of VS Code from external links. These downloads, however, deliver malware, turning a trusted developer platform into a potent malware distribution channel.

Swiss Critical Infrastructure Hit by 325 Cyberattacks in One Year

The Swiss Federal Office for Cybersecurity has revealed that it received 325 mandatory reports of cyberattacks against the nation's critical infrastructure in the past year, averaging nearly one incident per day. The report, which covers the first year of a new mandatory reporting law, shows the administrative sector was the most frequent target, followed by IT, telecommunications, and financial institutions. Hacking, DDoS attacks, and malware were among the most common attack vectors reported.

New Phishing-as-a-Service "EvilTokens" Abuses Microsoft's OAuth Device Code Flow

A new and sophisticated Phishing-as-a-Service (PhaaS) platform named EvilTokens is enabling widespread attacks against Microsoft 365 accounts. The service automates the process of stealing access tokens by abusing the legitimate OAuth 2.0 device code authentication flow. This technique allows attackers to bypass certain types of MFA and gain persistent access to a victim's cloud account, even if the user changes their password. The EvilTokens kit provides a turnkey solution for criminals, complete with phishing templates and a dashboard for managing stolen tokens, significantly lowering the bar for conducting advanced cloud-based attacks.

Middle East Conflict Amplifies Global Cyber Risks, Reshaping Threat Landscape

The ongoing conflict in the Middle East is significantly reshaping the global cyber threat landscape, according to a new report from the World Economic Forum. The conflict has fueled a surge in state-aligned and proxy hacking operations that target critical infrastructure, businesses, and government institutions far beyond the immediate geographic region. This new era of hybrid warfare, where cyber operations are a standard tool in geopolitical disputes, has forced 91% of large organizations to alter their cybersecurity strategies in response to the heightened volatility. The report highlights attacks on sectors like healthcare and energy, and the physical vulnerability of undersea communication cables.

European Commission Hit by Data Breach; Attacker Claims 350GB Exfiltrated from AWS Cloud

The European Commission has confirmed a data breach affecting its cloud infrastructure hosted on Amazon Web Services (AWS). The attack targeted the Europa.eu websites, and an attacker has claimed to have exfiltrated over 350 GB of data, allegedly including databases and employee records. The Commission has stated that its internal systems were not affected and that the attacker has not made any extortion demands. This incident follows a separate breach of the Commission's mobile device management system in January 2026 and highlights the persistent cyber threats facing major government entities. In response, the EU has pledged to strengthen the security of its critical services.

CISA Warns of "BridgeSiphon" Zero-Day Exposing Passwords in Hybrid Cloud Sync

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an emergency directive concerning "BridgeSiphon," a critical zero-day vulnerability impacting hybrid cloud environments. The flaw, found in a widely used data synchronization protocol, allows attackers to intercept and exfiltrate plaintext passwords as data moves between on-premise and cloud infrastructure. This poses a severe risk of credential theft, lateral movement, and widespread system compromise. The directive mandates immediate action from all federal agencies to audit their hybrid connections and apply mitigations while a permanent patch is developed.

AT&T Probes Massive Data Breach as 70 Million Customer Records Surface on Dark Web

Telecommunications giant AT&T has launched a full-scale investigation after a database containing the sensitive personal information of approximately 70 million current and former customers was leaked on a dark web forum. The dataset, which reportedly dates back to 2021, includes highly sensitive PII such as Social Security numbers, dates of birth, and home addresses. The breach places millions at significant risk of identity theft, financial fraud, and targeted phishing campaigns. AT&T is advising customers to monitor their accounts and has stated it will offer credit monitoring services.

Serbian Clinic's Patient Data Leaked by Ransomware Group After Refusing to Pay

In a severe violation of patient privacy, a Serbian gynecology clinic has had its entire patient database leaked on the dark web. The data dump occurred after the clinic refused to pay a ransom demand from a cybercriminal group that had encrypted its systems. The leaked information includes names, contact details, and extremely sensitive clinical notes, placing thousands of patients at risk of blackmail and public exposure. The incident underscores the ruthless tactics of modern ransomware gangs targeting the healthcare sector and the devastating real-world consequences of such attacks.

Major Data Leak at Malaysian Car Park Operator Imej Parking Exposes Government Data

Imej Parking Sdn Bhd, a major car park operator in Malaysia, has suffered a significant data breach after a large MySQL database was found exposed on the internet. The leak, attributed to a server misconfiguration, contains a wide array of sensitive information, including the company's internal records, customer data, and, most critically, data related to its government contracts. This third-party breach highlights the cascading risks within supply chains, as the exposure of a vendor's data has led to a potential compromise of government information. Malaysian authorities have been alerted and are assessing the full scope of the incident.

Global Cyber Incidents Surge: State-Sponsored Attacks, Financial Fraud, and AI-Powered Malware on the Rise

The global threat landscape is experiencing a significant escalation, with a notable surge in diverse and sophisticated cyberattacks over the past 24 hours. Key trends include state-sponsored actors, allegedly linked to China, targeting critical telecommunications infrastructure in nations like Canada, with the threat actor ShinyHunters implicated in a breach at Telus. Concurrently, attackers are evolving their TTPs, leveraging AI for more adaptive malware and increasingly targeting operational technology (OT) to threaten physical safety. This convergence of geopolitical espionage, high-tech criminal activity, and threats to critical infrastructure signals a new, more dangerous phase in cybersecurity.

Warning to Developers: Malicious Logic Bombs Found in Popular IDE Extensions

A significant software supply chain threat has emerged as security researchers have discovered malicious logic bombs hidden within several popular coding extensions for Integrated Development Environments (IDEs). The malicious code is designed to remain dormant until a specific future timestamp. Upon activation, the payload triggers and locks the host system, effectively rendering the developer's machine unusable. This attack vector targets developers directly through the trusted tools they use daily, raising serious concerns about the security of third-party extension marketplaces and the software development lifecycle itself.

New Android Trojan "AudioSignature Hijack" Eavesdrops on Conversations Using Vibration Sensors

Mobile security researchers have uncovered a highly sophisticated Android Trojan, dubbed "AudioSignature Hijack 2.0," that employs a novel technique to eavesdrop on conversations without requesting microphone permissions. The malware leverages the device's built-in vibration sensors (accelerometers) to detect microscopic vibrations caused by sound waves in the surrounding environment. A complex algorithm then processes this sensor data to reconstruct the audio, allowing attackers to spy on users' conversations covertly. This side-channel attack represents a significant threat to mobile privacy, as it bypasses a fundamental security control in the Android operating system.

Coordinated Cyber-Physical Attack on North American Battery Storage Facilities Causes Physical Damage

A highly sophisticated cyber-physical attack has targeted multiple lithium battery storage facilities across North America, resulting in significant physical damage to critical energy infrastructure. Attackers demonstrated a deep understanding of electrical engineering by gaining remote access to the facilities' Industrial Control Systems (ICS) and manipulating voltage settings. They carefully modulated the voltage to create harmonic resonance, a condition that caused substation transformers to overheat and fail catastrophically. This incident is a chilling real-world example of how digital intrusions can be leveraged to cause tangible, destructive effects, raising urgent concerns about the security of the modern power grid.

G20 Nations Sign Landmark Data Sovereignty Protocol to Govern Cross-Border Data Flows

In a significant move towards international cooperation on digital governance, the G20 nations have signed a new data sovereignty protocol. The non-binding agreement, finalized on March 28, 2026, aims to create a common framework for the secure and responsible transfer of data across borders. It seeks to balance the economic benefits of the free flow of data with the growing need for robust data protection, privacy, and national security. The protocol establishes key principles like data minimization and purpose limitation, representing a critical diplomatic step in harmonizing global data governance policies amidst escalating cyber threats.

Middle East Cyber Conflict Escalates Following Military Strikes on Iran

Coordinated military strikes against Iran on February 28, reportedly involving the U.S. and Israel, have ignited a significant escalation in cyber warfare across the Middle East. Security firms have issued heightened threat advisories, warning of disruptive attacks from state-aligned actors and hacktivists. Pro-Iran groups, such as 'Handala Hack,' have launched DDoS attacks, defacements, and data leak campaigns targeting government, aviation, and financial sectors in Israel and other regional nations. The conflict has also severely disrupted civil aviation, with hundreds of flights cancelled amid safety concerns.

Cloud Sweep Group's "Phase 30" Attack Embeds Ransomware in Cold Storage Backups, Defeating Recovery Efforts

The notorious threat actor group "Cloud Sweep" has launched "Phase 30," a sophisticated new attack campaign that targets cold storage backups. The group's novel technique involves embedding dormant malware into data archives during the backup process. When an organization attempts to restore from the compromised backup, the malware activates, re-encrypts the system, and sabotages the recovery effort, effectively creating a ransomware time bomb within the last line of defense.

Triple Threat: Canada's Top Telecoms Rogers, Telus, and Freedom Mobile Hit by Data Breaches

Canada's telecommunications sector is under fire after three of its largest carriers—Rogers, Telus, and Freedom Mobile—each reported significant data breaches. The incidents, which occurred within the same week, exposed customer information such as names, contact details, and account numbers. The breaches highlight systemic vulnerabilities, particularly related to third-party and subcontractor access. Rogers and its subsidiary Fido confirmed unauthorized access to customer data, while Telus was targeted by the 'ShinyHunters' hacking group, which claimed to have stolen nearly a petabyte of data. Freedom Mobile suffered its second breach in six months due to compromised subcontractor credentials, prompting all three companies to enhance their security protocols.

CRITICAL: Telegram Hit by 9.8-Rated Zero-Click RCE Flaw on Android & Linux

A critical zero-click remote code execution (RCE) vulnerability has been discovered in the Telegram messenger application, affecting both Android and Linux versions. The flaw, tracked as ZDI-CAN-30207, has been assigned a CVSS score of 9.8 out of 10, reflecting its extreme severity. An attacker can exploit this vulnerability by simply sending a specially crafted animated sticker to a victim. No user interaction is required; the malicious code executes as soon as the media is viewed. A successful exploit could grant the attacker full control over the user's account and correspondence. Reports suggest an exploit is already being sold in underground communities. Telegram has not yet released a patch.

INC Ransomware Leaks 500GB of Data from Namibia Airports Company on Dark Web

The Namibia Airports Company (NAC) has confirmed that approximately 500GB of sensitive data stolen during a ransomware attack has been published on the dark web. The attack, attributed to the INC Ransomware Group, was first detected on March 6, 2026. The threat actors employed double-extortion tactics, exfiltrating the data before encrypting systems and demanding a ransom. A preliminary assessment of the leaked data suggests it includes sensitive files such as airport permit records, financial documents, engineering plans, and internal reports. While airport operations were not affected, the NAC is investigating the full scope of the breach, which marks the second known attack in Namibia by the INC Ransomware Group.

Iran-Linked 'Handala Hack Team' Breaches Personal Gmail of FBI Director Kash Patel

The personal Gmail account of FBI Director Kash Patel has been compromised by an Iran-linked hacking group calling itself the 'Handala Hack Team.' The group claimed responsibility for the breach and subsequently leaked personal data, including photographs, emails, and documents from 2010 to 2019. The FBI has confirmed the breach of the director's personal account. In its claim, the Handala group stated the attack was a response to U.S. government actions and boasted about its ability to penetrate 'impenetrable' systems. The same group has also been linked to a separate leak of personal data belonging to Israeli government and military personnel, highlighting a pattern of targeting high-profile government officials.

Supreme Court to Decide FCC's Power to Fine Telcos for Customer Data Breaches

The U.S. Supreme Court is set to hear a pivotal case, FCC v. Verizon and AT&T v. FCC, concerning the Federal Communications Commission's (FCC) authority to penalize wireless carriers for failing to protect customer data. The case stems from fines the FCC issued in 2020 after an investigation found major carriers were selling access to customers' sensitive location data without reasonable safeguards. A coalition including two former FCC Chairs and several consumer advocacy groups has filed a brief in support of the FCC, arguing that stripping the agency of its enforcement power would leave consumers without a meaningful remedy for privacy violations. The carriers contend the FCC overstepped its authority, and the court's decision will have significant implications for consumer data privacy regulation in the U.S.

'ClickFix' Campaign Tricks macOS Users into Installing Infiniti Stealer via Fake CAPTCHA

A social engineering campaign dubbed 'ClickFix' is targeting macOS users with a sophisticated ruse to install the 'Infiniti Stealer' malware. The attack begins with a fake Cloudflare CAPTCHA page that, instead of presenting a puzzle, instructs the user to open their Terminal and run a malicious command to 'prove they are human.' This user-initiated execution triggers a multi-stage infection chain involving a Bash script and a Nuitka loader, which ultimately deploys the Python-based Infiniti Stealer. The malware is designed to harvest a wide array of sensitive data, including browser credentials, macOS Keychain contents, cryptocurrency wallets, and developer secrets, before exfiltrating the stolen information to the attacker's C2 server.

EU and Australia Issue New Cybersecurity Guidance as Regulatory Focus Sharpens

Governments are continuing to tighten cybersecurity regulations, with new guidance issued in the European Union and Australia on March 4, 2026. The European Commission launched a public consultation for its upcoming Cyber Resilience Act (CRA), aimed at helping manufacturers of connected devices prepare for new security obligations. Simultaneously, the Office of the Australian Information Commissioner (OAIC) released guidance clarifying the balance between privacy obligations and reporting requirements under Australia's Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) Act. These moves, along with legislative proposals being developed in Sweden and new internet code guidance in Nigeria, signal a growing global trend toward more stringent, government-mandated cybersecurity standards.

Police Physically Warn Firms of Critical Unpatched RCE Flaw in PTC Windchill

A critical remote code execution (RCE) vulnerability in PTC's Windchill and FlexPLM software, tracked as CVE-2026-4681 with a CVSS score of 10.0, has prompted an unprecedented response in Germany. Police officers were physically dispatched, some in the middle of the night, to warn companies of the imminent threat. The flaw, which allows unauthenticated remote code execution, has not yet been patched by PTC, though mitigation guidance is available. The U.S. CISA has since issued its own advisory, highlighting the global risk to manufacturing and aerospace sectors.

China-Linked 'Red Menshen' APT Creates 'Digital Sleeper Cells' in Telecoms with BPFDoor

A long-running espionage campaign attributed to a China-linked threat actor dubbed 'Red Menshen' has been uncovered targeting telecommunications providers across the Middle East and Asia. Active since at least 2021, the group utilizes a highly sophisticated and passive Linux backdoor known as BPFDoor. This implant operates at the kernel level and only activates upon receiving a specific 'magic packet,' allowing it to remain dormant and evade detection while creating 'digital sleeper cells' for persistent surveillance and high-level espionage.

CISA KEV Alert: Actively Exploited Flaws in Langflow AI Framework and Trivy Scanner

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The first, CVE-2026-33017, is a critical unauthenticated RCE in the popular AI framework Langflow, which was reportedly exploited within 20 hours of disclosure. The second, CVE-2026-33634, is a supply chain compromise in Aqua Security's Trivy vulnerability scanner where malicious code was embedded. Federal agencies are now required to patch these flaws on an accelerated timeline.

Ransomware Dip Masks Alarming Rise in Nation-State Attacks on Critical Infrastructure

The Waterfall Threat Report 2026 reveals a complex shift in the industrial cyberattack landscape. While publicly recorded cyber incidents against heavy industry with physical consequences fell by 25% in 2025, this masks a more dangerous trend: attacks by nation-states and hacktivists on critical infrastructure doubled during the same period. The report suggests the slowdown in ransomware, the primary cause of such incidents in recent years, is temporary and that these attacks are expected to rebound in 2026.

New 'Uragan' Ransomware Emerges, Using Double Extortion Against Windows Systems

Researchers at CYFIRMA have discovered a new strain of ransomware named 'Uragan' on underground forums. This file-encrypting malware targets Windows systems, appending a '.uragan' extension to encrypted files and dropping a ransom note named 'README.txt'. The operators employ double extortion tactics, threatening to leak sensitive data exfiltrated from the victim's network if the ransom is not paid. No decryption tool is currently available.

Ransomware Attack Cripples Indiana Sheriff's Office, Forcing Full System Rebuild

The Jackson County Sheriff's Office in Indiana has suffered a devastating ransomware attack that has completely disabled its entire computer network. The attack, believed to have originated from a malicious email, has corrupted all computers, Wi-Fi, and the department's report filing system. Officials have stated they will not pay the ransom and are in the process of wiping all machines, replacing hardware, and rebuilding their IT infrastructure from scratch. Deputies have resorted to manual processes and working from a neighboring police department's facility.

Sophisticated AiTM Phishing Campaign Targets TikTok for Business Accounts to Bypass MFA

A sophisticated phishing campaign is actively targeting TikTok for Business accounts using adversary-in-the-middle (AiTM) techniques to bypass multi-factor authentication. According to researchers at Push Security, the attack uses a multi-stage process involving Google Storage URLs and Cloudflare CAPTCHA challenges to evade detection and filter out bots. The AiTM phishing kit allows attackers to steal not only usernames and passwords but also session cookies and MFA codes in real-time, enabling complete account takeover for use in fraudulent advertising or malware distribution.

Russia's Pawn Storm (APT28) Targets Defense Supply Chain with New 'PRISMEX' Malware and Zero-Day

The prolific Russia-aligned threat group Pawn Storm (also known as APT28 or Fancy Bear) is conducting a new campaign targeting the defense supply chain of Ukraine and its allies. According to Trend Micro, the group is deploying a new modular malware collection called PRISMEX. This sophisticated toolkit uses advanced evasion techniques like steganography and COM hijacking. The campaign has actively exploited multiple vulnerabilities, including a confirmed zero-day in Microsoft Windows, CVE-2026-21513, underscoring the group's high level of capability and determination.

Protos Labs Challenges Threat Intel Market with Freemium Agentic AI Platform

Singapore-based Protos Labs has launched a freemium edition of its Protos AI platform at RSA Conference 2026, aiming to disrupt the traditional cyber threat intelligence (CTI) market. The platform utilizes specialized, coordinated AI agents to automate the entire CTI lifecycle, from planning and evidence collection to analysis and reporting. By offering a freemium tier, Protos Labs seeks to democratize access to advanced CTI capabilities for smaller organizations while allowing large enterprises to augment their existing security teams. The solution is designed to be vendor-agnostic, integrating with existing security stacks and supporting multiple LLMs, including those from Azure OpenAI, Anthropic, and Google Gemini.

Ontario Enforces New Cybersecurity and Data Transparency Regulations for Public Sector

The government of Ontario, Canada, has filed two new regulations, O. Reg. 51/26 and O. Reg. 52/26, which will come into force on July 1, 2026. These regulations impose significant new cybersecurity and data privacy obligations on public sector entities, including hospitals, universities, school boards, and children's aid societies. O. Reg. 51/26 mandates the establishment of a formal cybersecurity program, the designation of a senior leader responsible for cybersecurity, regular maturity assessments, and a 72-hour reporting deadline for critical incidents. O. Reg. 52/26 introduces new transparency requirements for school boards regarding the disclosure of student data to third-party software providers.

Darktrace Replaces Security Training with 'Adaptive Human Defense'

At RSA Conference 2026, AI cybersecurity firm Darktrace launched 'Adaptive Human Defense,' a new product that shifts away from traditional, scheduled security awareness training. Instead, the platform uses behavioral AI to monitor user actions in real-time and delivers personalized, contextual 'micro-coaching' sessions at the exact moment a risky behavior is detected, such as interacting with a suspicious email. The system creates a feedback loop with Darktrace's email security solution, using the coaching results to automatically tune security controls for each individual user, thereby creating a personalized defense that strengthens both human and technical layers simultaneously.

NetRise Launches 'Provenance' to Uncover Contributor Risk in Software Supply Chains

Software supply chain security firm NetRise has launched 'Provenance,' a new product announced at RSA Conference 2026 designed to identify risks associated with the individual contributors and organizations behind open-source components. Moving beyond traditional SBOMs and vulnerability scanning, Provenance provides intelligence on the people and entities writing the code that enterprises rely on. The tool helps organizations identify potentially malicious contributors, understand their 'blast radius' across the software ecosystem, and enforce policies based on contributor risk, such as geographic location, to meet compliance obligations like OFAC.

Co-op CEO Resigns as Cyber-Attack Fallout Leads to £126 Million Loss

Shirine Khoury-Haq, the chief executive of the UK's Co-op Group, is stepping down effective March 29, 2026. Her departure follows the company's announcement of a £126 million pre-tax loss for the year, a dramatic reversal from the previous year's profit. The company directly attributed a significant portion of this financial damage to a major cyber-attack in April 2025, which caused widespread disruption, including payment problems and product shortages. The incident reportedly had a direct impact of £285 million on revenues and contributed £107 million to the profit loss, serving as a stark case study on the severe, real-world business consequences of a major cyber incident.

Cisco Firewall Zero-Day Exploited by Interlock Ransomware for Over a Month Before Patch

A critical insecure deserialization vulnerability in Cisco's Secure Firewall Management Center (FMC), tracked as CVE-2026-20131, was exploited as a zero-day by the Interlock ransomware gang. Amazon's threat intelligence team discovered that exploitation began on January 26, 2026, a full 36 days before Cisco released a patch in early March. The flaw allows an unauthenticated remote attacker to execute arbitrary Java code with root privileges on the management interface. Following the discovery of in-the-wild exploitation, CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by March 22, 2026. Cisco strongly advises against exposing the FMC management interface to the internet.

FCC Issues Sweeping Ban on All Foreign-Produced Consumer Routers Citing National Security Risks

The U.S. Federal Communications Commission (FCC) has enacted a sweeping ban on the import and authorization of all new models of foreign-produced consumer-grade wireless routers. The devices have been added to the FCC's "Covered List" following a White House determination that they pose an unacceptable risk to U.S. national security. The move is aimed at preventing espionage and attacks on critical infrastructure by state-sponsored actors like Volt Typhoon. While not naming a specific country, the ban will significantly impact Chinese firms like TP-Link and any U.S. companies that manufacture their devices overseas. Existing inventory can still be sold, but no new models can be introduced to the U.S. market without FCC approval under a new, stricter regime.

Wealth Manager Hightower Holding Discloses Data Breach Affecting Over 131,000 Clients

Chicago-based wealth management firm Hightower Holding has disclosed a data breach that exposed the sensitive personal information of 131,483 clients. The breach occurred across two separate incidents in January 2026, where an unauthorized actor gained access to the company's network via compromised user accounts and exfiltrated files. The stolen data includes full names, Social Security numbers, and driver's license numbers. The company discovered the breach on March 12 and began notifying victims on March 23, a delay that has prompted investigations by multiple law firms for a potential class-action lawsuit.

CISA Adds Actively Exploited Langflow Code Injection Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a code injection vulnerability in Langflow, CVE-2026-33017, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that the vulnerability is being actively exploited in the wild. Langflow is a user interface for the popular LangChain application development framework, making this a significant threat to organizations developing AI and LLM-based applications. In accordance with Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch agencies are now required to remediate this vulnerability by a specified deadline.

NIST Releases New Quick-Start Guides to Boost Adoption of Cybersecurity Framework 2.0

The U.S. National Institute of Standards and Technology (NIST) has released two new quick-start guides to help organizations implement its Cybersecurity Framework (CSF) 2.0. The first guide, SP 1308, focuses on integrating cybersecurity with enterprise risk management (ERM) and workforce planning, bridging the gap between technical teams and executive leadership. The second, a draft guide (SP 1347), explains how to use CSF 2.0's "Informative References" to map security outcomes to other standards and practices. These resources aim to make the updated framework more accessible and operational for a wider range of organizations.

Nike Faces Class-Action Lawsuit Over January Data Breach

Nike Inc. is the target of a proposed class-action lawsuit filed in Oregon over a data breach the company discovered on a third-party portal in January 2026. The lawsuit alleges that the sportswear giant failed to implement adequate security measures to protect customer data and violated the law by waiting a month to begin notifying affected individuals. The complaint accuses Nike of breaching its duties under the FTC Act, contract law, and common law, seeking to represent a class of all individuals whose data was compromised in the incident.

Microsoft Teams Phishing Campaign Uses Quick Assist to Deploy 'A0Backdoor' Malware

A social engineering campaign is targeting enterprise users on Microsoft Teams to deploy a malware strain named 'A0Backdoor'. Reported on March 20, 2026, the attack begins with attackers contacting employees directly on Teams. They then trick the target into granting remote access to their machine using the legitimate Windows Quick Assist tool. Once access is established, the attackers manually deploy the A0Backdoor malware, which allows them to infiltrate the corporate network, escalate privileges, and maintain persistence. The campaign, which primarily targets the financial and healthcare sectors, highlights the growing abuse of trusted internal collaboration platforms as a vector for initial access and lateral movement.

SOCs Pivot to Autonomous Defense to Counter Machine-Speed AI Attacks

A February 24, 2026 analysis argues that the modern Security Operations Center (SOC) is at a tipping point, forced to pivot towards autonomous, AI-driven defense strategies. This shift is a direct response to the crisis of scale created by adversaries who are already using AI and automation to launch attacks at machine speed. With threat actors leveraging LLMs for flawless phishing and scripts to scan thousands of targets, manual human-led defense is no longer viable. The report frames autonomous security not as a replacement for human analysts, but as a necessary augmentation to handle high-volume tasks, reduce burnout, and free up experts for strategic threat hunting and response.

Analysts Warn of 'Cyber Spillover' as US-Iran Tensions Escalate, Threatening Global Orgs

An editorial analysis published on March 6, 2026, warns of the increasing risk of 'cyber spillover' from the escalating geopolitical conflict between the United States and Iran. Security experts note that Iranian state-sponsored actors and affiliated hacktivist groups have intensified disruptive campaigns, including DDoS attacks and phishing, against Western commercial, financial, and critical infrastructure targets. There is a growing concern that these targeted attacks could cause unforeseen collateral damage to organizations not directly involved in the conflict, prompting calls for a 'shields up' posture.

Citrix Scrambles to Patch Critical 'CitrixBleed'-like Flaw in NetScaler Products

Citrix has issued an urgent patch for CVE-2026-3055, a critical (CVSS 9.3) out-of-bounds read vulnerability in its NetScaler ADC and Gateway products. The flaw allows unauthenticated remote attackers to read sensitive memory contents, such as session tokens, from appliances configured as a SAML Identity Provider (IdP). Security researchers warn that the vulnerability is poised for imminent exploitation, drawing strong parallels to the widely exploited CitrixBleed flaw. While there is no evidence of active attacks yet, the public disclosure of patches makes reverse-engineering and exploit development highly likely. A second high-severity flaw, CVE-2026-4368, was also addressed.

Kaplan Data Breach Exposes SSNs and Driver's Licenses of Over 230,000 People

Kaplan North America, a major educational services provider, is notifying over 230,000 individuals that their highly sensitive personal information was stolen in a data breach. The incident, which occurred between October 30 and November 18, 2025, resulted in the exfiltration of names, Social Security numbers, and driver's license numbers. The breach has affected individuals in at least seven U.S. states, with the largest impact in Texas. Multiple law firms have already initiated investigations and class-action lawsuits against Kaplan in response to the disclosure.

QualDerm Healthcare Data Breach Exposes Personal and Medical Info of 3.1 Million Patients

QualDerm Partners, a healthcare management services organization, is notifying over 3.1 million individuals of a major data breach that occurred in December 2025. During a two-day period of unauthorized network access, attackers exfiltrated a vast amount of sensitive data, including patient names, addresses, dates of birth, medical record numbers, treatment details, diagnoses, health insurance information, and some government-issued IDs. The scale and sensitivity of the compromised data make this a critical incident, placing millions of patients at risk of fraud and identity theft.

Russian Initial Access Broker for Yanluowang Ransomware Jailed for 81 Months in US

Aleksei Volkov, a 26-year-old Russian citizen, has been sentenced to 81 months in U.S. federal prison for his role as a prolific initial access broker (IAB). Volkov admitted to hacking into U.S. companies and selling that unauthorized access to ransomware groups, including the notorious Yanluowang gang. His activities facilitated dozens of attacks that resulted in over $9 million in actual losses to victims. Volkov was arrested in Italy, extradited to the U.S., and pleaded guilty in November 2025. He has also been ordered to pay over $9.1 million in restitution.

Iran-Linked Pay2Key Ransomware Targeted US Healthcare Amidst Military Conflict

The Iranian-linked ransomware group Pay2Key targeted a U.S. healthcare organization in late February 2026, coinciding with military conflict between the U.S. and Iran. Incident responders noted that the attack used an evolved strain of the Pay2Key ransomware but, unusually, did not involve data exfiltration. This deviation from typical financially motivated attacks suggests a potential dual motive of disruption and espionage, consistent with Iranian state-sponsored operations. The attackers compromised an administrative account days before deploying the ransomware and attempted to wipe event logs to cover their tracks.

Cybercrime Automation: Attacker Handoff Time Plummets from 8 Hours to 22 Seconds

The 2025 Google M-Trends report from Mandiant reveals a stunning increase in the efficiency of cybercriminal operations. The time between an initial network compromise and the handoff to a secondary attacker, such as a ransomware group, has plummeted from eight hours in 2022 to just 22 seconds in 2025. This points to highly integrated and automated partnerships in the cybercrime ecosystem. The report also highlights a surge in voice-based phishing (vishing) as a top initial access vector, while noting that global median dwell time has risen to 14 days, skewed by long-running espionage campaigns.

Semiconductor Firm Trio-Tech's Singapore Unit Hit by Gunra Ransomware

Trio-Tech International, a U.S.-based semiconductor services firm, has confirmed its Singaporean subsidiary was hit by a ransomware attack on March 11. The Gunra ransomware operation has claimed responsibility. In an SEC filing, the company initially stated the incident was not material, but later revised its assessment after the attackers began leaking stolen data online. The subsidiary has now activated its incident response plan, is working with cyber insurance, and is notifying affected parties. The event highlights how a contained ransomware incident can quickly escalate to a data breach crisis.

Poland Reports 150% Surge in Cyberattacks, Cites Unprecedented Assault on Energy Grid

A Polish government official has revealed a dramatic 150% increase in cyberattacks against the country in 2025, totaling 270,000 incidents. The surge included a sophisticated and coordinated attack in December on Poland's energy system, which targeted a major heat and power plant and multiple renewable energy farms. Polish authorities believe the attack, described as a 'significant escalation' for a NATO member, originated from a single actor linked to Russian secret services. While the electricity supply was not disrupted, the incident has raised significant alarms about the vulnerability of critical infrastructure.

Network Gear Surpasses Endpoints as Top Cyber Risk, Forescout Warns

Forescout's 2026 'Riskiest Connected Devices' report reveals a major shift in enterprise risk, with network infrastructure like routers and switches now posing a greater threat than traditional endpoints. These core network devices, which average nearly 32 vulnerabilities each, are heavily targeted by attackers for lateral movement and persistence. The report highlights a diversifying attack surface, with 40% of the riskiest device types being new to the list this year, including OT, IoT, and IoMT devices. This signals a clear trend of attackers focusing on often-unmanaged, high-impact devices within the network.

URGENT: Oracle Patches Critical 9.8 CVSS Unauthenticated RCE Flaw

Oracle has released an emergency, out-of-band security update for a critical remote code execution (RCE) vulnerability, CVE-2026-21992. The flaw, which affects Oracle Identity Manager and Oracle Web Services Manager, carries a CVSS score of 9.8 and can be exploited by an unauthenticated attacker over HTTP. A successful exploit could lead to a complete system takeover, allowing attackers to exfiltrate sensitive identity data, deploy malware, and pivot within the corporate network. Due to the flaw's ease of exploitation and the critical role of the affected products in enterprise identity management, Oracle strongly urges customers to apply the patches immediately. The out-of-band release suggests a high risk of active exploitation.

CISA KEV Catalog Updated: Federal Agencies Must Patch Exploited Flaws in Apple, Laravel, Craft CMS

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws include an out-of-bounds write issue in Apple visionOS (CVE-2026-28217), a remote code execution bug in the Laravel Framework (CVE-2024-4671), and a critical cross-site scripting (XSS) vulnerability in Craft CMS (CVE-2026-25487) that allows for admin account creation. The inclusion in the KEV catalog signifies that these vulnerabilities are being actively used in real-world attacks. U.S. federal agencies are now mandated to apply patches by April 12, 2026, and CISA strongly urges all organizations to prioritize remediation to defend against these active threats.

Navia Benefit Solutions Breach Exposes PII and PHI of 2.7 Million People

Navia Benefit Solutions, a third-party administrator of employee benefits, has disclosed a significant data breach impacting nearly 2.7 million individuals. The company revealed that an unauthorized party had access to its network for three weeks, from December 22, 2025, to January 15, 2026. The compromised data includes a vast amount of personally identifiable information (PII) and protected health information (PHI), such as names, Social Security numbers, dates of birth, and health plan details. While financial and claims data were not exposed, the breach affects current and former members of over 10,000 employers. Navia is providing 12 months of identity theft protection to affected individuals.

Over 7,500 Magento E-Commerce Sites Defaced in Ongoing Global Campaign

A widespread and ongoing defacement campaign has compromised over 7,500 websites running the Magento e-commerce platform since late February 2026. The attackers, using aliases like 'Typical Idiot Security', are exploiting a suspected file upload vulnerability to place simple text files on web servers, leading to site defacement. The campaign appears opportunistic, affecting a diverse range of victims from regional storefronts and subdomains of major brands like Toyota, Asus, and FedEx to government services and universities. While largely driven by notoriety-seeking actors, the campaign highlights a significant vulnerability in the Magento ecosystem that could be exploited for more malicious purposes, such as deploying web shells or credit card skimmers.

WorldLeaks Ransomware Claims Attack on City of Los Angeles, Leaks Police Data

The City of Los Angeles has been listed as a victim on the darknet leak site of the WorldLeaks ransomware group. The group, believed to be a rebrand of the Hunters International gang, claims to have stolen nearly 160 GB of data and has published pages from a police interview transcript as proof of the breach. This incident is a data extortion attack, where the group forgoes encryption and focuses solely on data theft and the threat of public release. The attack coincides with other cyber incidents in California, including a disruption at the Los Angeles Metro system and a ransomware attack that prompted a state of emergency in Foster City, highlighting a trend of cybercriminals targeting municipal services.

Warning: Critical 10.0 CVSS Quest KACE Flaw from 2025 Now Actively Exploited

A critical authentication bypass vulnerability in the Quest KACE Systems Management Appliance (SMA), CVE-2025-32975, is being actively exploited in attacks observed in March 2026. The flaw, which has a perfect CVSS score of 10.0 and was patched in May 2025, allows an unauthenticated attacker to gain full administrative control of an unpatched, internet-exposed appliance. Attackers are leveraging this access to deploy credential harvesting tools like Mimikatz, create rogue admin accounts for persistence, and move laterally to other critical systems like domain controllers and backup servers. The new wave of attacks highlights the danger of unpatched legacy vulnerabilities, and all organizations using KACE SMA are urged to verify they are patched and remove the appliance from public internet exposure.

Puerto Rico Water Authority Hit by Cyberattack, Exposing Customer and Employee Data

The Puerto Rico Aqueduct and Sewer Authority (PRASA) has confirmed it was the victim of a cyberattack that resulted in the exposure of customer and employee data. The utility, which is responsible for the territory's water supply, stated that critical water distribution and management systems were not affected. PRASA credited its network segmentation, which separates the operational technology (OT) systems from the business information technology (IT) network, for containing the impact and preventing a disruption to the water supply. Details on the nature of the attack, the volume of data breached, and the number of individuals affected have not yet been disclosed.

New 'Perseus' Malware with Espionage Features Used by Drug Cartels

Security researchers have identified a new malware strain named 'Perseus,' reportedly developed for and used by Drug Trafficking Organizations (DTOs) to conduct espionage against targets like journalists, officials, and rival groups. Perseus is a sophisticated information stealer with capabilities for keylogging, credential theft from browsers, and monitoring encrypted messaging apps. A key feature is its ability to take detailed notes on victim activity for exfiltration. The malware also includes a 'kill switch' that allows operators to remotely wipe all traces of it from a compromised system, a common feature in advanced espionage tools designed to evade forensic analysis. This highlights the growing technical sophistication of non-state criminal actors.

A Look Inside 'The Gentlemen': A Sophisticated RaaS Operation

Security researchers have published detailed profiles of 'The Gentlemen,' a Ransomware-as-a-Service (RaaS) operation that emerged in mid-2025 and has been targeting organizations across at least 17 countries. The group employs a double-extortion strategy, exfiltrating sensitive data before encrypting files on Windows, Linux, and ESXi systems. Their ransomware, written in Go, exhibits a degree of sophistication, requiring a password to execute to hinder analysis. The group's TTPs include using legitimate remote access tools like AnyDesk for persistence, abusing Group Policy Objects (GPOs) for mass deployment, disabling security products, and using WinSCP for data exfiltration. The reports serve as a timely warning about this active and evolving global threat.

G7 Responds with GNSS Resilience Act as GPS Spoofing Attacks Cripple Global Aviation and Threaten Power Grids

A wave of sophisticated GPS spoofing attacks is targeting civil aviation and critical infrastructure across the Middle East and Europe. Attackers are using "time skew sabotage" to disrupt aircraft automated landing systems and attempting "flow reversal" attacks on solar farms to destabilize power grids. In a swift response, G7 nations have introduced the GNSS Resilience Act, mandating inertial backup systems for transit. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also issued Emergency Directive 26-24 to address the escalating cyber-physical threats.

"Bband Siphon 16.0" Android Malware Steals Location Data Directly from Communication Chip, Works Even When Phone is Off

A novel Android malware named "Bband Siphon 16.0" has been discovered, representing a significant escalation in mobile threats. It targets the device's communication (baseband) chip directly, bypassing the OS to exfiltrate location data. Its most alarming feature is the ability to transmit data even when the device appears powered down, indicating a deep, persistent hardware-level compromise that is exceptionally difficult to detect and remove.

"Phantom Entry" Zero-Day Hits Building Management Systems; Gov Agencies Ordered to Take Smart Meters Offline

A critical zero-day vulnerability dubbed "Phantom Entry" has been discovered in building management systems (BMS), enabling unauthorized physical and logical access. The threat is considered so severe that a government directive has ordered all smart metering controllers in federal buildings to be taken offline immediately. Compounding the threat, a new backdoor called "Ghost Pointer" found in free remote work tools could be used to exploit this vulnerability, allowing attackers to manipulate systems remotely without user knowledge.

Massive Telehealth Breach Exposes 30 Million Patient Video Records, Sparking Deepfake Scam Fears

A leading international telehealth platform has suffered a catastrophic data breach, resulting in the theft of 30 million patient video consultation records. While the company remains unnamed, the scale of the breach is staggering, exposing highly sensitive and private medical interactions. Cybersecurity experts are issuing urgent warnings that this data is a goldmine for creating sophisticated deepfake scams, enabling attackers to commit fraud, extortion, and identity theft with unprecedented realism.

"LAR Blinding Attacks" Use Lasers to Deceive Autonomous Car Sensors, Creating Critical Collision Risks

A new cyber-physical attack method targeting autonomous vehicles, dubbed "LAR blinding," has been demonstrated. The attack uses coordinated lasers to jam and feed false signals into a self-driving car's sensors, such as LiDAR and cameras. This manipulation effectively blinds the vehicle, preventing it from identifying real-world obstacles and creating a severe risk of collision. The emergence of this physical-layer attack poses a critical safety challenge to the automotive industry.

New "Latent Poisoning" Attack Embeds Hidden Backdoors in AI Models, Triggered by Secret Prompts

Security researchers have discovered a sophisticated new AI attack method called "latent poisoning." This technique embeds hidden, triggerable vulnerabilities within an AI model's training data. The compromised model behaves normally until an attacker provides a specific, secret prompt (a "sleeper agent" trigger). When activated, the prompt causes the model to bypass its safety controls, potentially leading to data leakage, execution of unauthorized commands, or generation of malicious content. This stealthy attack vector poses a significant threat to the integrity and security of AI systems.

EU Proposes Mandatory Audits for AI Training Data to Combat Data Poisoning Attacks

The European Union is drafting landmark legislation aimed at securing the AI supply chain. The proposed rules would mandate that companies developing or deploying AI systems within the EU must have their training datasets audited and certified by independent security agencies. This move is a direct response to the growing threat of AI data poisoning attacks, such as the recently discovered "latent poisoning" technique, and aims to establish a new standard for AI safety and trustworthiness.

Cyber Attack Paralyzes Parking Payment System in Russian City, Highlighting Urban Infrastructure Vulnerabilities

A cyber attack has disrupted the municipal parking payment system in an unnamed Russian city, preventing citizens from paying for parking. Details regarding the type of attack, the threat actor responsible, and the duration of the outage have not yet been disclosed. The incident serves as a stark reminder of the vulnerability of smart city infrastructure and the potential for cyber attacks to cause significant disruption to daily public services.

Payload Ransomware Group Claims Attack on Royal Bahrain Hospital, Threatening Patient Data Leak

The Payload ransomware group has claimed responsibility for a cyber attack against the Royal Bahrain Hospital, listing the healthcare provider as a victim on its dark web leak site. This incident is a classic double-extortion attack, where the group has likely encrypted the hospital's systems and exfiltrated sensitive patient data. The hospital has not yet confirmed the breach, but the attack places immense pressure on the institution, threatening operational disruption and a major violation of patient privacy.

Crimestoppers Data Breach Exposes 8.3 Million Anonymous Crime Tip Records, Endangering Whistleblowers

The anonymous crime reporting service Crimestoppers has suffered a catastrophic data breach, with a threat actor claiming to have stolen and leaked 8.3 million records. This incident strikes at the heart of the service's mission, which is built on the promise of anonymity for tipsters. The exposure of this data could potentially identify and endanger individuals who have reported on criminal activity, creating a massive chilling effect on public cooperation with law enforcement.

Bit Refill Blames North Korea-Linked Hackers for Cyber Attack on Cryptocurrency Platform

The cryptocurrency gift card platform Bit Refill has publicly attributed a recent cyber attack to a hacker group linked with North Korea. While the company has not yet detailed the full impact of the attack, such as whether customer funds were stolen, the accusation points towards a sophisticated, state-sponsored operation. North Korean threat actors, like the infamous Lazarus Group, are well-known for targeting cryptocurrency services to generate revenue for the regime, suggesting the attack was likely financially motivated.

Trivy Open-Source Scanner Backdoored in Major Supply Chain Attack, Secrets at Risk

The widely-used open-source security scanner Trivy has been compromised in a sophisticated supply chain attack. Threat actors identified as TeamPCP injected a multi-stage infostealer into official Trivy binaries and GitHub Actions. The breach stemmed from an incomplete credential rotation following a previous compromise, allowing attackers to regain access and modify 75 of 76 `trivy-action` tags and publish a malicious Trivy version `0.69.4`. The malware was designed to steal a wide array of secrets, including cloud credentials, API tokens, and SSH keys from CI/CD environments. The incident has triggered urgent warnings for all users to rotate pipeline secrets, audit workflows, and verify the integrity of their scanner versions, as the malicious code was active for up to 12 hours.

Identity Protection Firm Aura Ironically Breached via Vishing, 900,000 Records Exposed

In a deeply ironic turn of events, identity theft protection company Aura has confirmed a data breach exposing the records of nearly 900,000 individuals. The incident began with a successful voice phishing (vishing) attack, where an employee was socially engineered over the phone into providing credentials. This gave attackers access to a legacy marketing database from an acquired company. The notorious ShinyHunters group claimed responsibility, stating they exfiltrated 12GB of data. The breach affects 35,000 direct Aura customers, whose names, emails, phone numbers, and addresses were exposed. The incident highlights the power of social engineering and the persistent risks of legacy systems from mergers and acquisitions.

Critical UNISOC Modem Flaw Allows Zero-Click RCE on Millions of Android Phones via Cellular Call

A critical, unpatched vulnerability has been discovered in the modem firmware of several UNISOC chipsets, affecting millions of budget and mid-range Android devices from major brands like Samsung and Motorola. The flaw, an uncontrolled recursion issue (CWE-674), allows a remote attacker to achieve arbitrary code execution simply by initiating a cellular video call and sending a specially crafted SDP message. This triggers a stack overflow in the modem's firmware, crashing it and enabling the execution of shellcode. The attack requires no user interaction beyond the device being reachable on the cellular network, posing a severe risk to users of affected devices, including the Realme C33, on which a full RCE was demonstrated.

Nordstrom Email System Hijacked to Blast Crypto Scams, Abusing Salesforce and Okta Integration

The official customer email system of retailer Nordstrom was compromised and used to send fraudulent cryptocurrency scam emails. Attackers leveraged Nordstrom's integration with Salesforce Marketing Cloud and Okta, sending emails from the trusted `nordstrom@eml.nordstrom.com` address. Disguised as a St. Patrick's Day promotion, the emails promised to double cryptocurrency deposits and successfully bypassed spam filters due to their legitimate origin. The campaign led to at least $5,600 in confirmed losses for victims. This incident follows a pattern of similar attacks on other companies, highlighting a trend of attackers targeting and abusing trusted third-party SaaS platforms to exploit brand trust and reach customers directly.

Disgruntled Affiliate Leaks 'The Gentlemen' Ransomware Gang's Playbook

The operational playbook of 'The Gentlemen,' a nascent Ransomware-as-a-Service (RaaS) operation, has been leaked by a disgruntled affiliate known as 'hastalamuerte'. The leak, stemming from a financial dispute, provides a rare, unfiltered look into the group's methods. It reveals that The Gentlemen, an offshoot of the Qilin ransomware group, employs dual-extortion tactics and targets Windows, Linux, and ESXi environments. A primary initial access vector is the exploitation of vulnerable Fortinet FortiGate VPNs. The leaked TTPs include using PowerShell and WMI for lateral movement, deploying anti-forensic tools, and using Bring Your Own Vulnerable Driver (BYOVD) exploits. The incident highlights growing instability and internal conflict within the cybercrime ecosystem.

Critical ConnectWise ScreenConnect Flaw (CVE-2026-3564) Allows Session Hijacking

ConnectWise has patched a critical cryptographic vulnerability in its ScreenConnect remote access software, tracked as CVE-2026-3564. The flaw, which affects all versions prior to 26.1, allows an unauthenticated attacker to extract unique ASP.NET machine keys from server configuration files. These keys can then be used to forge authentication tokens and hijack active remote access sessions. This is extremely dangerous as ScreenConnect is widely used by Managed Service Providers (MSPs) with high levels of privilege in client networks. While ConnectWise is not aware of active exploitation of this specific CVE, it has observed abuse of the underlying technique. All administrators are urged to update to ScreenConnect version 26.1 immediately.

International Law Enforcement Operation Dismantles Major IoT DDoS Botnets

A coordinated international law enforcement operation involving the U.S., Canada, and Germany has successfully disrupted the command-and-control (C2) infrastructure of several major IoT botnets. The operation, reported on March 20, 2026, targeted the Aisuru, Kimwolf, JackSkid, and Mossad botnets, which collectively had infected over 3 million IoT devices like routers and cameras. These botnets were rented out in a 'cybercrime-as-a-service' model to launch massive Distributed Denial-of-Service (DDoS) attacks, some reaching speeds of 30 Terabits per second. The operation involved seizing domains and servers, significantly degrading the criminals' ability to conduct attacks and offer their services.

Identity Service Providers CGI Group and Aura Hit by Data Breaches

Two separate data breaches have impacted companies in the identity services sector. IT consulting giant CGI Group, which manages Sweden's e-government platform, is investigating a breach after its data was found on the dark web. This raises concerns about the security of sensitive data for Swedish citizens who use the platform to access government services. In a separate incident, identity protection firm Aura confirmed a breach claimed by the ShinyHunters hacking collective. The attackers allegedly stole 12GB of files affecting 35,000 customers from a marketing tool used by a company Aura acquired in 2021. These incidents highlight the high value of PII and the persistent risk of third-party and supply-chain-related breaches.

Foster City Declares State of Emergency After Cyberattack Cripples Public Services

Foster City, California, has declared a state of emergency following a significant cybersecurity breach on March 19, 2026. The attack has caused a widespread shutdown of all non-emergency city services, impacting the public's ability to conduct business with the city. While police and fire departments remain operational, other municipal functions are temporarily paused. Officials have not disclosed the nature of the attack but have warned that public information may have been accessed. The city is working with external cybersecurity experts to restore systems and is encouraging residents who have done business with the city to change their passwords as a precaution.

Poland Thwarts Iran-Linked Cyberattack on National Nuclear Research Center

Polish officials announced on March 20, 2026, that they had successfully thwarted a cyberattack targeting the IT infrastructure of the country's National Center for Nuclear Research (NCBJ). While specific details about the attack's nature or methods were not disclosed, authorities have assessed that the malicious activity originated from Iran. The successful defense of a critical national research facility highlights the persistent threat of nation-state cyber espionage and attacks against sensitive scientific and infrastructure sectors. The incident comes amid a heightened state of alert in Western nations for such threats.

RSAC 2026 Preview: AI Risks and Quantum Computing Threat Dominate Agenda

As the cybersecurity industry gears up for RSA Conference 2026 in San Francisco, the agenda reveals a significant focus on two transformative technologies: agentic Artificial Intelligence (AI) and quantum computing. Key themes revolve around managing the new attack surfaces and identity challenges introduced by autonomous AI agents, and the urgent need for organizations to prepare for post-quantum cryptography (PQC). The industry conversation is shifting from theoretical discussions to practical implementation strategies, urging leaders to begin inventorying cryptographic assets and planning their migration to quantum-resistant algorithms now. The conference signals a move away from pure defense towards building long-term resilience in the face of these disruptive technologies.

LAPSUS$ Hacking Group Reemerges, Claims Breach of Pharma Giant AstraZeneca

The notorious LAPSUS$ hacking group appears to have resurfaced, claiming a significant data breach at the pharmaceutical giant AstraZeneca. In a departure from some of their previous high-profile attacks, the group is attempting to sell a 3GB archive of allegedly stolen data on illicit forums. LAPSUS$ has posted screenshots as proof, claiming the data includes Java source code, Terraform configurations for AWS and Azure, and private keys for GitHub and Jenkins pipelines. They are directing potential buyers to contact them via the Session messaging app. AstraZeneca has not yet commented on the claim, but the reemergence of this highly unpredictable and effective group is a major concern for large enterprises.

Interlock Ransomware Exploited Critical Cisco Firewall Zero-Day for 36 Days Before Patch

The Interlock ransomware group exploited a critical zero-day vulnerability, CVE-2026-20131, in Cisco's Secure Firewall Management Center (FMC) for 36 days before a patch was released. The flaw, rated 10.0 on the CVSS scale, allows for unauthenticated remote code execution with root privileges. Amazon Threat Intelligence discovered the exploitation began on January 26, 2026, well before Cisco's patch on March 4. CISA has since added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the severe risk to organizations using the affected firewall management software.

Fintech Firm Marquis Revises Breach Impact to 672,000; Akira Ransomware Suspected

Fintech provider Marquis has officially revised the number of individuals impacted by its August 2025 data breach to 672,075. The breach, which stemmed from an exploited vulnerability in a SonicWall firewall, exposed the personal and financial data of customers from over 700 financial institutions. Compromised data includes names, Social Security numbers, and financial account details. While not officially confirmed, the Akira ransomware group, known for exploiting SonicWall flaws, is suspected to be behind the attack, with some reports alleging a ransom was paid.

Dragonforce Ransomware Claims Attack on U.S. Hydraulics Firm Dynex/Rivett

The Dragonforce ransomware group has claimed responsibility for a cyberattack against Dynex/Rivett Inc., a U.S.-based manufacturer of hydraulic systems. In a post on March 18, 2026, the group announced the attack and threatened to publish a 'full leak' of stolen data if the company does not make contact to negotiate. This incident employs a typical double-extortion tactic, where data is both encrypted and stolen to maximize pressure on the victim to pay a ransom. The nature and volume of the exfiltrated data have not been specified.

Freedom Mobile Data Breach Exposes Customer PII via Compromised Subcontractor

Canadian telecom provider Freedom Mobile disclosed a data breach on March 18, 2026, that occurred in January. An unauthorized third party gained access to the company's customer account management platform for one week using the compromised credentials of a subcontractor. The breach exposed customer PII including names, addresses, dates of birth, and phone numbers. Freedom Mobile confirmed that more sensitive data like passwords and financial information was not affected, but the incident highlights the significant risks posed by supply chain security gaps.

Apple Silently Patches WebKit Flaw That Could Let Sites Steal Your Data

Apple released a silent, background security patch on March 18, 2026, to fix a cross-origin vulnerability in WebKit, its core web rendering engine. The flaw, CVE-2026-20643, could allow a malicious website to bypass the same-origin policy, a fundamental browser security feature. This would enable an attacker to access or steal data from other websites open in different tabs. The patch was delivered automatically to users on the latest versions of iOS and macOS. There is no evidence of active exploitation.

Data of 129,509 Vault Strategies Customers Leaked Online After Ransomware Attack

Data stolen from benefits administrator Vault Strategies during a December 2025 ransomware attack by the 'Incransom' group has now been made public. On March 18, 2026, a searchable database containing the extensive Personally Identifiable Information (PII) of 129,509 individuals was posted online. The exposed data includes full names, addresses, dates of birth, and Social Security numbers, placing victims at high risk of identity theft and prompting investigations into a potential class-action lawsuit.

CISA Warns of Critical Code Injection Flaw in Schneider Electric ICS Software

CISA issued an ICS advisory on March 19, 2026, for a critical code injection vulnerability, CVE-2026-2273, in Schneider Electric's EcoStruxure Automation Expert software. The flaw, with a CVSS score of 8.2, could allow an authenticated attacker to achieve arbitrary command execution by tricking a user into opening a malicious project file. This could lead to a compromise of the engineering workstation and pose a significant risk to industrial control systems. Schneider Electric has released a patched version.

Public Sector Unprepared for AI-Powered Attacks, Report Finds

A March 18, 2026 report by LevelBlue reveals that public-sector organizations are struggling to defend against a rising tide of cyberattacks, especially those enhanced by AI. The study found that nearly one-third of state, local, and education (SLED) entities suffered a breach in the last year. A concerning 44% lack full visibility into their supply chain, and only 28% feel prepared for AI-enabled threats, highlighting significant gaps in visibility, readiness, and workforce training across the public sector.

CISA Adds Actively Exploited Zimbra XSS Flaw to KEV Catalog

On March 18, 2026, CISA added a cross-site scripting (XSS) vulnerability in Synacor's Zimbra Collaboration Suite, CVE-2025-66376, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the vulnerability is being actively exploited in the wild. The flaw could allow attackers to inject malicious scripts into the web client, potentially leading to session hijacking or data theft. U.S. federal agencies are now required to remediate the vulnerability promptly.

Interlock Ransomware Weaponized Cisco Firewall Zero-Day 36 Days Before Patch

The Interlock ransomware group exploited a critical, maximum-severity vulnerability (CVE-2026-20131) in Cisco's Secure Firewall Management Center (FMC) as a zero-day for 36 days before a patch was released. The flaw allows unauthenticated remote code execution with root privileges. Amazon's threat intelligence team discovered the exploitation and, in a major OPSEC failure by the attackers, also found a misconfigured server that exposed the group's entire operational toolkit, including custom RATs and reconnaissance scripts. The discovery highlights the advanced capabilities of ransomware groups and their focus on targeting edge network infrastructure.

Apple Unveils 'Background Security Improvements' to Patch WebKit SOP Bypass Flaw

Apple has introduced a novel update mechanism called 'Background Security Improvements' to deliver its first-ever out-of-band patch for a WebKit vulnerability. The flaw, tracked as CVE-2026-20643, is a cross-origin issue that could allow a malicious website to bypass the Same-Origin Policy (SOP), potentially enabling it to read sensitive data from other open websites. The new update method allows Apple to ship smaller, more agile security fixes for critical components like WebKit without requiring a full OS update, ensuring faster protection for users. The feature is enabled by default on iOS 26.1, iPadOS 26.1, macOS 26, and later, with patched versions identified by an '(a)' suffix.

High-Severity DoS Flaw in Parse Server (CVE-2026-32886) Allows Unauthenticated Remote Crash

A high-severity denial-of-service (DoS) vulnerability, CVE-2026-32886, has been found in Parse Server, a popular open-source backend framework. The flaw allows a remote, unauthenticated attacker to instantly crash a server process with a single, specially crafted API request. The vulnerability is caused by improper handling of the JavaScript prototype chain when the server resolves cloud function names. By sending a request with a function name containing properties like `__proto__`, an attacker can trigger a recursive loop that leads to a stack overflow, crashing the server. The issue affects Parse Server versions before 9.6.0-alpha.24 and 8.6.47, and users are urged to update immediately.

Micronaut Framework Flaw (CVE-2026-33012) Leads to DoS via Unbounded Cache

A high-severity denial-of-service (DoS) vulnerability, CVE-2026-33012, has been discovered in the Micronaut Framework, a popular Java-based application framework. The flaw, which has a CVSS score of 7.5, allows a remote attacker to cause an `OutOfMemoryError` and crash the application server. The vulnerability lies in the `DefaultHtmlErrorResponseBodyProvider` component, which uses an unbounded `ConcurrentHashMap` to cache error messages. An attacker can exploit this by repeatedly triggering exceptions with unique, attacker-controlled input, causing the cache to grow indefinitely until it consumes all available heap memory. The issue affects Micronaut versions 4.7.0 through 4.10.6 and is fixed in version 4.10.7.

Ransomware Surge: LockBit Leads as 28 New Victims Claimed in 24 Hours

Ransomware activity remains intense, with 28 new victims publicly claimed on data leak sites in the 24 hours leading up to March 17, 2026. The resilient LockBit ransomware group was the most prolific operator, claiming six new victims. The APT73 and Medusa gangs were also highly active, each adding four victims to their lists. The Professional Services sector and organizations within the United States continue to be the most frequent targets. Notable victims from this period include the Philippine Department of Public Works and Highways (targeted by APT73), Cape May County in the U.S. (attacked by Medusa), and the Florida East Coast Railway (claimed by PayoutsKing).

Novel Font-Rendering Trick Hides Malicious Commands from AI Assistants

Security researchers have developed a novel technique that uses font-rendering manipulations to hide malicious commands from AI assistants and security scanners while they remain invisible to human users. Disclosed on March 18, 2026, the method exploits how web browsers render different fonts to create text that is perceived differently by machines than by people. This allows for the creation of 'poisoned' web pages containing hidden instructions. When an AI assistant processes the content of such a page, it could inadvertently execute these commands, leading to potential data exfiltration or other unauthorized actions. The discovery highlights a new class of vulnerabilities in the gap between human and machine perception.

High-Severity Ubuntu Flaw (CVE-2026-3888) Allows Local Root Access

A high-severity local privilege escalation (LPE) vulnerability, CVE-2026-3888, has been discovered in default installations of multiple Ubuntu LTS versions. The flaw, found by the Qualys Threat Research Unit and rated 7.8 (High), allows an unprivileged local user to gain full root access. The vulnerability is a race condition stemming from an interaction between the privileged `snap-confine` utility and the `systemd-tmpfiles` service. An attacker can exploit a time window during the cleanup of a snap's temporary directory to create malicious symlinks, leading to a full system compromise. The flaw affects Ubuntu versions 16.04 through 24.04, and Canonical has released patches.

Poland Blocks Cyberattack on Nuclear Research Centre; Suspects Iran-Linked False Flag

Poland's National Centre for Nuclear Research (NCBJ) successfully detected and blocked a cyberattack targeting its internal IT infrastructure. Officials confirmed that no systems were compromised and the 'MARIA' research reactor remained safe. While preliminary analysis of the attack vectors points towards Iran, Polish authorities, including the Minister for Digital Affairs, have cautioned that this could be a 'false flag' operation designed to misdirect attribution, especially given the history of cyberattacks against Poland attributed to Russian-linked groups like APT44 (Sandworm).

EU Sanctions Chinese and Iranian Hack-for-Hire Firms for Cyberattacks

The European Union has imposed sanctions on three companies and two individuals from China and Iran for their involvement in cyberattacks against EU interests. The sanctioned entities include Iranian firm Emennet Pasargad, linked to the Charlie Hebdo data leak and election interference, and two Chinese companies: Anxun Information Technology (iSoon), a hack-for-hire group targeting critical infrastructure, and Integrity Technology Group, which supported operations linked to the state-backed APT group Flax Typhoon. The measures include asset freezes and travel bans.

Fortinet Patches Three Critical FortiGate Flaws Used in Active Attacks to Steal Credentials

Fortinet has released patches for three critical vulnerabilities in its FortiGate Next-Generation Firewalls (NGFWs), which were actively exploited by attackers between December 2025 and February 2026. Two of the flaws, CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), allowed remote authentication bypass via crafted SAML tokens. A third zero-day, CVE-2026-24858 (CVSS 9.8), was also abused. Attackers leveraged these flaws to gain administrative access, download the full device configuration, and steal service account credentials for lateral movement. CISA has added CVE-2025-59718 to its KEV catalog.

Atlassian Bulletin Details 21 High-Severity Flaws, Including Critical RCEs in Bamboo

Atlassian has published its March 2026 Security Bulletin, addressing numerous vulnerabilities across its product suite, 21 of which are rated high-severity. Among the most critical fixes is for a Remote Code Execution (RCE) vulnerability in Bamboo Data Center and Server (CVE-2026-21570, CVSS 8.6). Other significant flaws in Bamboo, stemming from an Apache Struts dependency, were also patched. The company urges customers to upgrade their instances to a fixed version to mitigate the risks posed by these vulnerabilities.

Google Finalizes Acquisition of Cloud Security Firm Wiz to Bolster Multicloud Security

Google has officially completed its acquisition of Wiz, a leading cloud-native security platform. This major strategic investment is aimed at enhancing Google Cloud's security offerings, particularly for customers operating in multicloud environments. Wiz will join the Google Cloud division but will continue to operate under its own brand, maintaining its commitment to securing customer environments across all major cloud providers, including AWS and Microsoft Azure. The move is expected to help organizations better secure their cloud and AI deployments.

Zapier Pledges Free AI Education for One Million People to Lower Skills Barrier

Workflow automation company Zapier has launched the "1 Million AIs" initiative, a public pledge to provide free AI education and training to one million people. The program aims to democratize AI skills, making them accessible to non-technical users and driving broader adoption of AI-powered automation. The initiative will include live workshops, bootcamps, and self-paced courses, with a public counter tracking progress towards the goal. The first virtual workshop is scheduled for April 7, 2026.

WEF Report: AI Supercharges Cyber Arms Race, Widens Global 'Cyber Equity' Gap

The World Economic Forum's (WEF) "Global Cybersecurity Outlook 2026" report warns of a deepening 'cyber equity' gap, where many organizations are falling below a 'security poverty line' and lack the resources to defend against modern threats. The report, based on data from 800 global leaders, also highlights the dual-edged role of AI, noting that while more organizations are assessing AI tools, 87% of leaders believe AI will significantly amplify cyber threats. The WEF calls for greater public-private collaboration to address these systemic risks to the global digital ecosystem.

Cisco Scrambles to Patch Critical SD-WAN Zero-Day Exploited for Months

Cisco has released emergency patches for a critical, CVSS 10.0 zero-day vulnerability, CVE-2026-20127, impacting its Catalyst SD-WAN products. The flaw, an authentication bypass, has been actively exploited by a threat actor tracked as UAT-8616 since at least 2023, allowing unauthenticated attackers to gain administrative privileges. The vulnerability has been added to CISA's KEV catalog, and federal agencies have been ordered to patch within two days. The exploit allows attackers to create rogue peer devices, manipulate network configurations, and has been observed chained with another flaw (CVE-2022-20775) to achieve root access.

Ransomware Splinters as Attacks Surge 59% in Asia-Pacific, S-RM Report Finds

S-RM's 2026 Cyber Incident Insights Report reveals a significant shift in the ransomware landscape, which is fragmenting into a more diverse and unpredictable ecosystem. Based on over 800 incidents in 2025, the report identified 67 distinct ransomware groups, an increase from the previous year. This diversification includes both sophisticated RaaS operations like Akira and Qilin and newer, less predictable actors. A key finding is the dramatic 59% year-over-year increase in ransomware attacks in the Asia-Pacific (APAC) region, driven by rapid digitization and immature security postures. The report also warns of emerging risks from the insecure adoption of AI agents with privileged access in enterprise environments.

UK Companies House Flaw Exposes Data of 5 Million Companies

The UK's official business registry, Companies House, has confirmed a significant security vulnerability in its WebFiling service that exposed the sensitive data of personnel from five million registered companies. The flaw, which was active from October 2025 until March 2026, allowed any logged-in user to view non-public information of other companies, including directors' residential addresses and full dates of birth, by manipulating their browser session. The service was taken offline for emergency maintenance and restored on March 16, 2026, after a patch was applied. Companies House has reported the incident to the ICO and NCSC and is urging all UK businesses to review their filing history for any unauthorized changes.

CISA KEV Alert: Actively Exploited Wing FTP Server Flaw Added to Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-47813, a medium-severity information disclosure vulnerability in Wing FTP Server, to its Known Exploited Vulnerabilities (KEV) catalog. This indicates the flaw is being actively exploited in the wild. The vulnerability allows an unauthenticated attacker to reveal the full local installation path of the server by sending a crafted request. While not an RCE flaw itself, attackers are using this information for reconnaissance to facilitate more severe follow-on attacks. A patch has been available since May 2025 in version 7.4.4. CISA has mandated that federal agencies remediate the flaw by March 30, 2026.

Play Ransomware Claims Attack on U.S. Aviation Firm Executive Aviation

The Play ransomware group, also known as Playcrypt, has claimed responsibility for a cyberattack against Executive Aviation, a company in the U.S. aviation sector. On March 15, 2026, the group posted the company's name on its dark web leak site, threatening to publish a 'full leak' of stolen data unless a ransom is paid. This incident highlights the ongoing targeting of critical infrastructure sectors by sophisticated ransomware operators. The Play group is known for its double-extortion tactics and often gains initial access by exploiting vulnerabilities in public-facing VPN or RDP services. The attack serves as a warning to the aviation industry to bolster its defenses against such threats.

'The Gentlemen' Ransomware Hits Thai Financial Firm Chase Asia

A relatively new ransomware group calling itself 'The Gentlemen' has claimed responsibility for a cyberattack on Chase Asia, a major debt collection and loan management firm in Thailand. On March 16, 2026, the group threatened to publish the company's data if contact was not made. 'The Gentlemen' is believed to be a sophisticated Ransomware-as-a-Service (RaaS) operation that emerged from the Qilin ransomware ecosystem. The group is known to target Windows, Linux, and ESXi environments and has previously exploited Fortinet VPN vulnerabilities for initial access. This attack on a prominent financial firm highlights the expanding reach of organized cybercrime into the Asia-Pacific market.

Critical CVSS 9.9 SQL Injection Flaw (CVE-2026-32306) Hits OneUptime Platform

A critical SQL injection vulnerability, CVE-2026-32306, with a CVSS score of 9.9 has been disclosed in the OneUptime open-source observability platform. The flaw allows a low-privileged authenticated user to execute arbitrary SQL commands against the backend ClickHouse database. This could enable an attacker to read or modify data across all tenants in a shared environment and potentially achieve remote code execution (RCE). The vulnerability, which stems from improper sanitization of API parameters, has been patched in version 10.0.23. This is the fourth critical vulnerability to impact OneUptime in just six weeks, raising serious concerns about the platform's security posture and prompting recommendations for users of self-hosted instances to apply the patch immediately.

AppsFlyer Web SDK Hijacked in Supply-Chain Attack to Deploy Crypto-Stealing Malware

The widely used AppsFlyer Web SDK was compromised in a software supply-chain attack reported on March 14, 2026. For a brief period, the official SDK hosted on 'websdk.appsflyer.com' was replaced with a malicious version that delivered a crypto-stealing JavaScript payload. The malware was designed to intercept cryptocurrency wallet addresses entered by users on any of the thousands of websites integrating the SDK, replacing them with attacker-controlled addresses to divert funds. AppsFlyer confirmed that a domain registrar incident on March 10 led to the compromise. The company has since resolved the issue and stated that its mobile SDK and customer data were not affected. The event highlights the significant downstream risk of supply-chain attacks targeting popular third-party scripts.

Payload Ransomware Hits Royal Bahrain Hospital, Threatens to Leak 110 GB of Patient Data

The Payload ransomware group has claimed responsibility for a cyberattack on the Royal Bahrain Hospital (RBH), a major healthcare provider in the Gulf region. In a post on their dark web leak site dated March 15, 2026, the group alleged it had stolen 110 gigabytes of sensitive data and published images of compromised systems as proof. Payload is employing a double-extortion tactic, threatening to publish the stolen data if a ransom is not negotiated by their March 23 deadline. The attack on RBH, which serves patients from across the region, poses a significant threat to patient privacy and hospital operations, and is another stark example of the healthcare sector's continued targeting by financially motivated ransomware gangs.

HHS Launches Free Cybersecurity Toolkit to Help Healthcare Orgs Assess Risk

The U.S. Department of Health and Human Services' (HHS) Administration for Strategic Preparedness and Response (ASPR) has launched a new cybersecurity module for its free RISC 2.0 Toolkit. Announced on March 14, 2026, the web-based tool is designed to help healthcare organizations of all sizes assess their cybersecurity posture. The module guides users through a questionnaire about their security practices and scores their responses against two key standards: the NIST Cybersecurity Framework (CSF) 2.0 and the HHS Cybersecurity Performance Goals (CPGs). This enables facilities to identify security gaps, prioritize investments, and improve their overall resilience against cyber threats, as part of a broader federal effort to bolster the security of the healthcare sector.

CA/Browser Forum Mandate Cuts TLS Certificate Lifespan to 200 Days, Forcing Automation

Effective March 15, 2026, a major industry-wide policy change mandated by the CA/Browser Forum has reduced the maximum lifespan of all newly issued public TLS/SSL certificates from 398 days to just 200 days. This change, which affects all Certificate Authorities (CAs) and browsers, is designed to improve security by forcing more frequent re-validation of website identities and limiting the window for misuse of compromised certificates. The move is the first step in a phased plan that will see lifespans shrink to 100 days in 2027 and 47 days in 2029. This accelerated renewal cadence will make manual certificate management impractical, creating a strong imperative for organizations to adopt automated certificate lifecycle management (CLM) solutions to avoid outages and security risks.

Canadian Retail Giant Loblaw Investigates Data Breach Exposing Customer Info

Loblaw Companies Limited, Canada's largest food and pharmacy retailer, has announced it is investigating a data breach after detecting suspicious activity on its network. The company stated that an unauthorized third party accessed a non-critical segment of its network and exfiltrated basic customer information, including names, phone numbers, and email addresses. Loblaw has assured customers that more sensitive data such as passwords, financial information, and health data were not compromised. As a precaution, the company has logged all customers out of their accounts, requiring them to sign back in.

CISA Issues Binding Directive: Federal Agencies Must Remove Unsupported Edge Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring all federal civilian agencies to remove unsupported, end-of-life (EoL) 'edge' devices from their networks. The move targets internet-facing hardware like routers, firewalls, and VPNs that no longer receive security updates, as these are frequently exploited by advanced threat actors. Agencies have three months to identify all such devices and must complete their removal and replacement within 18 months, reflecting a major push to reduce the government's attack surface.

Google and Partners Dismantle Chinese Espionage Campaign (UNC2814) Targeting Global Telecoms

Google's Threat Intelligence Group (GTIG), with partners including Mandiant, has disrupted a major cyber-espionage campaign attributed to UNC2814, a hacking group linked to the People's Republic of China. Active since at least 2017, the campaign compromised at least 53 telecommunication and government organizations in 42 countries across multiple continents. The group's goal was intelligence collection and monitoring communications. The takedown involved sinkholing attacker domains and blocking their use of Google Sheets for command-and-control (C2) communications. Google has notified the victims and released Indicators of Compromise (IOCs).

Starbucks Discloses Data Breach After Phishing Attack on Employee Portal

Starbucks has disclosed a data breach affecting 889 of its employees after attackers gained unauthorized access to their accounts on the company's 'Partner Central' portal. The breach was the result of a targeted phishing campaign where employees were tricked into entering their credentials on fraudulent websites impersonating the legitimate portal. The incident, discovered on February 6, 2026, led to the exposure of highly sensitive personal information, including names, Social Security numbers, dates of birth, and financial account details. Starbucks has notified law enforcement and is providing affected employees with 24 months of free credit monitoring and identity protection services.

ShinyHunters Claims Massive Data Theft from Telus Digital, Demands $65 Million

Canadian business process outsourcer Telus Digital is investigating a major security incident after the notorious 'ShinyHunters' hacking group claimed to have stolen nearly a petabyte of data. The attackers are demanding a $65 million ransom. The breach allegedly involves customer data, call records, and sensitive information from dozens of Telus Digital's corporate clients, which include banks and tech firms. ShinyHunters reportedly gained initial access using stolen Google Cloud Platform credentials from a previous third-party breach, highlighting a significant supply chain risk.

Police Scotland Fined £66,000 by UK Regulator for Egregious Data Protection Failures

The UK's Information Commissioner's Office (ICO) has fined Police Scotland £66,000 for severe data protection violations. The police force improperly extracted the entire contents of a crime victim's mobile phone, collecting excessive and irrelevant sensitive data. This unredacted data was then mistakenly shared with an unauthorized third party. The ICO cited a lack of adequate policies, technical controls, and staff guidance as root causes for the breach, which also involved a failure to report the incident within the mandatory 72-hour window.

"DarkSword" iOS Exploit Chain Actively Used by Spyware Vendors and State Actors

Google's Threat Analysis Group (TAG) has uncovered a sophisticated iOS exploit chain named 'DarkSword,' which is being actively used by multiple threat actors, including commercial spyware vendors and state-sponsored groups. The exploit leverages six vulnerabilities, including CVE-2026-20700 and CVE-2025-43529, to achieve full device compromise on iPhones running iOS 18.4 to 18.7. The attack can be delivered via drive-by downloads and deploys a potent data-stealing payload called 'Ghostblade,' which exfiltrates messages, contacts, location data, and information from secure messaging and crypto apps.

CISA Warns: Critical SharePoint RCE Flaw Now Actively Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in Microsoft SharePoint Server, CVE-2026-20963, to its Known Exploited Vulnerabilities (KEV) catalog, confirming it is under active attack. The flaw, rated 9.8 in severity, allows an unauthenticated attacker to execute arbitrary code with no user interaction. It affects multiple versions of SharePoint Server. CISA has ordered federal agencies to apply the patch, originally released in January 2026, by March 21, and strongly urges all organizations to prioritize patching immediately.

Microsoft Rushes Emergency Hotpatch for Critical RCE Flaws in Windows RRAS

Microsoft has issued an emergency, out-of-band hotpatch (KB5084597) on March 13, 2026, to address three critical remote code execution (RCE) vulnerabilities in the Windows Routing and Remote Access Service (RRAS). The flaws—CVE-2026-25172, CVE-2026-25173, and CVE-2026-26111—affect Windows 11 and can be exploited by an attacker who tricks a user into connecting to a malicious remote server. A successful exploit could allow the attacker to execute arbitrary code on the victim's device. The hotpatch is being delivered via Windows Update and allows for a no-reboot installation on supported Enterprise devices, underscoring the severity of the vulnerabilities in this core networking component.

Chinese Spy Group Targets Southeast Asian Militaries with Custom 'AppleChris' & 'MemFun' Backdoors

A suspected China-based cyber espionage group, tracked as CL-STA-1087, is conducting a long-running intelligence-gathering campaign against military organizations in Southeast Asia. Active since at least 2020, the operation demonstrates high sophistication, using custom backdoors named 'AppleChris' and 'MemFun' along with a credential harvesting tool called 'Getpass.' The threat actors focus on exfiltrating specific, high-value intelligence related to military capabilities, organizational structures, and collaborations with Western forces. Researchers at Palo Alto Networks Unit 42 detected the intrusion after observing suspicious PowerShell commands used to establish reverse shells to a command-and-control server, indicating a patient and persistent adversary focused on strategic espionage rather than widespread disruption.

Malicious AI Browser Extensions Caught Stealing ChatGPT Prompts and Corporate Data

Security researchers have uncovered a widespread data harvesting campaign involving malicious Chromium browser extensions disguised as helpful AI assistants. These extensions, installed nearly 900,000 times from official browser stores, targeted over 20,000 enterprise environments. The malware's primary function was to steal browsing history and exfiltrate the full content of user interactions with Large Language Models (LLMs) like ChatGPT and DeepSeek. This allowed attackers to capture potentially sensitive corporate data, intellectual property, and source code that employees were inputting into AI services. The incident highlights the significant 'shadow IT' risk posed by ungoverned browser extensions and the use of public AI tools for business purposes.

'SocksEscort' Proxy Botnet Used for Millions in Fraud Dismantled by FBI & Europol

An international law enforcement action named 'Operation Lightning' has dismantled 'SocksEscort,' a massive residential proxy service that facilitated widespread cybercrime. The service operated by infecting hundreds of thousands of home and business routers worldwide with the 'AVRecon' botnet malware. This network of compromised devices was then sold to criminals, who used it to hide their activities while committing large-scale fraud, including ransomware, ad fraud, and identity theft, resulting in tens of millions of dollars in losses. The operation, led by the FBI and Europol, involved seizing 34 domains and 23 servers, and freezing $3.5 million in cryptocurrency, dealing a major blow to the cybercrime ecosystem.

China's CERT Warns 'OpenClaw' AI Model Can Be Abused to Delete Data, Expose Keys

China's national Computer Emergency Response Team (CERT) has issued a significant security warning about the 'OpenClaw' AI model. According to the alert reported on March 12, 2026, the model can be manipulated to perform dangerous and destructive actions, such as deleting user data, exposing sensitive information like secret keys, and loading malicious content onto a system. The perceived severity of these vulnerabilities has reportedly led authorities in Beijing to ban the use of the AI model. The warning highlights the growing concerns among national security bodies about the inherent risks and potential for misuse of powerful, publicly available large language models.

Zscaler Rushes Patch for Critical Privilege Escalation Flaw in Windows Client Connector

Zscaler has released a security update for a high-severity privilege escalation vulnerability, CVE-2024-5407, in its Client Connector for Windows. The flaw, with a CVSS score of 7.8, could allow a local attacker with standard user privileges to gain SYSTEM-level access by exploiting the application's repair functionality. This could enable full system compromise, data theft, or the deployment of malware like ransomware. Zscaler strongly urges all customers to update to the patched version 4.4.0.280 immediately to mitigate the risk. While not yet exploited in the wild, its public disclosure increases the likelihood of future attacks.

Black Basta Ransomware Gang Caught Exploiting Windows Zero-Day for SYSTEM-Level Access

The notorious Black Basta ransomware gang has been observed exploiting a now-patched zero-day vulnerability in the Microsoft Windows Error Reporting Service, tracked as CVE-2024-26169. This critical privilege escalation flaw allowed attackers to gain SYSTEM privileges, bypassing security measures to deploy their ransomware. The threat group Cardinal (Storm-1811), an initial access broker for Black Basta, was also linked to the attacks. Microsoft addressed the vulnerability in its March 2024 Patch Tuesday updates, highlighting the urgent need for organizations to apply security patches to defend against sophisticated ransomware operations.

VMware Patches Critical RCE Flaws in vCenter and ESXi; Admins Urged to Update Immediately

VMware has released urgent security updates to address three critical vulnerabilities in its vCenter Server and ESXi products. The flaws include two heap-overflow vulnerabilities (CVE-2024-22252, CVE-2024-22253) with CVSS scores of 9.3, and a privilege escalation vulnerability (CVE-2024-22255). The heap-overflow flaws could allow an attacker with access to a virtual machine to escape to the hypervisor and achieve remote code execution, leading to a complete compromise of the host. VMware states there are no workarounds and immediate patching is the only mitigation.

CISA Adds Actively Exploited SharePoint RCE Chain to KEV Catalog, Mandates Federal Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Microsoft SharePoint vulnerabilities, CVE-2023-29357 and CVE-2023-24955, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the flaws are being actively used in attacks. When chained together, these vulnerabilities allow an unauthenticated attacker to achieve remote code execution (RCE) on affected SharePoint servers. CISA has mandated that all Federal Civilian Executive Branch agencies apply the necessary patches by a specified deadline, and all organizations are strongly urged to patch immediately.

New 'Migo' Golang Malware Blinds Linux Security Tools on Redis Servers

A new Golang-based malware named 'Migo' is targeting exposed Redis servers on Linux systems. The malware's primary objective is to disable endpoint security solutions, cloud agents, and other monitoring tools, effectively blinding security teams. After neutralizing defenses, Migo deploys a cryptocurrency miner to hijack the compromised system's resources. The use of Golang makes the malware highly portable and harder to detect. Security researchers note that Migo is under active development, indicating a persistent and evolving threat. Securing Redis instances is a critical mitigation.

Leaked LockBit 3.0 Builder Continues to Fuel Ransomware Ecosystem, Complicating Attribution

The LockBit 3.0 ransomware builder, which was leaked in September 2022, is still being widely used by a multitude of threat actors to launch their own custom ransomware attacks. This has led to a significant proliferation of smaller, disparate ransomware operations, making attack attribution and defense more challenging for organizations. The leak has effectively 'democratized' a sophisticated ransomware tool, lowering the barrier to entry for less-skilled cybercriminals and creating a long-lasting problem for the cybersecurity community. The attacks have impacted a wide range of industries globally.

Microsoft Unleashes Massive April 2024 Patch Tuesday, Fixing 149 Flaws Including Critical RCEs

Microsoft has released its April 2024 Patch Tuesday update, a substantial release addressing 149 vulnerabilities across its product portfolio. Of these, three are rated as critical: a remote code execution (RCE) flaw in Microsoft SQL Server (CVE-2024-21422), a Windows Secure Boot bypass (CVE-2024-29053), and an RCE in the Microsoft RPC runtime (CVE-2024-21323). The update also covers numerous important-rated flaws in Windows, Office, Azure, and Dynamics 365. Given the volume and criticality of the fixes, organizations are urged to prioritize deployment of these updates to protect against potential exploitation.

Stealthy 'Cuttlefish' Malware Hides on Routers to Steal Credentials from Network Traffic

A sophisticated and stealthy malware named 'Cuttlefish' has been found infecting enterprise-grade routers. The malware is designed to remain hidden while it actively monitors network traffic passing through the device. Its primary goal is to exfiltrate sensitive information, such as usernames, passwords, and other credentials, by intercepting traffic from various protocols. The infection vector is believed to be the exploitation of known vulnerabilities or weak credentials. The malware's persistence and data-stealing capabilities make it a significant threat to corporate security and privacy.

Panda Restaurant Group Discloses Data Breach Impacting Corporate Employee Information

Panda Restaurant Group, the parent company of the Panda Express fast-food chain, has disclosed a data breach that exposed the personal information of some of its current and former corporate employees. The breach occurred in March 2024 when unauthorized actors gained access to corporate systems and exfiltrated files. The compromised data includes names, Social Security numbers, and driver's license numbers. The company has stated that customer data was not affected and is offering credit monitoring services to the impacted individuals.

'FakeBat' Malware Loader Uses Malvertising to Distribute RedLine Stealer and Other Payloads

A new and evolving malware loader, dubbed 'FakeBat', is being distributed through widespread malvertising campaigns. These campaigns use malicious ads that impersonate legitimate download pages for popular business software like Slack, Zoom, and Notion. When a user clicks an ad, they are redirected to a site that downloads the FakeBat loader. FakeBat is then used to deliver a variety of secondary payloads, most notably information stealers like RedLine Stealer and remote access trojans (RATs). The campaign highlights the ongoing threat of malvertising as a primary infection vector.

US Offers $10 Million Bounty for Information on BlackCat (ALPHV) Ransomware Gang Leaders

The U.S. Department of State's Rewards for Justice program is offering a reward of up to $10 million for information that leads to the identification or location of key leaders of the BlackCat (also known as ALPHV) ransomware gang. This significant bounty is part of a broader U.S. government effort to disrupt the operations of this prolific and destructive cybercrime group, which is known for targeting critical infrastructure and healthcare organizations worldwide using a 'triple extortion' model.

Starbucks Discloses Data Breach Affecting 889 Employees via Phishing Attack

Starbucks has revealed a data breach impacting 889 of its employees, or "partners," after their accounts on the company's 'Partner Central' portal were compromised. The breach was the result of a successful phishing campaign where employees were tricked into entering their credentials on imposter websites. The unauthorized access occurred over three weeks, between January 19 and February 11, 2026. The company discovered the activity on February 6 and contained it five days later. The exposed data is highly sensitive, including employees' full names, Social Security numbers, and financial account and routing numbers. Starbucks has stated that no customer data was affected and is providing identity theft protection services to the impacted employees.

UK NCSC Warns of Heightened Indirect Cyber Threat from Iran Amid Geopolitical Tensions

The UK's National Cyber Security Centre (NCSC) has issued an advisory urging British organizations to enhance their cyber defenses due to an increased risk of indirect cyber threats linked to Iran. The warning comes amid escalating geopolitical tensions in the Middle East. While the direct threat to the UK has not significantly changed, the NCSC cautions that organizations with supply chains or operations in the region, as well as Critical National Infrastructure (CNI), could face collateral damage from politically motivated cyberattacks.

Ericsson Data Breach Exposes Personal Info of 15,000 Due to Third-Party Vendor Compromise

Telecommunications giant Ericsson has reported a data breach impacting approximately 15,000 individuals associated with its US operations. The incident was not a direct breach of Ericsson's systems but originated from a compromise at an unnamed third-party service provider. The breach occurred in April 2025, but the investigation only concluded in February 2026. An unauthorized party gained access to files containing sensitive personal information, including names, addresses, Social Security numbers, driver's license numbers, and financial data, highlighting the significant risks posed by supply chain security vulnerabilities.

APT28 Hits Ukrainian Military with Custom 'BeardShell' Malware in Two-Year Espionage Campaign

The Russian state-sponsored threat group APT28, also known as Fancy Bear, has been conducting a persistent cyberespionage campaign against the Ukrainian military for nearly two years. Research from ESET reveals the group, attributed to Russia's GRU, has been using a sophisticated toolkit of custom malware since at least April 2024. The campaign employs paired implants, including a backdoor named 'BeardShell' and a heavily modified version of the open-source C2 framework 'Covenant'. The operation also deployed the 'SlimAgent' keylogger, demonstrating the group's continued investment in developing advanced tools for strategic intelligence gathering.

State-Aligned Hackers from China, Iran, Belarus Escalate Espionage in Middle East

A new report from Proofpoint reveals a significant uptick in cyber-espionage campaigns targeting government and diplomatic entities in the Middle East. Threat actors with suspected alignments to China (UNK_InnerAmbush), Iran (TA402, TA453), Belarus (TA473), and Hamas are opportunistically using a regional conflict as lure content for strategic intelligence collection. These campaigns often use compromised government email accounts, such as one from Iraq's Ministry of Foreign Affairs, to send highly credible phishing emails, demonstrating a complex and multi-faceted cyber-threat landscape in the region.

First-Ever 'Wormable' Malware in npm History Detailed in Analysis of 2025 Supply Chain Attacks

A detailed analysis of major JavaScript supply chain attacks from late 2025 reveals a significant escalation in threat actor sophistication. The campaigns included the compromise of massively popular npm packages like 'Chalk' and 'Debug,' which collectively see two billion weekly downloads, with payloads designed to steal cryptocurrency. Another campaign featured the 'Shai-Hulud' worm, described as the first wormable malware in npm's history. This malware executed during the `npm install` process, stealing developer credentials like npm tokens, GitHub PATs, and AWS keys, and then publishing them to a public repository, highlighting a severe threat to the software development lifecycle.

Critical Nginx UI Flaw (CVE-2026-27944) Allows Unauthenticated Backup Theft and Decryption

A critical information disclosure vulnerability, CVE-2026-27944, has been discovered in Nginx UI, a popular web interface for managing Nginx servers. The flaw, which has a CVSS score of 9.8, allows a remote, unauthenticated attacker to download a full system backup. Compounding the issue, the API endpoint also discloses the encryption key in a response header, allowing for immediate decryption of the stolen backup. The backup can contain highly sensitive data, including user credentials, session tokens, and SSL private keys. Users are urged to update to the patched version, Nginx UI 2.3.3, immediately.

Russian State Hackers Target Signal & WhatsApp Accounts of High-Value Individuals

Dutch intelligence agencies AIVD and MIVD have issued a warning about a large-scale phishing campaign by Russian state-backed hackers aimed at compromising the Signal and WhatsApp accounts of high-value targets. The campaign targets government officials, military personnel, and journalists. The attacks do not exploit software vulnerabilities but rely on social engineering to trick victims into sharing SMS verification codes or scanning malicious QR codes to link an attacker's device. This allows the attackers to take over the account or silently monitor all communications.

ShinyHunters Linked to Voice Phishing Campaign Targeting Okta Admins to Steal SaaS Data

A 2026 cyberattack campaign is using voice phishing (vishing) and social engineering to compromise Okta administrator accounts, with TTPs consistent with the ShinyHunters threat group. According to Obsidian Security, attackers socially engineer IT help desks or users over the phone to gain initial access. Once in, they immediately enroll their own MFA device (often an emulated Android device with Okta FastPass) to establish persistence. With persistent access to the identity provider, the attackers then pivot to connected single sign-on (SSO) applications to perform high-volume data exfiltration, highlighting a coordinated attack across the identity and SaaS layers.

FBI Warns of Sophisticated Phishing Scam Impersonating City Officials to Steal Permit Fees

The FBI's Internet Crime Complaint Center (IC3) has issued a public service announcement about a sophisticated, nationwide phishing campaign. Scammers are impersonating city and county officials, using publicly available permit data to create highly convincing emails that trick individuals and businesses into paying fraudulent fees. The attackers request payment via non-standard methods like wire transfers, P2P apps, and cryptocurrency, creating a significant financial risk for those engaged in the permitting process.

Texas Healthcare Provider CommuniCare Discloses Data Breach Affecting Nearly 20,000 Patients

The San Antonio-based Barrio Comprehensive Family Health Care Center, operating as CommuniCare, has reported a data breach impacting 19,885 individuals. The breach stemmed from unauthorized access to an employee's email account, which was first detected in September 2025. A subsequent investigation confirmed that the compromised account contained a trove of patient data, including personally identifiable information (PII) and protected health information (PHI) such as medical diagnoses, treatments, and prescription details.

FDD Warns NIST of "Agentic AI" Security Risks, Highlighting Prompt Injection and Multi-Agent Dangers

The Foundation for Defense of Democracies (FDD) has submitted a formal public comment to the U.S. National Institute of Standards and Technology (NIST), warning that the federal government is unprepared for the unique security risks posed by agentic artificial intelligence. The submission, part of NIST's RFI for a new AI Agent Security Framework, highlighted novel threats like indirect prompt injection, data poisoning, and multi-agent interaction risk. The FDD urged NIST to update core security standards to address these emerging dangers, which could be exploited by nation-state adversaries.

Transport for London Confirms 2024 Breach by 'Scattered Spiders' Affected 10 Million People

Transport for London (TfL) has officially confirmed the massive scale of a cyberattack that occurred in August 2024. The breach, attributed to the notorious hacking group 'Scattered Spiders', affected approximately 10 million people. The attackers stole a database containing sensitive personal information, including names, email addresses, phone numbers, and home addresses. The financial impact of the incident is estimated to be around £39 million ($52 million USD), highlighting the severe consequences of the attack long after its initial discovery.

Critical Zero-Click RCE Flaw (CVE-2026-25253) Hits OpenClaw AI Agent Framework

A critical zero-click remote code execution (RCE) vulnerability, CVE-2026-25253, has been discovered in the widely-used OpenClaw AI Agent Framework. The flaw allows a remote attacker to gain complete control of a developer's machine with minimal to no user interaction, posing a severe security risk. This disclosure adds to a series of security crises for the open-source project, which was already dealing with hundreds of malicious 'skills' on its marketplace. The vulnerability has drawn advisories from international cybersecurity agencies, compounding the pressure on the project.

Paint Giant AkzoNobel Hit by Anubis Ransomware; 170GB of Client Data and Passports Leaked

Dutch paint and coatings multinational AkzoNobel has confirmed that one of its U.S. sites was hit by a ransomware attack. The Anubis ransomware group has claimed responsibility on its dark web leak site, stating it exfiltrated 170 GB of data, including over 170,000 files. The attackers leaked samples containing confidential client agreements, product specifications, and sensitive employee PII like passport scans, demonstrating a classic double-extortion tactic. AkzoNobel stated the incident was contained to the single site.

China-Linked Group UAT9244 Targets South American Telecoms with New Malware Suite

A newly identified China-linked threat actor, designated UAT9244, is targeting telecommunications providers in South America with a previously undocumented malware toolkit. The campaign appears focused on long-term espionage and intelligence collection within this critical infrastructure sector. Researchers have identified a suite of custom implants, including backdoors named TernDoor, PeerTime, and BruteEntry, which provide capabilities for remote command execution, persistence, and reconnaissance. The strategic targeting of telecom providers highlights an ongoing focus by nation-state actors on critical infrastructure for surveillance purposes.

Google Patches Actively Exploited Qualcomm Zero-Day in Massive Android Update

Google's March 2026 security update for Android addresses 129 vulnerabilities, including a high-severity zero-day flaw, CVE-2026-21385, in a Qualcomm display component. The vulnerability, a memory corruption issue affecting over 230 Qualcomm chipsets, is confirmed to be under limited, targeted exploitation. The patch is included in the '2026-03-05' security patch level, and users are urged to update their devices as soon as the patch is made available by their respective manufacturers to mitigate the risk of compromise.

Infutor Data Breach Exposes 676 Million Records, Including SSNs, via Misconfigured Database

Data solutions provider Infutor, now part of Verisk, has reportedly suffered a colossal data breach exposing over 676 million unique records. The leak is attributed to a misconfigured Elasticsearch database and is said to include highly sensitive personally identifiable information (PII) such as full names, physical addresses, dates of birth, and Social Security numbers. Given Infutor's role in providing consumer identity data for marketing and verification, the breach could have severe and far-reaching consequences, placing millions at risk of identity theft and financial fraud. Attorneys are now investigating a potential class-action lawsuit.

New Excel Flaw Allows Zero-Click Data Theft by Abusing Copilot AI

Microsoft has disclosed and patched CVE-2026-26144, a high-severity cross-site scripting (XSS) vulnerability in Microsoft Excel with a CVSS score of 7.5. The flaw is particularly dangerous due to a novel attack vector that allows for zero-click data theft by leveraging Microsoft's own Copilot AI features. An attacker can craft a malicious Excel file that, when opened, uses the Copilot agent to exfiltrate sensitive data from the user's machine without any further interaction. Microsoft has released patches as part of its March 2026 security updates and urges customers to apply them immediately.

Cyberattack on French Healthcare Vendor Exposes Medical Data of 15 Million People

The French health ministry has confirmed a massive cyberattack that compromised the administrative and medical data of over 15 million individuals. The breach was a supply chain attack originating from Cegedim Santé, a software company providing services to approximately 1,500 medical practices. While most victims had administrative data like names and addresses exposed, over 165,000 individuals had highly sensitive medical notes leaked, including details on HIV/AIDS status and sexual orientation. The incident underscores the immense risk of supply chain vulnerabilities within the healthcare sector.

LexisNexis Confirms Breach After Hacker 'FulcrumSec' Leaks Data of 400,000 Users, Including U.S. Gov Employees

Data analytics and legal research firm LexisNexis Legal & Professional has confirmed a significant data breach that occurred on February 24, 2026. The incident was initiated by a threat actor known as 'FulcrumSec' who exploited a critical vulnerability, CVE-2025-55182 (React2Shell), in an unpatched front-end application. The attackers then leveraged severe AWS cloud misconfigurations, including overly permissive IAM roles and hardcoded credentials, to escalate privileges and move laterally. On March 3, FulcrumSec publicly leaked 2GB of stolen data, which reportedly includes information on nearly 400,000 user profiles and over 21,000 enterprise accounts. The compromised data contains names, emails, and phone numbers, and notably affects over 100 U.S. government employees. LexisNexis stated the breach was contained and primarily impacted legacy data, with no exposure of sensitive legal research, financial information, or Social Security numbers.

Iranian-Aligned Groups Launch 'The Great Epic' Wiper Campaign Targeting Israel and Allies

In retaliation for recent military strikes, a coalition of Iranian-aligned threat groups, including 'Handala Hack,' has launched a disruptive cyber campaign dubbed 'The Great Epic.' The operation primarily uses destructive wiper malware to attack critical infrastructure and logistics in Israel and Jordan. Unlike financially motivated ransomware, the goal is pure disruption. Israel's National Cyber Directorate issued a warning on March 6, 2026, about active attacks aimed at deleting servers, while the Handala group leaked sensitive data allegedly belonging to Israeli military personnel.

Pentagon Blacklists Anthropic AI, Citing National Security Risk Over Usage Policy Dispute

In an unprecedented move, the U.S. Pentagon has designated artificial intelligence company Anthropic a 'supply chain risk,' effectively banning its technology, including the Claude AI model, from all federal agencies. The decision, announced March 2, 2026, and directed by President Donald Trump, stems from a fundamental disagreement over Anthropic's acceptable use policy (AUP). The Pentagon sought unrestricted use of the AI for 'all lawful purposes,' while Anthropic refused to lift prohibitions against its use in autonomous weapons and mass surveillance, leading to a contract breakdown and the sweeping directive.

Cisco SD-WAN Flaw (CVSS 10.0) Actively Exploited, CISA Issues Emergency Directive

A critical authentication bypass vulnerability, **[CVE-2026-20127](https://www.cisco.com/c/en/us/support/docs/cve/2026/cve-2026-20127.html)**, in **[Cisco](https://www.cisco.com)** Catalyst SD-WAN Controller software is being actively exploited in the wild. The flaw, which has a maximum CVSS score of 10.0, allows a remote, unauthenticated attacker to gain administrative privileges on affected devices, effectively handing them control over a core component of an enterprise network. The threat actor UAT-8616 has been observed exploiting this vulnerability. Due to the severe risk, **[CISA](https://www.cisa.gov)** has issued Emergency Directive 26-03, compelling federal agencies to patch immediately and inventory all affected systems.

Microsoft's March Patch Tuesday Fixes 84 Flaws, Including Two Publicly Known Zero-Days

Microsoft has released its March 2026 security updates, addressing a total of 84 vulnerabilities across its product portfolio, including Windows, Office, Azure, and SQL Server. The update includes patches for eight critical flaws, primarily involving remote code execution and elevation of privilege. While none of the vulnerabilities were actively exploited at the time of release, two were publicly disclosed, increasing the urgency for remediation. These include a critical elevation of privilege bug in SQL Server (CVE-2026-21262) and a denial-of-service flaw in .NET (CVE-2026-26127). The patches cover a wide range of products, with elevation of privilege flaws representing the largest category of fixes.

Navia Data Breach Exposes Personal and Health Data of Nearly 2.7 Million Individuals

Navia Benefit Solutions, a third-party benefits administrator, has disclosed a significant data breach that exposed the personal and health information of nearly 2.7 million people. The incident occurred between December 2025 and January 2026, during which attackers had unauthorized access to Navia's systems. The stolen data includes names, Social Security numbers, dates of birth, and sensitive health plan information related to HRAs, FSAs, and COBRA plans. The breach has impacted employees from over 10,000 companies, including union workers in Washington state. Navia is now facing multiple class-action lawsuits.

Industrial Cyber Threats Evolve from Spying to Physical Disruption, Dragos Warns

The Dragos 2026 OT/ICS Cybersecurity Year in Review report reveals a significant strategic shift by adversaries targeting industrial sectors. Attackers are moving beyond simple espionage and are now actively studying industrial processes with the intent to cause physical operational impact. The report identifies three new APT groups specializing in industrial attacks, including SYLVANITE, an initial access broker. While nation-state threats are growing in sophistication, the report also highlights that ransomware remains a primary threat, with 119 distinct groups targeting over 3,300 industrial organizations in 2025.

Stryker Hit by Destructive Attack as Hackers Weaponize Microsoft Intune for Mass Device Wipe

Medical technology leader Stryker was hit by a highly disruptive cyberattack where attackers used a compromised administrative account to issue remote wipe commands to thousands of corporate devices via Microsoft Intune. The attack, attributed to pro-Iranian hackers, was not technically sophisticated but leveraged legitimate IT administration functions for destructive purposes. The mass device wipe caused significant operational disruption, leading to delays in surgical cases due to inventory delivery issues. The incident serves as a stark warning that Mobile Device Management (MDM) platforms must be treated as critical, high-risk assets requiring stringent security controls.

Russian APT28 Exploits Zimbra XSS Flaw in Phishing Campaign Against Ukraine

A Russian-backed APT group, believed to be APT28 (Fancy Bear), is exploiting a high-severity cross-site scripting (XSS) vulnerability in Zimbra Collaboration (CVE-2025-66376). The campaign targets Ukrainian government entities, including the State Hydrology Agency, with sophisticated phishing emails. The attack uses a stored XSS flaw embedded directly in the email's HTML body, which executes upon opening in a vulnerable Zimbra webmail client. The malicious JavaScript payload is designed to steal credentials, 2FA data, and emails. CISA has added the vulnerability to its KEV catalog.

GitHub Phishing Campaign Lures Developers with Fake $5,000 OpenClaw Crypto Airdrop

A sophisticated phishing campaign is abusing GitHub to target developers with a fake crypto airdrop for a project named OpenClaw. Attackers create fake accounts, open issue threads, and tag legitimate developers, promising a $5,000 token allocation. The link leads to a convincing clone of the real OpenClaw website with a malicious 'Connect your wallet' button. This button executes a wallet-draining script that steals funds from connected crypto wallets like MetaMask and Trust Wallet. The campaign uses social engineering by targeting developers who have shown interest in the legitimate OpenClaw project.

Critical Cisco Firewall Flaw (CVSS 10.0) Exploited as Zero-Day by Ransomware Gang

Cisco has released an urgent security update for a critical vulnerability, CVE-2026-20131, in its Secure Firewall Management Center (FMC) software. The flaw carries the maximum CVSS score of 10.0 and allows an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerability was actively exploited as a zero-day by the Interlock ransomware group for more than a month before the patch was released, making immediate patching a top priority for all affected organizations.

ShinyHunters Exploits Salesforce Cloud Flaw, Steals Data from Hundreds of Orgs

The **[ShinyHunters](https://malpedia.caad.fkie.fraunhofer.de/actor/shinyhunters)** cybercrime group is actively exploiting widespread customer misconfigurations in **[Salesforce](https://www.salesforce.com/)** Experience Cloud, leading to data exfiltration from hundreds of organizations. According to a Salesforce advisory on March 7, 2026, the attackers are not exploiting a platform vulnerability but are abusing overly permissive guest user access settings. Using a modified open-source tool, ShinyHunters scans for public sites and queries exposed APIs (`/s/sfsites/aura` and GraphQL) to steal CRM data. The campaign, which began in late 2025, has prompted a FINRA alert, warning that the stolen data is being used for targeted phishing and extortion.

Cognizant Subsidiary TriZetto Breach Exposes 3.4M Patients' Health Data

TriZetto Provider Solutions (TPS), a healthcare technology subsidiary of IT giant **[Cognizant](https://www.cognizant.com)**, has disclosed a data breach that exposed the protected health information (PHI) of 3,433,965 individuals. Unauthorized actors gained access to a system handling insurance eligibility verification and remained undetected for approximately one year, from November 2024 to October 2025. The compromised data includes highly sensitive information such as names, Social Security numbers, dates of birth, and health insurance details, placing millions of patients at significant risk of identity theft and financial fraud. The incident highlights severe security gaps in the healthcare supply chain.

Genesis Ransomware Hits Healthcare Firm, Claims 100GB Data Theft

The **Genesis** ransomware group has claimed responsibility for a cyberattack against Sierra Management Group, a California-based firm that provides management services to medical practices. In a dark web post on March 7, 2026, the group alleged it exfiltrated 100GB of highly sensitive data, including PII, healthcare records, and financial information. The attackers are using a double extortion tactic, threatening to leak the stolen data within days if their ransom demand is not met. This incident underscores the significant risk to the healthcare sector from supply chain attacks, as the compromised data belongs to patients of Sierra's clients.

Phishing Campaign Delivers Signed Malware via Fake Zoom/Teams Invites

A sophisticated phishing campaign is targeting corporate employees with fake Zoom and Microsoft Teams meeting invitations. The attack, identified by **[Microsoft](https://www.microsoft.com/security)**, uses social engineering to trick users into downloading a supposed client update. The malware installer is signed with a stolen Extended Validation (EV) digital certificate from 'TrustConnect Software PTY LTD', allowing it to bypass security checks and appear legitimate. Once executed, the malware uses PowerShell to deploy legitimate remote monitoring and management (RMM) tools like ScreenConnect and MeshAgent, giving attackers persistent access to the victim's network for future attacks, such as ransomware deployment.

New Russian Malware 'BadPaw' & 'MeowMeow' Target Ukraine; 'Starkiller' Phishing Tool Bypasses MFA

Two distinct but significant threats have emerged. First, a new Russian-led cyber campaign is targeting Ukrainian organizations with two previously unknown malware families, **BadPaw** and **MeowMeow**. The attack uses a phishing lure disguised as a border crossing document to deploy a backdoor. Second, a powerful new Phishing-as-a-Service (PhaaS) tool named **Starkiller** has been identified. Starkiller is designed to defeat multi-factor authentication (MFA) by using real-time request proxying and headless browsers to steal not just credentials, but the post-authentication session tokens needed to hijack active user sessions.

Hacker 'GhostCrawl' Claims Breach of Cybersecurity Firm Team4Security

On March 7, 2026, a threat actor using the alias 'GhostCrawl' posted a claim on the 'Breachforums' hacking forum, alleging they had breached the cybersecurity firm Team4Security. The actor demanded a ransom of $2,350, threatening to leak confidential files, company 'secrets', and security vulnerabilities if the payment was not made within 24 hours. The post is an extortion attempt, and the claims remain unverified. However, the incident highlights that cybersecurity firms themselves are high-value targets for attackers seeking to cause reputational damage or extort money.

Boggy Serpens (MuddyWater) APT Targets UAE Energy Firm in Sustained Espionage Campaign

Researchers from Palo Alto Networks' Unit 42 have detailed a long-running cyber-espionage campaign targeting a national marine and energy company in the United Arab Emirates. The campaign, attributed to the APT group Boggy Serpens (also known as MuddyWater), was active from August 2025 through February 11, 2026. The threat actor conducted four distinct attack waves, using hijacked email accounts from legitimate government and corporate entities for its spear-phishing operations. The campaign deployed a diverse arsenal of malware, including GhostBackDoor, Nuso (HTTP_VIP), UDPGangster, and LampoRAT, showcasing the group's maturing and persistent operational methodology aimed at long-term intelligence gathering.

CISA Adds VMware Aria RCE Flaw to 'Must-Patch' KEV List, Confirming Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-22719, a command injection vulnerability in Broadcom's VMware Aria Operations, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the flaw is being actively used in attacks. The vulnerability, rated CVSS 8.1, allows an unauthenticated attacker to achieve remote code execution, though it is only exploitable during a specific window when a product migration is in progress. The incident highlights the significant risk posed by under-patched management and observability platforms.

Australia, NZ, and Tonga Issue Joint Advisory on INC Ransomware Targeting Healthcare

On March 6, 2026, cyber authorities from Australia (ACSC), New Zealand (NCSC-NZ), and Tonga (CERT Tonga) issued a joint advisory on the INC Ransom group. The Ransomware-as-a-Service (RaaS) operation is actively using affiliates to conduct double-extortion attacks, with a significant focus on the healthcare sector across the Pacific region. The advisory details the group's TTPs—including initial access via phishing and exploitation of public-facing services—and highlights a major incident that disrupted Tonga's national healthcare network in 2025.

Dutch Telecom Odido Hit by Massive Data Breach; 6.2 Million Customers Exposed

Odido, the largest mobile provider in the Netherlands, has suffered a colossal data breach exposing the personal information of 6.2 million customers. The company confirmed the incident on February 12, 2026, after detecting unauthorized access to a customer contact system over the previous weekend. The compromised data is extensive, including names, addresses, phone numbers, email addresses, dates of birth, and, in some cases, bank account (IBAN) and government ID numbers. The threat actor group ShinyHunters has claimed responsibility, allegedly after Odido refused to pay a ransom. The attack is believed to have been initiated through a sophisticated social engineering campaign targeting customer service employees. A criminal investigation has been launched by Dutch authorities.

CISA KEV Alert: Actively Exploited VMware Aria Flaw (CVE-2026-22719) Allows Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity command injection vulnerability in VMware Aria Operations, CVE-2026-22719, to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms the flaw is being actively exploited in the wild. The vulnerability, rated CVSS 8.1, allows an unauthenticated attacker to achieve remote code execution during a product migration process, potentially granting them broad access to an organization's virtual infrastructure.

CrowdStrike & Schwarz Digits to Offer Sovereign AI-Native Security on STACKIT Cloud

CrowdStrike has announced a strategic partnership with Schwarz Digits, the IT division of the group owning retail giants Lidl and Kaufland. The collaboration will deliver CrowdStrike's AI-native Falcon cybersecurity platform on STACKIT, the sovereign cloud developed by Schwarz Group. This initiative aims to provide a comprehensive security solution that meets stringent European data sovereignty and residency requirements, ensuring customer data remains within European legal jurisdictions.

Hennessy Advisors Discloses Year-Old Data Breach, Notifying 12,000 Individuals

California-based investment firm Hennessy Advisors, Inc. has begun notifying over 12,000 individuals of a data breach that occurred nearly a full year ago, on March 30, 2025. The notification, filed in early 2026, reveals that an external system breach led to the potential compromise of highly sensitive personal information, including names, driver's license numbers, and financial account details. The significant delay in notification raises concerns and increases the risk of fraud for affected clients.

Latin America Now Top Global Target, Facing Double the Cyberattacks of US, Report Finds

A new threat report from Check Point Research reveals a dramatic shift in the global cyber threat landscape, with Latin America emerging as the world's most heavily targeted region. Organizations in Latin America now face an average of 3,100 cyber threats per week, a figure that is more than double the rate seen in the United States. This surge is attributed to rapid digitalization across the region, often outpacing the implementation of mature cybersecurity defenses.

Cloudflare Report: Attackers Ditch Malware for Stolen Credentials, Shifting from 'Breaking In' to 'Logging In'

Cloudflare's 2026 Threat Report, released March 3, reveals a fundamental change in cyberattack methodology. Threat actors are increasingly abandoning traditional malware in favor of using stolen credentials to 'log in' to target networks. This identity-centric approach allows attackers to blend in with legitimate traffic, making detection significantly harder and rendering identity and access management a critical security battleground. The report highlights that this tactic is now the primary vector for high-impact ransomware attacks. Furthermore, attackers are leveraging AI and LLMs to accelerate exploit development and network mapping. Nation-state actors are also adapting, with Chinese groups like Salt Typhoon and Linen Typhoon focusing on stealthy persistence in critical infrastructure, and other groups abusing legitimate cloud services like Google Calendar and Microsoft Azure for command-and-control operations. The findings underscore the need for automated defenses and a security strategy centered on identity verification and zero trust principles.

International Law Enforcement Dismantles 'LeakBase' Hacker Forum in Coordinated Takedown

In a major blow to the cybercrime economy, an international law enforcement operation led by the U.S. Department of Justice has seized and dismantled the 'LeakBase' hacker forum. The coordinated action, which took place on March 3-4, 2026, involved agents in 14 countries and was supported by Europol. LeakBase was a prominent English-language marketplace on the open web with over 142,000 members, used for buying and selling vast quantities of stolen data, including credentials from corporate breaches, credit card numbers, and other personally identifiable information. As part of the takedown, authorities seized the forum's infrastructure and collected user data, including private messages and IP logs, for evidentiary purposes. This operation follows similar successful disruptions of criminal forums like RaidForums and BreachForums, signaling a continued commitment by global law enforcement to disrupt the infrastructure that underpins cybercrime.

Half of Private Equity-Backed Firms Have High Cyber Risk, New Report Finds

A new report from ACA Group, released March 3, 2026, reveals a concerning state of cybersecurity within companies backed by private equity. The study, which assessed over 300 portfolio companies across 18 industries, found that half are operating with an 'elevated' or 'high' level of cyber risk. The Health Services and Producer Manufacturing sectors were identified as having the highest average risk scores. The report pinpoints two consistent areas of major weakness across the board: Third-Party Risk Management and Penetration Testing. The findings suggest that many firms are failing to adequately manage the security of their supply chains and are not effectively identifying and remediating their own vulnerabilities. The report underscores the need for stronger governance and programmatic controls to mitigate the growing risk of these companies being used as entry points for attacks on larger enterprises.

Global Coalition Disrupts 'Tycoon 2FA' Phishing Platform Used to Bypass MFA on Microsoft 365 and Gmail

An international coalition of law enforcement and private technology companies has disrupted the 'Tycoon 2FA' Phishing-as-a-Service (PaaS) platform. Announced on March 4, 2026, the operation involved Europol, Microsoft, Proofpoint, Cloudflare, and SpyCloud, leading to the seizure of 330 of the platform's control panel domains. Tycoon 2FA, active since at least 2023 and sold via Telegram, enabled cybercriminals to conduct adversary-in-the-middle (AiTM) phishing attacks. The service used a transparent proxy to intercept user credentials and, crucially, session cookies for Microsoft 365 and Gmail accounts, allowing attackers to bypass multi-factor authentication (MFA) and hijack active sessions. The takedown highlights the industrialization of cybercrime and the growing threat of session hijacking as a primary method for gaining unauthorized access to corporate accounts.

Trend Micro Warns of Severe RCE Flaws in Apex One Security Software, Allowing Protection Bypass

Trend Micro issued a warning on March 3, 2026, about severe remote code execution (RCE) vulnerabilities in its Apex One enterprise endpoint security solution. These flaws are highly critical because they could allow an attacker to disable the very security layers designed to protect the system. By exploiting these vulnerabilities, an attacker could remotely execute code on a protected endpoint, effectively neutralizing the Apex One agent. This would leave the system blind and defenseless, allowing the attacker to deploy further malware, exfiltrate data, or move laterally across the network undetected. Given that a security product itself is the attack vector, Trend Micro is urging customers and Managed Service Providers (MSPs) to apply the necessary patches immediately to prevent their primary line of defense from being turned against them.

ShinyHunters Leaks 12.4 Million CarGurus Records After Failed Extortion

The extortion group ShinyHunters has leaked a massive 6.1GB database containing 12.4 million user records allegedly stolen from the automotive marketplace CarGurus. The data, which includes full names, emails, phone numbers, and highly sensitive auto finance pre-qualification details, was published on February 21, 2026, after an extortion attempt failed. The breach tracking service 'Have I Been Pwned' has integrated the data, noting that it introduced 3.7 million new email addresses to its database. The incident places millions of users at significant risk of targeted phishing, identity theft, and financial fraud.

ManoMano Breach: 38 Million Customers Exposed After Third-Party Customer Service Provider Hacked

European DIY e-commerce giant ManoMano has disclosed a significant data breach impacting approximately 38 million customers across France, Germany, Italy, Spain, and the UK. The incident, which occurred in January 2026, was not a direct breach of ManoMano's systems but a supply chain attack targeting a third-party customer service provider. A threat actor known as 'Indra' has claimed responsibility, stating they exfiltrated 43GB of data, including full names, email addresses, phone numbers, and customer service message histories. ManoMano has confirmed that financial data and account passwords were not compromised. The company has since disabled the subcontractor's access, notified data protection authorities like France's CNIL, and is warning affected customers about potential phishing attacks.

CISA Orders Federal Agencies to Patch Actively Exploited Cisco and Ivanti Flaws

On February 12, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. The flaws affect Cisco Secure Firewall Management Center (FMC) software (CVE-2026-20131) and Ivanti Endpoint Manager (EPM) (CVE-2026-1603). CVE-2026-20131 is a critical deserialization flaw allowing remote code execution with root privileges on Cisco FMC. In response, CISA has issued a directive under BOD 22-01 requiring all Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by a specified deadline to mitigate significant risk to their networks.

Wynn Resorts Confirms ShinyHunters Stole Data of 800,000 Employees, May Have Paid Ransom

Wynn Resorts confirmed on February 24, 2026, that it was the victim of a data breach by the ShinyHunters extortion group, resulting in the theft of sensitive data for approximately 800,000 employees. The stolen information includes Social Security numbers, names, and contact details. The initial intrusion reportedly occurred in September 2025 via a vulnerability in the company's Oracle PeopleSoft platform. ShinyHunters demanded a $1.5 million ransom and later removed Wynn from its leak site, strongly suggesting a payment was made. Wynn is now facing a class-action lawsuit and is offering identity protection services to affected employees.

APT37's 'Ruby Jumper' Malware Breaches Air-Gapped Networks via USB

The North Korean state-sponsored group APT37 (aka ScarCruft) is using a new malware suite called 'Ruby Jumper' to breach and exfiltrate data from highly secure, air-gapped networks. Active since at least December 2025, the campaign uses weaponized USB drives to bridge the air gap. The complex attack chain involves LNK files, PowerShell, and a backdoored Ruby interpreter to establish persistence and deploy surveillance tools, demonstrating a significant advancement in techniques for targeting isolated environments.

Bitrefill Breach: North Korea's Lazarus Group Suspected in Attack on Crypto Service

Bitcoin payment service Bitrefill has disclosed a data breach that occurred on March 1, 2026, after a single employee's laptop was compromised. The attack methods bear a strong resemblance to campaigns by the North Korean state-sponsored Lazarus Group. The breach exposed data from approximately 18,500 purchase records, including email addresses and IP metadata. Bitrefill has isolated the affected systems and is working with law enforcement.

Russia's APT28 Linked to Exploitation of MSHTML Zero-Day Before Patch

Security firm Akamai has found evidence suggesting that the Russian state-sponsored group APT28 (Fancy Bear) exploited a high-severity zero-day vulnerability, CVE-2026-21513, in Microsoft's MSHTML framework before it was patched in February 2026. The flaw, which allows attackers to bypass the Mark-of-the-Web (MotW) security feature, was reportedly exploited using malicious LNK files. The findings link the zero-day to infrastructure previously used in APT28 campaigns targeting Ukraine.

DragonForce Ransomware Hits Top Brazilian University, Threatens Data Leak

The DragonForce ransomware group has claimed responsibility for a cyberattack on Fundação Getulio Vargas (FGV), a prominent Brazilian university and research institution. In a post on March 2, 2026, the group threatened to publish a 'full leak' of sensitive data if the university does not enter into negotiations. The attack highlights the continued targeting of the education sector by ransomware gangs.

Qilin Ransomware Strikes Italian Logistics Firm, Threatening Supply Chain Disruption

The Qilin ransomware group has claimed an attack on Traffic Tech, a major logistics and freight company based in Italy. The claim was made on March 1, 2026, with the group threatening to leak sensitive operational data. This attack highlights the persistent and significant threat that ransomware poses to the global supply chain, where operational disruptions can have widespread cascading effects.

Vect Ransomware Claims Breach of Indian Manufacturer USHA, Accessing SAP Data

The Vect ransomware group has claimed a cyberattack on USHA International Limited, a major Indian manufacturer of consumer durables. In a post on March 1, 2026, the attackers alleged they have breached sensitive employee data and crucial databases, including SAP, CMS, and CMR systems. The group stated that negotiations with the company were in progress, setting a deadline of approximately 19 days before they threaten to leak the stolen data.

Iran-Linked 'Dust Specter' APT Uses AI-Generated Malware to Spy on Iraqi Officials

A suspected Iran-nexus threat actor, tracked by Zscaler ThreatLabz as 'Dust Specter,' was observed targeting Iraqi government officials in a cyberespionage campaign in January 2026. The campaign used previously undocumented malware, including a dropper called SPLITDROP, and leveraged a compromised Iraqi government website for command-and-control. Researchers noted with medium-to-high confidence that the malware's codebase shows signs of being developed with the assistance of generative AI, marking a potential evolution in APT tactics.

Samsung Settles with Texas Over Unauthorized Smart TV Data Collection

Samsung Electronics has settled with the State of Texas over allegations that it used Automated Content Recognition (ACR) technology in its Smart TVs to collect detailed user viewing data without obtaining proper, express consent. Announced on March 1, 2026, the settlement resolves claims of deceptive trade practices and requires Samsung to overhaul its privacy disclosures and implement more transparent 'opt-in' mechanisms for data tracking, highlighting growing regulatory scrutiny over consumer data privacy in IoT devices.

UH Cancer Center Pays Ransom After Breach Exposes Data of 1.24 Million People

The University of Hawaiʻi (UH) Cancer Center has disclosed a major data breach stemming from a ransomware attack in August 2025. The incident compromised the sensitive personal information of approximately 1.24 million people, including Social Security numbers and historical voter registration and driver's license data used for research. The affected data was stored on servers in the Epidemiology Division and did not impact patient care systems. Due to the extent of the encryption, UH confirmed it paid a ransom to the unidentified attackers to obtain a decryption tool and an affirmation that the exfiltrated data was destroyed.

Conduent Breach Explodes: Safepay Ransomware Hits 25 Million with Sensitive Data Theft

Business process outsourcing giant Conduent is notifying over 25 million people that their highly sensitive personal and medical data was compromised in a ransomware attack attributed to the Safepay gang. The breach exposed a trove of PII and PHI, including Social Security numbers and detailed health information, affecting customers of Conduent's numerous government and private sector clients like Blue Cross Blue Shield and Humana. The number of victims has swelled from initial estimates of 10 million, placing a massive population at high risk for identity theft and fraud. Victims are being offered credit monitoring and urged to freeze their credit.

Cloud Misconfiguration at Canadian Tire Exposes 38 Million Customer Accounts

Retail giant Canadian Tire has confirmed that a data breach discovered in October 2025 compromised the personal information of over 38 million customer accounts. The incident, which affected e-commerce databases for brands including Canadian Tire, SportChek, and Mark's, was caused by a misconfigured cloud environment. Exposed data includes names, addresses, emails, phone numbers, and, for a subset of users, dates of birth and partial credit card information. While the company states the encrypted passwords (PBKDF2 hashes) and partial card data are not directly usable for fraud, the scale of the breach poses a significant risk of phishing and identity-related scams.

Coupang Reports $26M Loss, Blames 34M-Customer Data Breach for Fallout

South Korean e-commerce giant Coupang has reported a net loss of $26 million for Q4 2025, a sharp reversal from a profit a year earlier. The company directly attributes the poor financial performance and a miss on revenue estimates to the fallout from a November 2025 data breach that compromised the personal information of 34 million customers. The incident led to a decline in active customers, increased churn in its membership program, and forced the company to pledge $1.2 billion in customer compensation, resulting in negative free cash flow. The disruption is expected to continue into early 2026.

Indian Chief Justice: Forensic Science is a 'Protective Shield' Against Digital Crime

Speaking at the National Forensic Sciences University, Chief Justice of India (CJI) Surya Kant described forensic science as an essential "protective shield" for the justice system in the face of complex digital crimes. He highlighted that threats like cyber intrusions, digital fraud, and transnational data crimes are challenging traditional investigation methods. The CJI stressed that the integrity of justice depends on verifiable, fact-based evidence provided by ethically-guided forensic analysis, warning that scientific analysis "cannot exist in a moral vacuum."

India Risks Trading 'Autonomy for Efficiency' with Foreign AI, Warns Ex-Diplomat

At the Asia Economic Dialogue, former Indian foreign secretary Nirupama Rao warned that India risks losing its national autonomy if it becomes overly dependent on foreign-developed artificial intelligence. She argued that relying on "borrowed algorithms" might increase efficiency at the cost of sovereignty. Rao identified AI, semiconductors, and cybersecurity as critical "sovereignty platforms" where India must build its own mastery to secure its national interests in a turbulent global environment and avoid vulnerabilities from concentrated supply chains.

Indian Banks Embrace AI to Combat 1.4 Million Annual Cyberattacks

Leaders in India's banking sector are turning to Artificial Intelligence (AI) as a strategic defense against a rising tide of cyber threats, estimated at 1.4 million attacks annually. Executives highlighted that AI is crucial for fraud detection, cost reduction, and superior risk management in underwriting. Global banks like Bank of America and JP Morgan Chase are cited as examples of successful AI implementation. The push for AI adoption coincides with a broader digital transformation in the sector, including a new government dashboard for real-time oversight and a focus on using vast data reserves for hyper-personalized customer services.

Statamic CMS Flaw (CVE-2026-28423) Enables Cloud Credential Theft via SSRF

A Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-28423, has been disclosed in the Statamic content management system. The flaw, which has a CVSS score of 6.8, exists in the Glide image manipulation feature. An unauthenticated attacker can exploit it to force the server to make HTTP requests to internal network services or, more critically, to cloud metadata endpoints. This could allow an attacker to steal sensitive cloud credentials (e.g., from an AWS EC2 instance), leading to a full compromise of the underlying cloud infrastructure. Users are advised to patch or reconfigure the feature to prevent abuse.

Patch Released for "ClawJacked" WebSocket Hijacking Flaw in OpenClaw AI Agent

A patch has been released for a high-severity vulnerability, dubbed "ClawJacked," in the OpenClaw AI agent. The flaw, fixed in version 2026.2.13, allowed a malicious website to hijack a locally running OpenClaw agent by abusing its WebSocket connection. An attacker could trick a developer into visiting a malicious site, which would then silently connect to and control the local agent. The vulnerability also exposed a risk of indirect prompt injection. The flaw was responsibly disclosed, and a fix was promptly issued.

Conduent Data Breach Impact Explodes to 25 Million Americans, Safepay Ransomware Blamed

The true scale of the data breach at government services contractor Conduent Business Services has been revealed, with new figures showing over 25 million individuals across the U.S. have been affected. The breach, which occurred between late 2024 and early 2025, involved the theft of highly sensitive personal and medical information. The Safepay ransomware group has claimed responsibility for the attack, stating they exfiltrated over 8 terabytes of data. The incident has impacted numerous state government services and healthcare providers, prompting an investigation by the Texas Attorney General.

‘Diesel Vortex’ Phishing Ring Steals Over 1,600 Credentials from US & European Logistics Firms

A financially motivated threat group dubbed 'Diesel Vortex' has been identified targeting the freight and logistics industry in the United States and Europe since September 2025. The campaign utilized a Phishing-as-a-Service (PaaS) model, complete with call centers and typosquatted domains mimicking platforms like DAT Truckstop and Penske Logistics. The actors employed a 'Dual-Domain Deception' technique to bypass browser warnings and used vishing and Telegram to capture MFA codes. An exposed .git repository led investigators to the group's infrastructure, revealing the theft of 1,649 unique credentials and evidence of financial fraud, including double-brokering and EFS check fraud. The group is believed to be Armenian-speaking with ties to Russian infrastructure.

Dutch Prison Agency Data Exposed for Five Months in Wider Government Hack

An investigation has revealed that hackers had prolonged access, for at least five months, to the systems of the Dutch prison agency (Dienst Justitiële Inrichtingen - DJI). The breach exposed sensitive staff data, including email addresses, phone numbers, and security certificates, raising fears of blackmail. The attackers also gained access to phones, tablets, and laptops. The incident is part of a wider attack that also affected other Dutch government bodies, including the privacy watchdog and the judiciary council. The Dutch National Cyber Security Centre (NCSC) is monitoring the situation as the investigation continues.

Accounting Firm Legacy Professionals LLP Reports Data Breach Affecting Over 215,000 People

The accounting and consulting firm Legacy Professionals LLP has reported a data breach to the Attorney General of Maine, indicating that the personal information of over 215,000 people has been compromised. The firm discovered suspicious activity on its internal computer network where 'sensitive identifiable information' was stored. The notification suggests that personal data of Maine residents was involved, triggering the reporting requirement. The full scope of the breach, the specific data types exposed, and the attack vector have not yet been publicly disclosed. The firm is in the process of notifying the affected individuals.

Hacker Reportedly Used 'Jailbroken' AI Chatbot Claude to Breach Mexican Government Agencies

A hacker has reportedly used Anthropic's AI chatbot, Claude, to facilitate a series of cyberattacks against Mexican government agencies, resulting in the theft of approximately 150 GB of data. The compromised information is said to include 195 million taxpayer and voter records, government employee credentials, and civil registry files. The targeted agencies include Mexico's tax authority and national electoral institute. The attacker allegedly had to 'jailbreak' the AI model, bypassing its safeguards, to get it to assist in writing the scripts needed to breach the government networks. The incident highlights the growing threat of advanced AI tools being abused for malicious cyber operations.

Microsoft and Dell Patch Actively Exploited Zero-Day Vulnerabilities

Two significant enterprise vulnerabilities have been disclosed. Microsoft patched a critical privilege escalation flaw (CVE-2026-26119, CVSS 8.8) in Windows Admin Center. More severely, Dell revealed a maximum-severity zero-day (CVE-2026-22769, CVSS 10.0) in its RecoverPoint for VMs product has been actively exploited by a suspected Chinese-linked group, UNC6201, since mid-2024. The Dell flaw involves hard-coded credentials, allowing root access and deployment of BRICKSTORM and GRIMBOLT malware.

NATO Certifies iPhones and iPads for "Restricted" Classified Data Handling

In a landmark decision, NATO has approved Apple's iPhones and iPads running iOS 26 and iPadOS 26 for handling classified data up to the "NATO Restricted" level. This makes them the first consumer mobile devices to achieve this certification without requiring any specialized hardware or software modifications. The approval, which applies to all NATO member nations, followed a rigorous security evaluation by Germany's Federal Office for Information Security (BSI), validating Apple's built-in security architecture.

Critical Flaws in Anthropic's Claude AI Tool Allowed Silent System Takeover

Check Point Research has disclosed three significant, now-patched vulnerabilities in Anthropic's AI coding assistant, Claude Code. The flaws could have allowed an attacker to achieve remote code execution (RCE), steal sensitive API keys, and take full control of a developer's environment. The attack was particularly dangerous as it could be triggered simply by having a developer clone and open a malicious code repository, highlighting new supply chain risks in AI-assisted development workflows.

"AirSnitch" Wi-Fi Attack Bypasses WPA3 Encryption to Intercept Traffic

Researchers have disclosed a novel Wi-Fi attack technique named "AirSnitch" that exploits architectural weaknesses in the Wi-Fi networking stack. The attack allows a threat actor already on the same network to bypass encryption, including on WPA3-protected networks, to intercept traffic, perform man-in-the-middle (MitM) attacks, and steal data. The flaw stems from a failure to cryptographically link identifiers across network layers, enabling an attacker to spoof a victim's identity and divert their traffic. The attack was demonstrated on popular routers from Netgear and Asus.

Discord Pauses Global Age Verification Rollout Until Late 2026 Amid Privacy Backlash

Discord has delayed the global implementation of its new age verification system until the second half of 2026. The decision follows widespread user criticism regarding privacy and data security, with many fearing mandatory ID uploads. Acknowledging it "missed the mark," Discord clarified that the system will primarily use on-platform signals and that most users won't need manual verification. The company also pledged more transparency, including publishing its list of verification vendors and prioritizing on-device processing to protect user data.

RansomHouse Claims Cyberattack on European Outlet Giant Neinver

The RansomHouse ransomware group has claimed responsibility for a cyberattack against Neinver, a major Spanish-based company that operates retail outlet centers across Europe. On February 27, 2026, the group added Neinver to its dark web leak site, threatening to release sensitive data if the company does not enter negotiations. Details about the attack vector and the scope of the data exfiltrated have not yet been disclosed. The incident highlights the ongoing trend of data extortion attacks against large enterprises.

INTERPOL's "Operation Red Card 2.0" Nabs 651 in African Cybercrime Sweep

An eight-week, INTERPOL-led crackdown on transnational online fraud across 16 African nations has concluded with significant results. Dubbed "Operation Red Card 2.0," the initiative led to the arrest of 651 individuals and the recovery of over $4.3 million in illicit funds. The operation targeted prevalent schemes such as high-yield investment scams, mobile money fraud, and fraudulent loan applications, which are estimated to have caused over $45 million in losses.

Chinese Hackers Used ChatGPT for Influence Operations, OpenAI Confirms

OpenAI has confirmed that threat actors linked to China have utilized its ChatGPT large language model to support cyberattack and influence operations. While not used for technical exploit development, the AI was leveraged to generate polished propaganda, craft convincing spear-phishing content, and create operational plans for social media manipulation. The activities included romance scams and fraudulent outreach to U.S. officials. OpenAI has banned the associated accounts and is enhancing its abuse detection mechanisms.

Marquis Sues SonicWall, Alleging Vendor's Breach Led to Ransomware Attack on 74 Banks

In a significant legal development for supply chain liability, financial services provider Marquis Software Solutions has filed a lawsuit against cybersecurity vendor SonicWall. Marquis alleges that a 2025 breach of SonicWall's MySonicWall cloud backup service exposed its firewall configuration data and unencrypted MFA scratch codes. This data, Marquis claims, was then used by threat actors to bypass its defenses and launch a devastating ransomware attack in August 2025 that disrupted services for 74 U.S. banks. The lawsuit accuses SonicWall of gross negligence.

Chinese APT UNC6201 Weaponizes Dell Zero-Day to Deploy GRIMBOLT Backdoor in VMware Environments

A sophisticated cyberespionage campaign attributed to a suspected Chinese state-sponsored actor, UNC6201, has been actively exploiting a critical zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines. The flaw, a hard-coded credential issue with a CVSS score of 10.0, allows unauthenticated remote attackers to gain root access. The campaign, ongoing since at least mid-2024, targets VMware infrastructure to deploy a suite of custom malware, including a new C#-based backdoor named GRIMBOLT. Researchers at Mandiant and Google observed the actor using the exploit for lateral movement and to establish persistent access, highlighting a significant threat to enterprise data recovery and virtualization environments. Dell has released patches and urges immediate updates.

US Treasury's OCC Remediates Critical BankNet Portal Vulnerability After Researcher Disclosure

The Office of the Comptroller of the Currency (OCC), a bureau within the U.S. Department of the Treasury, announced it has successfully remediated a cybersecurity vulnerability in its critical BankNet portal. The flaw was reported by a security researcher on February 25, 2026, under the agency's vulnerability disclosure policy. The OCC temporarily suspended access to the portal to conduct a forensic investigation, which found no evidence of data exfiltration or unauthorized access beyond that of the reporting researcher.

Threat Intelligence Supply Chain is Broken, Georgia Tech Researchers Warn

Researchers from Georgia Tech have revealed significant weaknesses in the global threat intelligence sharing ecosystem. Their study, presented on February 25, 2026, found that crucial information sharing between security vendors, antivirus companies, and sandbox services is slow and incomplete. The research showed that while most vendors analyze new malware, only 17% share the resulting intelligence. This creates dangerous delays and blind spots that can be exploited by adversaries and are exacerbated by geopolitical tensions, threatening to fracture the entire security community's defensive capabilities.

IBM X-Force: AI and RaaS Fuel 49% Surge in Ransomware Groups

The 2026 IBM X-Force Threat Intelligence Index, released on February 26, 2026, paints a concerning picture of the evolving threat landscape. The report reveals a 49% increase in ransomware groups compared to the previous year, a surge driven by the proliferation of AI and Ransomware-as-a-Service (RaaS) models that are lowering the barrier to entry for less skilled attackers. The report also highlights a significant rise in vulnerability exploitation, with 56% of tracked flaws requiring no authentication to exploit, and a nearly fourfold increase in supply chain attacks over the past five years.

Google Security Operations Unifies Access Control with Native IAM Integration

Google has enhanced its Security Operations platform by migrating its permission model to Google Cloud's native Identity and Access Management (IAM) framework. The update, announced on February 25, 2026, allows administrators to manage Role-Based Access Control (RBAC) for both the SIEM and SOAR components from a single, unified interface. This change enables more granular, consistent, and streamlined management of user permissions and automatically scopes data visibility in dashboards based on a user's assigned access labels.

Critical Unauthenticated RCE Flaw (CVE-2026-33017) in Langflow AI Platform Actively Exploited

A critical unauthenticated remote code execution (RCE) vulnerability, CVE-2026-33017, has been disclosed in the popular open-source AI framework, Langflow. The flaw allows an attacker to execute arbitrary Python code on a vulnerable server with a single HTTP request by sending a malicious flow definition to a public-facing API endpoint. The vulnerability, which exists in the way the server processes code with an `exec()` function, was reportedly weaponized and exploited by attackers within 20 hours of its public disclosure, highlighting the significant risk posed by insecure AI infrastructure.

Conduent Data Breach May Be Largest in U.S. History; Texas AG Investigates

The data breach at government contractor Conduent Business Services is escalating into what may be the largest in U.S. history, with estimates now exceeding 25 million victims nationwide. The Safepay ransomware group claimed to have stolen over 8 terabytes of data, including names, Social Security numbers, and medical histories. The breach, which occurred between late 2024 and early 2025, has triggered a formal investigation by the Texas Attorney General due to its massive impact on citizens, including 15.4 million in Texas alone. This incident serves as a stark reminder of the profound risks associated with third-party supply chain security.

CISA Orders Patching for Two Actively Exploited Cisco SD-WAN Flaws

On February 25, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities affecting Cisco Catalyst SD-WAN products to its Known Exploited Vulnerabilities (KEV) catalog, signaling they are under active attack. The flaws are CVE-2026-20127, a critical authentication bypass, and CVE-2022-20775, a path traversal vulnerability. Under Binding Operational Directive (BOD) 22-01, federal agencies are now mandated to apply the necessary patches by a specified deadline to protect their networks from these significant risks.

Google & Mandiant Dismantle Global Chinese Spy Network Using Novel "GRIDTIDE" Backdoor

On February 25, 2026, Google and Mandiant revealed they had disrupted a massive, multi-year cyber espionage campaign attributed to UNC2814, a suspected China-nexus threat actor. The operation compromised at least 53 organizations in 42 countries, primarily in the telecommunications and government sectors. The attackers utilized a novel C-based backdoor named GRIDTIDE, which cleverly abused the legitimate Google Sheets API for command and control, allowing its traffic to blend in with normal cloud activity. The joint disruption effort involved terminating the actor's cloud projects, disabling accounts, and taking down associated infrastructure, marking a significant blow to a prolific and distinct espionage group.

North Korea's Lazarus Group Adopts Medusa Ransomware, Targeting Healthcare

In a notable strategic shift, North Korea's state-sponsored Lazarus Group has been observed deploying Medusa ransomware in its financially motivated campaigns. Security researchers reported on February 24, 2026, that the prolific APT group used the ransomware-as-a-service (RaaS) offering in a successful attack in the Middle East and a failed attempt against a U.S. healthcare organization. This adoption of an off-the-shelf ransomware platform, rather than their custom tools, suggests Lazarus is industrializing its cybercrime efforts. The attacks leveraged a familiar toolkit, including the Comebacker backdoor and BLINDINGCAN RAT, indicating a blend of sophisticated espionage tradecraft with mainstream criminal tactics.

Medical Device Maker UFP Technologies Hit by Ransomware, Data Stolen and Destroyed

UFP Technologies, a U.S.-based manufacturer of medical devices, disclosed in a February 24 SEC filing that it suffered a ransomware attack on February 14, 2026. The company's CFO described it as a 'classic ransomware attack' where data was both stolen and destroyed. The incident caused significant disruption to IT systems, impacting billing, shipping, and other functions, leading to short-term shipment delays. While the company believes the threat actor has been removed and systems will be restored, an investigation is ongoing to determine the scope of the compromised data. No specific ransomware group has claimed responsibility.

CISA Warns of Actively Exploited RCE Flaw in Soliton FileZen Appliance

On February 24, 2026, CISA added a critical OS command injection vulnerability in the FileZen file transfer appliance to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-25108, affects products from the Japanese firm Soliton Systems K.K. and is confirmed to be under active exploitation. Command injection flaws can allow for remote code execution, leading to full system compromise. CISA has mandated that federal agencies patch the vulnerability by the specified deadline and strongly urges all organizations using FileZen to do the same.

Predator Spyware Defeats iPhone Privacy Indicators for Covert Recording

Research published on February 24, 2026, has revealed a sophisticated and stealthy capability of the Predator spyware, sold by commercial surveillance vendor Intellexa. The spyware can secretly record audio and video on a compromised iPhone by programmatically disabling the green and orange dot indicators in the iOS status bar. This is achieved by hooking into a core system process called SpringBoard. By defeating this key, user-facing privacy feature, Predator can conduct surveillance that is completely invisible to the victim, undermining the security assurances provided by the operating system.

LockBit Attackers Exploit Apache ActiveMQ Flaw, Return After Eviction

A threat intelligence report from February 25, 2026, details a persistent LockBit ransomware attack where threat actors demonstrated significant determination. The attackers initially gained access by exploiting CVE-2023-46604, a known RCE vulnerability in Apache ActiveMQ. Although the victim organization detected and evicted the intruders, the attackers returned 18 days later, this time using credentials stolen during the initial breach to regain access via RDP. They then used tools like Metasploit and AnyDesk to move laterally and successfully deploy the LockBit ransomware, highlighting the critical need for comprehensive remediation, including credential resets, after a security incident.

Conduent Data Breach Victim Count Skyrockets to 25 Million, Triggering Texas AG Investigation

The fallout from the 2025 data breach at business services provider Conduent has dramatically worsened, with the number of affected individuals now estimated to be over 25 million, a significant jump from the 10.5 million initially reported. The breach involved the theft of over eight terabytes of highly sensitive data, including names, Social Security numbers, and medical information. The massive scale of the incident, which now includes over 15 million Texans, has prompted the Texas Attorney General to launch a formal investigation into what could be one of the largest healthcare-related data breaches in U.S. history.

No Crystal Ball: AI Denies Future Threat Report Request

An automated cybersecurity analysis system rejected a user request to generate a threat report for February 24, 2026. The system's refusal was based on its core programming, which prohibits the fabrication of information for future dates where no data exists. This event serves as a practical demonstration of AI safety guardrails, specifically the principle of avoiding hallucination and maintaining data integrity. The response underscores that the system's function is to analyze past and present events, not to speculate on future occurrences, thereby ensuring the reliability and trustworthiness of the intelligence provided.

Critical Confluence Zero-Day (CVE-2026-22515) Actively Exploited to Deploy LockBit Ransomware

Atlassian has issued an emergency patch for a critical remote code execution (RCE) zero-day, CVE-2026-22515 (CVSS 9.8), affecting Confluence Data Center and Server. The vulnerability is being actively exploited by threat actors, including a group named 'Cerberus', to gain initial access, deploy web shells, and ultimately deliver LockBit 3.0 ransomware. The flaw stems from an authentication bypass in the attachment upload process, allowing unauthenticated attackers to take full control of vulnerable instances.

CISA Warns of North Korean "SandViper" APT Espionage Campaign Targeting US Defense Sector

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and NSA, has issued a joint advisory detailing a sophisticated cyber-espionage campaign by "SandViper," a North Korean state-sponsored APT group. The campaign targets the U.S. Defense Industrial Base (DIB) to steal military and aerospace secrets. Attackers use spear-phishing and exploit CVE-2025-41890, deploying custom malware like the "DuneDrifter" backdoor and "SandHauler" exfiltration tool.

GlobalPay Supply Chain Attack Exposes 20 Million Credit Cards; ShinyHunters Claims Responsibility

GlobalPay, a major payment processor, has suffered a massive data breach exposing the credit card details and personal information of approximately 20 million individuals. The breach was the result of a supply chain attack, where a compromised third-party software update allowed attackers to access GlobalPay's network. The notorious cybercrime group ShinyHunters has claimed responsibility, demanding a $5 million ransom to prevent the data from being sold.

New "ChronoLeap" Infostealer Bypasses MFA Using System Time Manipulation

Security researchers at Zscaler have discovered "ChronoLeap," a new information-stealing malware with a novel technique to bypass multi-factor authentication (MFA). The malware uses a Browser-in-the-Browser (BitB) attack to steal credentials, then manipulates the victim's system clock to extend the validity window of the MFA token. Combined with session cookie theft, this allows attackers to gain full access to protected accounts. ChronoLeap is being offered as a Malware-as-a-Service (MaaS), indicating it could see widespread use.

Scattered Spider Launches Massive Tax-Season Phishing Campaign Impersonating IRS, HMRC, and CRA

A large-scale phishing campaign attributed to the cybercrime group "Scattered Spider" is targeting taxpayers in the United States, United Kingdom, and Canada. The attackers are using convincing emails and SMS messages that impersonate the IRS, HMRC, and CRA, luring victims with fake tax refund notifications. The goal is to steal a wide range of personal and financial information through high-quality, geo-targeted phishing portals.

Microsoft Issues Emergency Patch for Critical Exchange Privilege Escalation Flaw (CVE-2026-21445)

Microsoft has released an emergency, out-of-band security update for a critical privilege escalation vulnerability in Microsoft Exchange Server 2016 and 2019. The flaw, tracked as CVE-2026-21445 with a CVSS score of 9.1, could allow an attacker with a standard user's credentials to escalate their privileges to Domain Administrator, effectively compromising the entire Active Directory environment. Microsoft urges immediate patching.

Global Police Operation "Cyber-Surge" Dismantles "LabHost" Phishing-as-a-Service Empire

A massive international law enforcement operation, codenamed "Cyber-Surge," has successfully dismantled "LabHost," a notorious Phishing-as-a-Service (PhaaS) platform. Led by Europol and involving 19 countries, the operation resulted in 37 arrests and the seizure of the platform's infrastructure. LabHost provided subscription-based phishing kits to over 2,000 criminals, enabling at least 40,000 successful attacks worldwide by targeting banks, government services, and tech companies.

US Treasury Sanctions Crypto Mixers VortexCash and Cyclone for Laundering Ransomware Proceeds

The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) has sanctioned two major cryptocurrency mixing services, VortexCash and Cyclone. The action was taken due to their extensive use by threat actors, including the North Korean Lazarus Group and the Conti and Ryuk ransomware gangs, to launder the proceeds of cybercrime. The sanctions make it illegal for U.S. persons to transact with these services, aiming to disrupt the financial infrastructure of ransomware operations.

"VoltSchemer" Attack Can Manipulate EV Charging and Destabilize Power Grids

Researchers have demonstrated a new attack method, "VoltSchemer," that exploits vulnerabilities in the Combined Charging System (CCS) standard for electric vehicles (EVs). By injecting malicious signals into the communication line between the vehicle and charger, an attacker can disrupt charging, overcharge batteries, and potentially create instability in local power grids. The attack can be carried out wirelessly from a nearby device.

Critical RCE Flaw in Ray AI Framework Actively Exploited After PoC Release

A critical remote code execution vulnerability, CVE-2023-48022 (CVSS score 9.8), in the open-source Ray AI/ML framework is under active threat following the public release of a proof-of-concept exploit. The flaw, stemming from a lack of authentication in the Ray Dashboard, allows unauthenticated attackers to execute arbitrary code and take full control of vulnerable Ray clusters. Security researchers report thousands of internet-exposed Ray instances are at immediate risk. The vulnerability affects Ray versions 2.6.3 and earlier, and users are urged to upgrade to version 2.7.0 or later immediately.

PayPal Discloses Data Breach After Software Bug Exposes User PII for Six Months

PayPal has disclosed a data breach resulting from a software bug in its PayPal Working Capital (PPWC) loan application. The flaw, which went undetected for nearly six months from July to December 2025, exposed the sensitive personal information of approximately 100 users. The compromised data includes names, addresses, dates of birth, and Social Security numbers. PayPal discovered the issue on December 12, 2025, and fixed it the next day. The company stated that a few customers experienced unauthorized transactions, which have since been refunded, and is offering two years of credit monitoring to those affected.

Kaplan Data Breach Exposed SSNs and Driver's Licenses of Over 200,000 Individuals

Educational services provider Kaplan North America has concluded its investigation into a 2025 cyberattack, confirming that files containing highly sensitive personal information were stolen. The breach, which occurred between October and November 2025, resulted in the exfiltration of names, Social Security numbers, and driver's license numbers. Regulatory filings show the breach impacted at least 173,676 residents in Texas, 26,612 in South Carolina, and 19,075 in Maine, with the total number likely being much higher. Kaplan is now notifying affected individuals and offering one year of identity protection services.

DHS Pressures Google, Meta, Reddit to Unmask Anonymous Critics of ICE

The Department of Homeland Security (DHS) has reportedly issued hundreds of administrative subpoenas to major tech companies, including Google, Meta, Reddit, and Discord, demanding the personal details of anonymous social media users. The targeted accounts are those that post critical commentary about Immigration and Customs Enforcement (ICE) or share publicly available information about the agency's operations. This move to unmask online critics using subpoenas that do not require a judge's approval has sparked significant concern among civil liberties advocates and resistance from the tech companies, raising questions about protected speech and privacy.

Fintech Firm Figure Technologies Breached by ShinyHunters; 1 Million Customer Records Leaked

Blockchain lending firm Figure Technology Solutions confirmed it suffered a major data breach after an employee's credentials were stolen in a social engineering attack. The notorious cybercrime group ShinyHunters has claimed responsibility, leaking 2.5GB of data allegedly belonging to nearly one million customers after the company refused to pay a ransom. The exposed data includes names, dates of birth, email addresses, and physical addresses, placing affected individuals at high risk for identity theft and further phishing attacks. Figure is now offering credit monitoring services to impacted users as legal investigations begin.

Convergence of Identity and Data Security Creates New Attack Vectors, Netwrix Warns

A new report from Netwrix warns that the next wave of cyber threats will arise from the convergence of identity and data security. As organizations increasingly rely on automated workflows to manage data access, attackers are shifting their focus from stealing individual credentials to exploiting misconfigured identity orchestration and automation. The report predicts that failures in identity automation will directly lead to data exposure. With the rise of agentic AI, which can autonomously perform actions, securing the identity of these non-human agents becomes paramount. Netwrix concludes that unified visibility across both identity management and data security is now essential to mitigate these emerging risks.

Semiconductor Giant Advantest Hit by Ransomware, Investigates Impact on Supply Chain

Advantest Corporation, a leading Japanese manufacturer of semiconductor testing equipment, has detected and is investigating a ransomware intrusion on its internal IT network. The company acted to isolate the affected systems to prevent the malware from spreading and has launched a full investigation to assess the scope and impact. As a critical supplier in the global semiconductor industry, this attack raises concerns about potential disruptions to the technology supply chain and the theft of valuable intellectual property. The ransomware group responsible has not yet been named.

AI's Role in Malware Evolves from Assistant to Embedded Threat Component

A February 17, 2026 analysis highlights a significant evolution in how threat actors are using Artificial Intelligence. The trend is shifting from using AI as a tool for development (e.g., writing phishing emails) to directly embedding AI models within malware itself. This new class of AI-integrated malware can dynamically alter its code, adapt its behavior to evade security tools, and make autonomous decisions about when to execute malicious actions. Attackers are using 'distillation attacks' to create their own unrestricted versions of commercial AI models, enabling this new phase of stealthy, persistent, and adaptive threats that challenge traditional, signature-based detection methods.

PromptSpy: First Android Malware to Weaponize Google's Gemini AI for Stealth and Persistence

Security researchers at ESET have uncovered 'PromptSpy,' a groundbreaking Android malware that integrates Google's Gemini AI to achieve persistence and evade removal. This marks the first known instance of malware weaponizing a large language model (LLM) in its core operational loop. PromptSpy sends UI data to Gemini, which returns instructions on how to navigate the device's interface to 'pin' the malicious app, preventing users from easily closing it. While its current goal is to deploy a VNC for remote access, PromptSpy's use of AI to dynamically adapt to different Android devices represents a significant and concerning evolution in mobile threat capabilities.

CISA KEV Catalog Updated with Actively Exploited BeyondTrust and SolarWinds RMM Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several critical vulnerabilities in Remote Monitoring and Management (RMM) tools from BeyondTrust and SolarWinds to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that threat actors are actively exploiting these flaws in the wild, likely for initial access and ransomware deployment. CISA has mandated a three-day patching deadline for federal agencies. The vulnerabilities, including a CVSS 9.9 flaw in SolarWinds Web Help Desk (CVE-2026-1731), provide privileged access into networks, making them high-priority targets for attackers and defenders alike.

Ransomware Attack Cripples University of Mississippi Medical Center, Forcing Clinic Closures

The University of Mississippi Medical Center (UMMC) has been hit by a severe ransomware attack, causing widespread disruption to its IT systems and patient care. The attack disabled the electronic health records (EHR) system, forcing the medical center to cancel surgeries and appointments and revert to manual paper-based processes. Clinics across the state have been shut down as UMMC works to contain the threat and restore operations. This incident is a stark reminder of the devastating impact of ransomware on the healthcare sector, where IT outages can directly threaten patient safety.

Warlock Ransomware Hits SmarterTools by Exploiting Flaw in its Own Email Server Software

In an ironic turn, software company SmarterTools was breached by the Warlock ransomware group, who exploited a known vulnerability (CVE-2026-23760) in SmarterTools' own SmarterMail email server software. The attackers leveraged the authentication bypass flaw for initial access, then deployed ransomware and used a malicious installer for the Velociraptor DFIR tool to establish persistence. The incident, first detected in late January 2026, is a stark reminder that all organizations, including software vendors themselves, must practice diligent patch management for internet-facing systems.

Critical Flaw in Grandstream VoIP Phones (CVE-2026-21486) Allows Silent Eavesdropping

A significant vulnerability, CVE-2026-21486, has been disclosed in popular VoIP phones from Grandstream. The flaw could be exploited by remote attackers to gain access to internal device interfaces and, most critically, to silently eavesdrop on private phone conversations. This poses a serious privacy and security risk for businesses and individuals using the affected devices. Users are urged to seek out and apply firmware updates from Grandstream immediately to mitigate the threat of having their sensitive communications compromised.

Honeywell CCTV Cameras Have Critical Auth Bypass Flaw, Allowing Video Hijacking

A critical authentication bypass vulnerability has been reported in multiple Honeywell CCTV camera models. The flaw, disclosed on February 19, 2026, could allow a remote, unauthenticated attacker to hijack user accounts and gain complete access to the cameras. This would enable them to view live and recorded video feeds, manipulate camera settings, or disable surveillance entirely, posing a severe risk to physical security and privacy. Users of Honeywell CCTV systems are urged to monitor for an official advisory and patch from the manufacturer.

FCC Warns US Telecoms of Soaring Ransomware Threat, Mandates Stronger Defenses

The U.S. Federal Communications Commission (FCC) has issued a strong warning to the telecommunications sector, urging companies to urgently bolster their defenses against a dramatic surge in ransomware attacks. Citing a fourfold increase in such incidents since 2021, the agency's alert highlights the significant risks to national security and public safety. The FCC is recommending a series of best practices, including the adoption of zero-trust architecture, network segmentation, EDR, and enhanced employee training to mitigate the growing threat.

Adidas Investigates Third-Party Data Breach After Lapsus$ Claims 815k Record Theft

Sportswear giant Adidas is investigating a data breach at an independent third-party partner responsible for distributing its martial arts products. The investigation follows a claim made on a hacking forum by a threat actor using the alias 'LAPSUS-GROUP', who alleged the theft of 815,000 records from the Adidas partner extranet. The stolen data reportedly includes user PII and technical data. Adidas stated that its own core IT infrastructure and consumer data are not affected, but the incident highlights the significant risks posed by supply chain security vulnerabilities.

DEF CON Bans Three Prominent Tech Figures Over Links to Jeffrey Epstein

The DEF CON hacking conference has permanently banned three well-known figures from the technology and cybersecurity community: inventor Pablos Holman, cybersecurity executive Vincenzo Iozzo, and former MIT Media Lab director Joichi 'Joi' Ito. The decision follows the release of Department of Justice files and investigative reports detailing their connections and interactions with the late convicted sex offender Jeffrey Epstein. The move reflects an effort by the influential conference to uphold ethical standards and distance the community from the scandal, though it has been met with some criticism.

Asahi Confirms 115k Records Leaked in 2025 Ransomware Attack, Details New Security Measures

Japanese food and beverage giant Asahi Group Holdings has provided a final update on the ransomware attack that crippled its operations in September 2025. The company confirmed the incident resulted in the leak of 115,513 sets of personal data, including information belonging to corporate clients and its own employees. The attack had previously caused severe system glitches, forcing a suspension of production and shipments. In its announcement, Asahi detailed a series of new security enhancements being implemented to prevent future incidents.

Lumifi Inks Deal with Vizient to Strengthen Cybersecurity for US Healthcare Sector

Cybersecurity provider Lumifi has announced a new contract with Vizient, the largest provider-driven healthcare performance improvement company in the United States. The agreement will give Vizient's extensive network of member organizations, including hospitals and healthcare providers, enhanced access and pricing for Lumifi's full suite of security services. The partnership aims to help healthcare organizations combat rising cyber threats like ransomware and address compliance demands and staffing shortages by providing services like 24/7 MDR, SOC-as-a-Service, and incident response.

CISA Adds Four Actively Exploited Flaws in Chrome, Windows, Zimbra to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are being actively abused in the wild. The flaws affect a range of widely used products from Google (Chrome), Microsoft (Windows), Zimbra (Collaboration Suite), and ThreatSonar. By adding these to the KEV catalog, CISA has issued a binding operational directive requiring U.S. federal civilian agencies to apply patches by a specified deadline. All organizations are strongly urged to prioritize these vulnerabilities for immediate remediation.

Metasploit Module Released for Critical RCE Flaw in Grandstream VoIP Phones (CVE-2026-2329)

Researchers at Rapid7 have disclosed a critical, unauthenticated remote code execution (RCE) vulnerability, CVE-2026-2329, affecting Grandstream GXP1600 series VoIP phones. The flaw is a stack-based buffer overflow in the phone's web API, allowing a remote attacker to gain root privileges on devices with default configurations. To demonstrate the severity, Rapid7 has released a Metasploit exploit module and a post-exploitation module for credential theft. Grandstream has issued firmware version 1.0.7.81 to patch the vulnerability. Given the availability of a public exploit, users are urged to update their devices immediately or apply network-level mitigations.

French Government Database Breach Exposes 1.2 Million Bank Accounts via Stolen Credentials

The French Economy Ministry has confirmed a data breach affecting its FICOBA national bank account database. An unauthorized individual gained access to the system using credentials stolen from a government official, exposing the personal and banking information of 1.2 million account holders. The breach, which occurred in late January 2026, exposed names, addresses, bank account numbers, and tax IDs. However, the ministry clarified that the attacker could not view account balances or conduct transactions. The government has blocked the malicious access, filed a criminal complaint, and is in the process of notifying affected individuals.

Betterment Breach Escalates: ShinyHunters Leaks Detailed Financial and Personal Data of 1.4M Customers

The data breach at investment advisor Betterment LLC, first disclosed in January 2026, is now understood to be far more severe. The incident stemmed from a social engineering attack that gave an attacker access to a third-party communications platform. The ShinyHunters ransomware group has since claimed responsibility and published a massive trove of data allegedly belonging to 1.4 million customers after Betterment refused to pay a ransom. Analysis of the leak shows it contains not just contact information but highly sensitive details including employer information, job titles, retirement plan data, and internal company notes, creating a significant risk of sophisticated, targeted fraud for affected individuals.

Cybercrime Goes Corporate: Huntress Report Finds Attackers Industrializing Tactics for Scale and Profit

The Huntress 2026 Cyber Threat Report, released February 18, 2026, details a major shift in the cybercrime landscape towards an industrialized, business-like model. Analyzing data from millions of endpoints, the report finds that threat actors are prioritizing scalable, low-effort attacks that abuse trusted tools and identities over complex zero-days. This 'living off the land' approach maximizes profitability. The report highlights a significant 88% year-over-year increase in attacks targeting the manufacturing sector. It also warns of the growing use of AI in tradecraft, including deepfakes for impersonation and manipulation of AI chat tools to trick employees, lowering the barrier to entry for less skilled attackers.

Attackers Abuse Atlassian Jira Notifications in Large-Scale Phishing Campaign to Bypass Email Filters

A widespread and ongoing phishing campaign is abusing the legitimate notification features of Atlassian's Jira platform to deliver malicious links to government and corporate targets worldwide. By creating tasks or comments in Jira, attackers trigger legitimate notification emails sent from Atlassian's own servers. These emails, bearing valid digital signatures, bypass most email security filters and appear trustworthy to recipients. The 'low and slow' campaign aims to harvest credentials and deliver malware by luring users to click on links within the seemingly benign project updates. The tactic highlights a growing trend of threat actors abusing trusted SaaS platforms to conduct their attacks.

New 'Contagious Interview' and 'CrescentHarvest' Campaigns Target Crypto Wallets and Iranian Dissidents

Two distinct and sophisticated cyber threat campaigns were reported on February 18, 2026. The first, dubbed 'Contagious Interview,' is a financially motivated operation targeting MetaMask browser wallets. It uses injected malicious code to surgically alter transaction data in real-time, redirecting cryptocurrency to attacker-controlled wallets. The second campaign, 'CrescentHarvest,' is attributed to an Iranian threat actor and focuses on cyber-espionage against political dissidents and protestors. This campaign uses phishing to deploy surveillance malware designed to harvest sensitive communications. Both campaigns highlight a trend towards precision-targeted, stealthy attacks for financial gain and political suppression.

Malicious GitHub Fork of 'Triton' macOS App Used to Distribute Windows Malware

A malicious supply chain attack was identified on GitHub on February 17, 2026, targeting users through a deceptive fork of a legitimate open-source application. Attackers cloned 'Triton,' a macOS client for the omg.lol service, and created a malicious repository under the account name 'JaoAureliano.' The repository's README file lured users into downloading a trojanized ZIP file, `Software_3.1.zip`. While the original project is for macOS, the malicious payload was designed to infect Windows systems. This incident highlights the ongoing threat of software supply chain attacks that abuse the trust inherent in the open-source ecosystem.

UC Berkeley to Host Regional Summits to Strengthen Cyber Civil Defense

The UC Berkeley Center for Long-Term Cybersecurity (CLTC) announced on February 17, 2026, that it will host three regional Cyber Civil Defense Summits in 2026. The initiative aims to build collaboration between volunteer cyber defenders, government officials, researchers, and emergency responders to better protect under-resourced community organizations like schools and local critical infrastructure. The summits will be co-hosted with partner states, including New Jersey and Louisiana, and will build on the CLTC's previous work to create replicable models for community-based cyber defense and resilience.

Google Scrambles to Patch First Actively Exploited Chrome Zero-Day of 2026

Google has issued an urgent security update for its Chrome web browser to fix a high-severity zero-day vulnerability, CVE-2026-2441. The flaw, a use-after-free bug in the browser's CSS component, is confirmed to be actively exploited in the wild. Successful exploitation allows a remote attacker to execute arbitrary code simply by tricking a user into visiting a malicious webpage. All users are urged to update their browsers immediately.

Dell Zero-Day Exploited for Two Years by Chinese Spies to Steal Data

Dell has released an emergency patch for a critical, maximum-severity vulnerability (CVE-2026-22769) in its RecoverPoint for Virtual Machines appliance. The flaw, a case of hardcoded credentials, has been actively exploited by a suspected Chinese cyberespionage group (UNC6201) since mid-2024. Attackers leveraged the CVSS 10.0 vulnerability to gain root access, deploy webshells, and install multiple backdoors, including the novel GRIMBOLT malware. The long-term exploitation allowed the threat actor to maintain persistence and conduct lateral movement within victim networks.

‘Zero-Knowledge’ Password Managers Not So Secure, Study Finds

A new study by researchers at ETH Zurich has uncovered significant architectural weaknesses in popular cloud-based password managers, including Bitwarden, LastPass, and Dashlane. The research challenges the "zero-knowledge" encryption promises made by these vendors, demonstrating 27 distinct attack scenarios where a malicious or compromised server could access or alter passwords in a user's encrypted vault. The attacks exploit weaknesses in features like account recovery and data synchronization rather than breaking the underlying cryptography.

CISA KEV Alert: Patch Now for Exploited Flaws in SolarWinds, Microsoft, Notepad++, and Apple

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect a wide range of popular products: SolarWinds Web Help Desk (CVE-2025-40536), Microsoft Configuration Manager (CVE-2024-43468), Notepad++ (CVE-2025-15556), and multiple Apple operating systems (CVE-2026-20700). Federal agencies are now under a binding directive to patch these vulnerabilities by their respective deadlines.

New ClickFix Attack Abuses DNS 'nslookup' for Stealthy Malware Delivery

Microsoft Threat Intelligence has uncovered a new variant of the 'ClickFix' social engineering attack that uses DNS queries as a covert channel for malware delivery. Victims are tricked into running an 'nslookup' command that queries an attacker-controlled DNS server. The malware payload, a PowerShell script, is embedded in the DNS response, allowing it to bypass some web-based security filters. The attack chain ultimately deploys the ModeloRAT remote access trojan.

Microsoft 365 Admin Center Outage in North America Investigated as Security Event

A significant service disruption on February 10, 2026, that prevented IT administrators across North America from accessing the Microsoft 365 admin center, is reportedly being investigated as a security event. The outage, which also affected the M365 mobile app, blocked administrators from performing critical user management and security tasks, raising concerns about the incident's root cause and whether it was the result of malicious activity.

New 'Keenadu' Android Backdoor Injects into Core Zygote Process, Links Major Botnets

Kaspersky researchers have discovered a highly sophisticated Android backdoor named "Keenadu." The malware is being distributed through two alarming vectors: pre-installed in device firmware via supply chain compromise, and through malicious apps on the Google Play Store. Keenadu's primary malicious action is to inject itself into the Android Zygote process, the parent of all applications, giving it pervasive access and control. The investigation also exposed operational links between Keenadu and the notorious Triada and BADBOX malware families.

Panasonic Launches World-First Cybersecurity Monitoring Trial for Grid-Scale Battery Storage Systems

Panasonic Holdings Corporation has announced the start of what it calls the world's first cybersecurity monitoring trial for grid-scale Battery Energy Storage Systems (BESS). This pioneering initiative aims to develop and validate a system for detecting intrusions and unauthorized commands within the BESS's internal operational technology (OT) network, moving beyond conventional perimeter defenses to secure critical energy infrastructure.

Fake 7-Zip Website Tricks Users, Turns PCs into Malicious Proxy Nodes

A malicious campaign is leveraging a lookalike domain, 7zip[.]com, to distribute a trojanized installer for the popular 7-Zip file archiving utility. The installer, signed with a now-revoked digital certificate, provides a functional version of 7-Zip to avoid suspicion, but also silently installs proxyware. This malware turns the victim's computer into a residential proxy node, allowing threat actors to route their traffic through the victim's IP address for nefarious activities.

New 'AI-in-the-Middle' Attack Turns Microsoft Copilot and Grok into C2 Channels

Security researchers have detailed a novel command-and-control (C2) technique dubbed "AI-in-the-Middle." This method allows malware on a compromised system to use legitimate, web-connected enterprise AI assistants, such as Microsoft Copilot, as a proxy to relay commands. The technique effectively hides malicious C2 traffic within the seemingly benign and trusted communications to AI platforms, posing a significant detection challenge for network security tools.

"Shadow Persistence" Rootkit Targets Cisco Edge Devices, Survives Factory Resets

A sophisticated espionage campaign is actively targeting critical infrastructure and government agencies by exploiting a new vulnerability in Cisco's IOS XE software. Attackers are using the flaw to install a powerful firmware rootkit, dubbed "Shadow Persistence," on network edge routers. This rootkit is exceptionally dangerous because it is installed directly into the device's firmware, allowing it to survive reboots and even factory resets, making it nearly impossible to remove through standard procedures.

BeyondTrust Patches Critical 9.9 CVSS RCE Zero-Day in Remote Access Tools

BeyondTrust has patched a critical zero-day vulnerability, CVE-2026-1731, affecting its self-hosted Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw is a pre-authentication remote code execution (RCE) vulnerability with a CVSS score of 9.9, indicating extreme severity. It allows an unauthenticated attacker to execute arbitrary OS commands on a vulnerable appliance by sending a specially crafted network request, requiring no user interaction. This could lead to a full server compromise. The vulnerability affects RS versions 25.3.1 and earlier, and PRA versions 24.3.4 and earlier. BeyondTrust has already secured its cloud instances, but is urging all on-premise customers to upgrade to the patched versions immediately. The flaw was discovered and responsibly disclosed by a security researcher.

Nation-State Hackers from China, Russia, and Iran Weaponize Google's Gemini AI for Attacks

A new report from Google's Threat Intelligence Group (GTIG) confirms that state-sponsored hacking groups from China, Iran, North Korea, and Russia are systematically using large language models (LLMs), including Google's own Gemini, to augment their cyber operations. These advanced persistent threat (APT) groups are leveraging AI for the entire attack lifecycle, from initial open-source intelligence gathering and target reconnaissance to crafting sophisticated phishing emails and developing malware. The report highlights a strategic shift where adversaries use AI to increase the speed, scale, and effectiveness of their campaigns, posing a new challenge for defenders.

CISA Issues Emergency Directive for 'IronBite' SCADA Zero-Day Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive for a critical zero-day vulnerability, CVE-2026-31501, dubbed 'IronBite'. This remote code execution (RCE) flaw in Avarium's OmniLogic SCADA platform scores a perfect 10.0 on the CVSS scale and is believed to be under active exploitation by state-sponsored actors targeting the energy sector. The vulnerability affects versions 4.x through 5.7.2 and can be triggered by a single network packet, requiring no authentication or user interaction. CISA has mandated immediate disconnection of affected systems from external networks for all federal agencies, highlighting the severe risk to critical infrastructure in North America and Europe.

ChronoLocker Ransomware Cripples AmeriCargo, Freezing US Supply Chains

The 'ChronoLocker' ransomware gang has launched a crippling attack against AmeriCargo, a major North American logistics firm, forcing a halt to its operations. The attack, which began on February 15, 2026, has encrypted critical systems managing port operations and freight tracking, leading to widespread supply chain disruptions across the United States. The threat actors claim to have exfiltrated 2 terabytes of sensitive data, including client contracts and financial information, and are demanding a $30 million ransom. This incident highlights the escalating trend of ransomware groups targeting critical infrastructure to maximize pressure and financial gain.

New APT 'Silent Geese' Deploys 'PoliGraph' Backdoor in Espionage Campaign Against NATO

A newly identified state-sponsored threat actor, named 'Silent Geese,' is conducting a highly targeted cyber-espionage campaign against diplomatic personnel in multiple NATO member states. According to research from SecuraIntel, the advanced persistent threat (APT) group uses convincing spear-phishing emails related to a fake security summit to lure victims. The emails contain a malicious PDF that exploits a vulnerability to install 'PoliGraph,' a novel and stealthy backdoor. This malware is designed for long-term intelligence gathering, capable of exfiltrating documents, capturing keystrokes, and recording audio, posing a significant threat to international security.

PaySphere FinTech App Breach Exposes Data and Transaction Histories of 4 Million Users

The popular FinTech payment app, PaySphere, has disclosed a major data breach affecting approximately 4 million users. The company announced that an unauthorized party gained access to a production database for over two weeks, from January 28 to February 12, 2026. The compromised data includes full names, email addresses, phone numbers, and detailed transaction histories. The breach was traced back to a compromised employee account that was phished, allowing attackers to bypass multi-factor authentication. While financial details like bank accounts were reportedly not accessed, the exposure of transaction data poses significant privacy and security risks to users.

CopperSteal Infostealer Evolves to Target AWS, Azure, and Google Cloud Credentials

A new variant of the 'CopperSteal' information-stealing malware has emerged with a dangerous new focus: enterprise cloud environments. According to analysis by ThreatFabric, the updated malware now includes specific modules designed to hunt for and exfiltrate credentials, access keys, and session cookies from AWS, Microsoft Azure, and Google Cloud. The malware is typically delivered through trojanized software masquerading as developer tools. This evolution marks a significant threat escalation, as stolen cloud credentials can be sold on underground forums and used to facilitate more severe attacks like ransomware deployment, corporate espionage, and data breaches.

Telehealth Provider HealthPath Exposes 700,000 Patient Medical Files in S3 Bucket Leak

Telehealth provider HealthPath has suffered a massive data exposure due to a misconfigured Amazon S3 bucket. A security researcher discovered the cloud storage bucket was left publicly accessible, exposing over 700,000 sensitive documents, including medical scans, test results, and patient identification forms. The data belongs to an estimated 150,000 patients and contained extensive personally identifiable information (PII) and protected health information (PHI). HealthPath attributed the exposure to 'human error' during a system update on January 20, 2026. The company now faces a major regulatory investigation under HIPAA for failing to secure patient data.

Patch Now: Critical RCE Flaw (CVE-2026-31845) in ZenithJS Framework Threatens Web Apps

The maintainers of ZenithJS, a popular JavaScript web framework, have released an emergency patch for a critical remote code execution (RCE) vulnerability, CVE-2026-31845. The flaw, rated 9.8 on the CVSS scale, exists in the framework's data serialization library and allows an unauthenticated attacker to execute arbitrary code on a server by sending a crafted HTTP request. The vulnerability is due to unsafe deserialization of user input. All applications built with ZenithJS versions 3.0.0 through 3.4.0 are affected. Given the framework's widespread use, developers are urged to upgrade to the patched version 3.4.1 immediately to prevent potential widespread exploitation.

Supply Chain Attack: Malicious 'PyUtils-Core' Library on PyPI Steals Developer Secrets

A software supply chain attack has compromised 'PyUtils-Core,' a popular Python library on the Python Package Index (PyPI) with millions of monthly downloads. The PyPI security team removed versions 1.8.7 and 1.8.8 after discovering they contained malicious code designed to steal developer secrets. The code, injected after the library maintainer's account was compromised, scans for and exfiltrates environment variables, including API keys, authentication tokens, and other secrets commonly found in developer environments and CI/CD pipelines. All users who downloaded the affected versions are urged to rotate their credentials immediately.

Social Media Giant ConnectSphere Hit with Landmark €800M GDPR Fine for Data Breaches

In a landmark ruling, European Union regulators have fined the social media platform ConnectSphere €800 million for significant and repeated violations of the General Data Protection Regulation (GDPR). The fine, issued by Ireland's Data Protection Commission (DPC), stems from a lengthy investigation into the company's data security practices between 2023 and 2025. The DPC found that ConnectSphere failed to implement appropriate technical measures to protect user data, citing inadequate access controls and weak password hashing, which directly contributed to multiple large-scale data breaches. ConnectSphere has been ordered to overhaul its security architecture and intends to appeal the decision.

'Crimson Wyvern' APT Steals Cancer Research Data in Global Espionage Campaign

A state-sponsored APT group tracked as 'Crimson Wyvern' is orchestrating a widespread cyber-espionage campaign against leading cancer research facilities and pharmaceutical companies. According to a new report from Mandiant, the attacks have targeted organizations in the U.S., U.K., and Japan with the goal of stealing valuable intellectual property, particularly data on novel drug therapies and clinical trials. The threat actors gain initial access by exploiting VPN vulnerabilities and then deploy a custom backdoor, 'SerpentShell,' to maintain long-term access and exfiltrate sensitive research data. The campaign poses a serious threat to public health innovation and commercial competitiveness.

NorthGrid Power Report Reveals IT-OT Segmentation Failure Led to Blackout Attack

NorthGrid Power, a major U.S. utility, has published a detailed post-incident report on the December 2025 cyberattack that resulted in localized power outages. The report attributes the attack to a sophisticated threat actor and provides a transparent look at the attack chain. The intrusion began with a spear-phishing email to an IT employee and escalated as attackers moved laterally from the corporate IT network to the sensitive operational technology (OT) network. This was possible due to a misconfigured firewall rule. Once in the OT network, the attackers used custom malware to manipulate circuit breakers, causing the outages. The report serves as a critical case study on the dangers of IT-OT convergence and segmentation failures.

Actively Exploited 'GhostTouch' Zero-Day in Androis Allows Silent Malware Installation

Google's Project Zero has disclosed a critical zero-day vulnerability, 'GhostTouch' (CVE-2026-31999), affecting billions of Androis devices. The flaw, present in Androis versions 14, 15, and the beta of 16, allows an attacker to silently install malicious applications on a victim's device without any user interaction. The attack is triggered simply by the user visiting a malicious webpage. Project Zero has confirmed the vulnerability is being actively exploited in the wild in targeted attacks, likely to install sophisticated spyware. While Google has released a patch, the fragmented Androis ecosystem means most users will remain vulnerable for weeks or months.

OpenClaw Founder Peter Steinberger Joins OpenAI Amidst Project's Security Turmoil

Peter Steinberger, the creator of the popular but embattled OpenClaw open-source AI framework, has announced he is joining OpenAI. The move, confirmed by OpenAI CEO Sam Altman, will see Steinberger focus on building the "next generation of personal agents." This decision comes during a turbulent period for OpenClaw, which is grappling with a critical RCE vulnerability and a marketplace flooded with malicious packages. Steinberger stated his goal is to build a safe, accessible AI agent for a broad audience, suggesting a pivot away from the complexities of maintaining a large open-source project.

Python 'cryptography' Library Flaw (CVE-2026-26007) Leaks Private Key Information

A significant vulnerability, CVE-2026-26007, has been disclosed in the widely-used Python 'cryptography' package. The flaw, which affects versions prior to 46.0.5, is due to improper input validation on public keys. An attacker can supply a specially crafted weak public key, causing cryptographic operations like ECDH to leak bits of the victim's private key. This also weakens signature forging defenses. Users are urged to update to the patched version immediately.

Critical 9.8 CVSS Unauthenticated Privilege Escalation Flaw Hits WordPress Plugin

A critical unauthenticated privilege escalation vulnerability, CVE-2025-14892, has been disclosed in the Prime Listing Manager WordPress plugin. The flaw, affecting versions up to and including 1.1, has been assigned a CVSS score of 9.8, reflecting its extreme severity. It allows any remote, unauthenticated attacker to elevate their privileges on an affected website, potentially leading to a full site compromise. Administrators are urged to deactivate the plugin immediately or apply WAF rules as no patch is currently available.

Google and Entrust Form Strategic Partnership for AI-Driven Identity Security

Global security provider Entrust and tech giant Google have announced a strategic collaboration to integrate their technologies for AI-driven identity verification. The partnership aims to develop advanced solutions to combat the growing threat of sophisticated, AI-powered fraud. By combining their expertise, the companies intend to strengthen security defenses while streamlining user and employee onboarding processes, reflecting a broader industry trend of using AI to bolster cybersecurity.

Google Attributes New 'CANFAIL' Malware Attacks in Ukraine to Russian State Actor

Google's Threat Intelligence group has attributed a new malware campaign targeting Ukrainian organizations to a suspected Russian nation-state actor. The report, published on February 15, 2026, details the use of a new malware framework dubbed 'CANFAIL'. This discovery, along with other novel malware like 'VoidLink', highlights the continuous development of custom tools for cyber warfare in the region. Security analysts stress the need for behavior-based detection methods to counter these rapidly evolving threats, particularly in high-value sectors like defense and energy.

Fedora Project Patches Vulnerabilities in Python-aiohttp Component for Fedora 43

The Fedora Project released an important security advisory on February 14, 2026, for its Fedora 43 distribution. The advisory, 2026-66cb8ecfc2, addresses vulnerabilities in the 'python-aiohttp' package, a key component for asynchronous HTTP clients and servers in Python. An updated version, 3.13.3-4.fc43, has been released to mitigate the unspecified security issues. Administrators of Fedora 43 systems are urged to apply the update promptly to protect their systems.

Firms Face 2026 Compliance Countdown for RBI and SAMA Cybersecurity Mandates

Cybersecurity firm Foresiet has published a strategic analysis for financial institutions navigating the upcoming 2026 compliance deadlines for external threat mandates from the Reserve Bank of India (RBI) and the Saudi Central Bank (SAMA). The guide addresses the specific regulatory frameworks and offers a roadmap for banks and financial firms in India and Saudi Arabia to enhance their security posture against external threats. This reflects a global trend of financial regulators imposing stricter cybersecurity rules to protect national financial sectors.

Blast Audit and SafePorter Formalize Researcher Relations with New VDPs

On February 15, 2026, cybersecurity firms Blast Audit and SafePorter each published new Vulnerability Disclosure Policies (VDPs). These policies provide a formal framework, including legal safe harbor, for security researchers to responsibly report vulnerabilities they discover in the companies' systems. Both policies outline the scope of testing, reporting procedures, and expected response times, reflecting a growing industry best practice for fostering positive relationships with the independent security research community.

Open-Source Malware Skyrockets by 75%, Sonatype's 2026 Report Warns

Sonatype's 2026 'State of the Software Supply Chain' report reveals an alarming 75% increase in malicious open-source packages, with over 1.233 million identified. The report connects this surge to the rapid adoption of AI and automation in software development, which has accelerated open-source consumption to 9.8 trillion downloads across major registries. This increased velocity expands the attack surface, making it easier for attackers to inject malware into the software supply chain. The report also notes that 86% of traffic from Maven Central, a key Java repository, now comes from automated cloud services, amplifying the risk of widespread compromise from a single malicious package.

Germany Prepares Legislation to Authorize Offensive Cyber Operations in Major Policy Shift

The German government is reportedly drafting legislation to formally authorize its intelligence agencies and military to conduct offensive cyber operations. This significant policy shift would move Germany from its traditionally defensive posture to one that includes 'hack-back' capabilities, aligning its cyber warfare doctrine more closely with allies like the United States and the UK. The proposed laws aim to counter hybrid threats and establish a zero-tolerance policy for attacks on the nation's critical infrastructure, signaling a more assertive stance in cyberspace.

'Crazy' Ransomware Gang Abuses Legitimate Employee Monitoring Software for Stealthy Persistence

The 'Crazy' ransomware gang has been observed using a new 'living off the land' tactic, abusing legitimate commercial software to maintain stealthy and persistent access to victim networks. Researchers report the group deployed 'Net Monitor for Employees Professional' and the 'SimpleHelp' remote support tool to blend their malicious activity with normal administrative traffic. This method allowed the attackers to remain undetected for extended periods while disabling security tools and preparing for the final ransomware deployment, highlighting a growing trend of abusing trusted applications to evade detection.

Google Details Coordinated Cyber Espionage Campaigns Against Global Defense Industrial Base

A comprehensive report from Google's Threat Intelligence Group (GTIG) details a multi-pronged assault on the global Defense Industrial Base (DIB) by state-sponsored actors from China, Iran, North Korea, and Russia. The campaigns use diverse tactics, including targeting battlefield technology in Ukraine, exploiting the hiring process with 'Operation Dream Job' style campaigns, and compromising edge devices for initial access. The report names specific APT groups like Russia's Sandworm (APT44), North Korea's Lazarus Group (UNC2970), and China's Volt Typhoon (UNC3236), and details their use of custom malware to evade EDR and steal sensitive data.

BridgePay Payment Gateway Hit by Ransomware, Causing Nationwide Outages

The U.S. payments platform BridgePay Network Solutions has confirmed it suffered a ransomware attack that initiated a "system-wide service disruption" on February 6, 2026. The attack has crippled the company's ability to process payments, causing significant downstream impact on its clients, which include retailers, restaurants, and municipal governments across the country. Many merchants have been forced to switch to cash-only operations. BridgePay has engaged cybersecurity experts and is collaborating with the FBI and the U.S. Secret Service. While the company stated that an initial forensic investigation shows no evidence that usable payment card data was compromised, it warned that the restoration process could be lengthy. The identity of the ransomware group responsible for the attack has not yet been disclosed.

Ransomware Attacks Skyrocket 58% in 2025, Setting New Records

Multiple cybersecurity reports released in January 2026 confirm that 2025 was the most active year for ransomware on record. A report from GuidePoint Security's GRIT team documented a staggering 58% year-over-year increase in publicly claimed ransomware victims. December 2025 alone saw 814 attacks, the highest monthly total ever recorded. Despite law enforcement takedowns of major players like LockBit, the ransomware ecosystem proved resilient. Affiliates quickly migrated to other operations, with the Qilin and Akira ransomware groups emerging as the dominant forces, collectively responsible for a significant portion of all attacks. The United States remained the primary target, and the manufacturing sector was the most heavily impacted industry.

Substack Discloses Data Breach Exposing User Contact Information

The newsletter platform Substack has announced it suffered a data breach after discovering on February 3, 2026, that an unauthorized party had gained access to a database containing user information. The exposed data includes names, email addresses, phone numbers, and Stripe IDs, though the company stated that financial data like credit card numbers and passwords were not compromised. The data exposure may date back to October 2025. With over 20 million active users, Substack is warning customers to be wary of suspicious emails and text messages, as a hacker has claimed to have stolen data from 700,000 users and posted it on the dark web.

Microsoft Scrambles to Fix Six Actively Exploited Zero-Days in February 2026 Patch Tuesday

Microsoft's February 2026 Patch Tuesday release is a critical one, addressing 58 vulnerabilities across its product ecosystem. Most alarmingly, the update includes patches for six zero-day vulnerabilities that were already being actively exploited by attackers in the wild. Three of these flaws were publicly disclosed before a fix was available, escalating the urgency for administrators to deploy these updates. The zero-days include severe security feature bypasses in Windows Shell (CVE-2026-21510) and the MSHTML engine (CVE-2026-21513), both rated with a CVSS of 8.8, which could allow for silent code execution. Additionally, three elevation of privilege (EoP) flaws in Desktop Window Manager (CVE-2026-21519) and Remote Desktop Services (CVE-2026-21533) grant attackers SYSTEM-level access. The sheer number of in-the-wild exploits makes this one of the most critical patch cycles in recent memory, requiring immediate action from all organizations to prevent compromise.

Dutch Telecom Odido Suffers Massive Data Breach; 6 Million Customers Potentially Exposed

Dutch telecommunications provider Odido announced a major data breach on February 11, 2026, after a third-party supplier's system was compromised. The incident may have exposed the personal information of as many as six million customers. The compromised data reportedly includes sensitive details such as names, addresses, phone numbers, and in some cases, bank account and passport numbers. While Odido's core network was not affected, the breach originated from a supplier managing a customer data environment, highlighting significant third-party risk. The company has launched a full investigation and is notifying affected individuals and regulatory authorities under GDPR, with significant fines and legal action expected.

CISA Warns Energy Sector of Destructive ICS/OT Attacks After Poland Grid Hit

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert to U.S. energy sector operators, urging them to bolster their defenses against destructive cyberattacks. The warning on February 12, 2026, follows a sophisticated attack in late 2025 that targeted energy facilities in Poland. In that incident, threat actors leveraged insecure internet-facing devices to gain initial access and deploy destructive malware that damaged remote terminal units (RTUs) and wiped data from human-machine interface (HMI) controls. CISA's advisory underscores the severe vulnerability of operational technology (OT) and industrial control systems (ICS) that form the backbone of critical infrastructure, calling for immediate action to prevent similar devastating attacks.

Google Scrambles to Patch Two Actively Exploited Chrome Zero-Days Under Active Attack

Google has released an emergency security update for its Chrome web browser to address two high-severity zero-day vulnerabilities, CVE-2026-3909 and CVE-2026-3910, that are confirmed to be actively exploited in the wild. The first flaw is an out-of-bounds write in the Skia 2D graphics library, while the second is an inappropriate implementation in the V8 JavaScript engine, both of which could allow a remote attacker to execute arbitrary code. With a CVSS score of 8.8 each, these vulnerabilities pose a significant risk to users. Google urges immediate updates to Chrome version 146.0.7680.75/76 for Windows/macOS and 146.0.7680.75 for Linux. Users of other Chromium-based browsers are also advised to apply patches as they become available.

Nation-States Pre-positioning in Critical Infrastructure for Future Cyber Warfare

Geopolitical tensions are fueling a new and dangerous phase of nation-state cyber activity, with a strategic shift towards pre-positioning within critical infrastructure for future disruptive operations. According to recent intelligence reports, Advanced Persistent Threat (APT) groups, such as the Iran-linked APT33 and APT34, are moving beyond espionage and financially motivated attacks. Instead, they are embedding themselves silently within global energy, healthcare, and telecommunications systems. Experts warn this long-term stealth access is designed to enable future attacks that could cause communications outages and supply chain shocks, making nation-state cyber warfare an existential business risk for organizations worldwide.

Software Supply Chain Attacks on the Rise, Exploiting Trusted Vendor Relationships

Software supply chain attacks have emerged as a dominant and highly effective threat vector, with cybercriminals increasingly targeting third-party vendors, open-source libraries, and software update mechanisms to compromise thousands of organizations at once. By injecting malicious code into legitimate software, attackers bypass traditional perimeter defenses and exploit the inherent trust between an organization and its suppliers. The infamous SolarWinds attack, which distributed a backdoored update to government agencies and major corporations, exemplifies the massive scale and impact of this threat. As modern software development increasingly relies on third-party components, the attack surface has expanded dramatically, making supply chain security a critical priority for businesses globally.

White House Unveils New "Cyber Strategy for America" with Offensive Focus

The White House announced its new "Cyber Strategy for America" on February 12, 2026, signaling a significant evolution from its 2023 predecessor. The new strategy marks a decisive shift towards a more proactive and offensive posture, aiming to disrupt foreign adversaries and cybercriminal networks before they can launch attacks against U.S. interests. Key pillars of the strategy include leveraging the full suite of government cyber capabilities, working with the private sector to dismantle threat actor infrastructure, and a push to streamline cybersecurity regulations to reduce compliance burdens on businesses. The policy also emphasizes modernizing federal networks with zero-trust architecture and AI-powered defenses.

FBI: Ransomware Attacks on Healthcare and Critical Infrastructure are Surging

Ransomware attacks continue to plague U.S. critical infrastructure, with a recent FBI report indicating a significant surge in incidents. At least 14 of the 16 critical infrastructure sectors have reported attacks, with healthcare and manufacturing being the most frequent targets. The FBI warns that these attacks are not just financial crimes but pose a direct threat to public safety and national security. In the healthcare sector, ransomware-induced downtime can delay treatments and divert emergency services, with life-threatening consequences. The 2021 attack on Colonial Pipeline serves as a stark reminder of the cascading societal impact, highlighting why ransomware remains a top-tier national security threat.

CISA Issues Flurry of ICS Advisories for Energy and Water System Vulnerabilities

On February 12, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published a significant batch of ten new Industrial Control Systems (ICS) advisories, detailing vulnerabilities in products used across multiple critical infrastructure sectors, particularly energy and water systems. The advisories cover a range of products from prominent vendors including Hitachi Energy, Schneider Electric, Mitsubishi Electric, and TP-Link. These alerts provide technical details on the flaws and recommended mitigations, urging asset owners to apply updates promptly to protect their ICS and SCADA environments from potential exploitation.

EU's Stricter NIS2 Cybersecurity Directive Now in Full Effect

The deadline for European Union member states to transpose the Network and Information Security 2 (NIS2) Directive into their national laws passed on February 12, 2026, ushering in a new, stricter era of cybersecurity regulation across the bloc. NIS2 significantly expands the scope of the original NIS directive, applying to a wider range of 'essential' and 'important' entities. It imposes more rigorous cybersecurity risk management measures, incident reporting obligations with tighter deadlines, and higher penalties for non-compliance. The directive aims to harmonize and elevate the overall level of cyber resilience for critical infrastructure sectors like energy, transport, healthcare, and digital services.

Cloud Breaches Skyrocket, Now Costing Firms an Average of $5.1 Million

Recent reports analyzing the 2025-2026 threat landscape reveal a significant and sustained increase in attacks against cloud infrastructure. Cloud-targeted attacks rose 21% year-over-year, with 81% of organizations experiencing at least one cloud security incident. The primary causes are not sophisticated exploits but fundamental security lapses: credential compromise was the top attack vector, followed closely by cloud misconfigurations and insecure APIs. The financial consequences are severe, with the average cost of a cloud data breach climbing to an estimated $5.1 million in 2026, highlighting an urgent need for improved cloud security posture management.

'SilentVoice' Phishing Campaign Weaponizes AI Deepfake Audio to Bypass MFA

A sophisticated social engineering campaign named 'SilentVoice' is successfully bypassing multi-factor authentication (MFA) by using AI-generated deepfake audio of corporate executives. According to researchers at Proofpoint, attackers clone an executive's voice from public audio samples and then use it in a vishing (voice phishing) call to a subordinate employee. The deepfake voice creates a sense of urgency, tricking the employee into entering their credentials on a fake site and then approving the subsequent MFA push notification sent to their device. This highly convincing technique circumvents the protection offered by many common MFA methods, leading to full account takeover. The campaign has already resulted in successful breaches and financial fraud, highlighting the emerging threat of AI-weaponized social engineering.

Automotive Cyber Risk Escalates to Enterprise-Wide Challenge, VicOne Report Warns

A new report from automotive cybersecurity firm VicOne, released on February 11, 2026, warns that cyber threats in the automotive industry have evolved from isolated technical issues into enterprise-wide risks. Titled "Crossroads: Automotive Cybersecurity in the Overlap Era," the report finds that cross-organizational cyber incidents tripled in 2025. This trend is driven by the centralization of software platforms and over-the-air (OTA) update infrastructures, which magnify the impact of a single security failure. The report also highlights the "Overlap Era," where legacy vehicle systems, software-defined vehicles, and AI create a complex, interconnected risk landscape. VicOne also points to a significant blind spot in vulnerability management, having discovered 174 zero-day vulnerabilities in connected vehicles and EV chargers that are not tracked in the public CVE system.

SitusAMC Nears Completion of Data Breach Investigation from November 2025 Incident

SitusAMC, a key technology and services provider for the real estate finance industry, announced on February 12, 2026, that it is finalizing its investigation into a data breach first detected in November 2025. The company stated that notifications to affected consumers will be sent out in the coming weeks. The breach, which did not involve ransomware, compromised corporate data and potentially the personal and financial information of its clients' customers, which include major financial institutions. The incident highlights the significant supply chain risk in the financial sector, as a breach at a single vendor can have cascading effects on numerous banks and their customers. SitusAMC has confirmed the threat actor has been removed from its systems.

Arizona Urology Practice Breach Exposes PHI of Over 73,000 Patients

Academic Urology & Urogynecology of Arizona (AUUA) has begun notifying 73,281 individuals that their personal and protected health information (PHI) was compromised in a data breach that occurred in May 2025. The notification letters, sent starting February 12, 2026, come after a lengthy investigation determined that an unauthorized party had accessed the network between May 18 and May 22, 2025. The exposed data is highly sensitive and includes names, Social Security numbers, financial account information, and detailed medical information such as diagnoses, treatments, and prescriptions. While AUUA has no evidence of fraud resulting from the incident, it is offering complimentary credit monitoring to affected individuals.

Turkish Retailer Civil Mağazacılık Breach Exposes Data of 4.5 Million

Civil Mağazacılık, a major Turkish retailer specializing in baby and children's products, has reported a significant data breach estimated to affect 4.5 million individuals. According to a notification filed with Turkey's Personal Data Protection Authority (KVKK), the breach began on February 12, 2026, but was not detected until February 28. Attackers gained access to a Windows Server hosting the company's CRM database using an administrator account and exfiltrated the contents. The compromised data includes sensitive personal information such as full names, Turkish ID numbers (T.C. kimlik no), phone numbers, and email addresses. The KVKK has launched an investigation into the incident.

Higher Education Software Provider Nuventive Achieves SOC 2 Type II Compliance

Nuventive, a software company that provides data and improvement platforms for the higher education sector, announced on February 11, 2026, that it has successfully completed its System and Organization Controls (SOC) 2 Type II compliance audit. This certification, validated by the independent auditing firm A-LIGN, affirms that Nuventive's security practices, policies, and infrastructure meet the stringent trust services criteria set by the American Institute of Certified Public Accountants (AICPA). The achievement demonstrates the company's commitment to data security and provides assurance to its higher education clients that their sensitive institutional and student data is being managed securely.

Europe's Largest University, La Sapienza, Crippled by Ransomware Attack

La Sapienza University in Rome, Europe's largest university, continues to reel from a major cyberattack that began in early February 2026. The attack forced a precautionary shutdown of most of its IT systems, causing widespread disruption for its 112,500 students and staff. As of February 11, many digital services, including the main website, remained offline. While the university has not officially confirmed the details, reports attribute the incident to a pro-Russian threat actor group named Femwar02, using a strain of Bablock/Rorschach ransomware. A ransom note was reportedly found, but the university has avoided engagement. The incident highlights the growing trend of ransomware attacks targeting the academic sector.

Sandworm Deploys New 'DynoWiper' Malware in Failed Attack on Polish Power Grid

The Russian state-sponsored hacking group Sandworm has been attributed with a major, albeit unsuccessful, cyberattack against Poland's power system in late December 2025. Poland's energy minister described it as the 'largest cyber attack' on their energy infrastructure in years. Cybersecurity firm ESET linked the attack to Sandworm and discovered the use of a previously undocumented destructive malware, which has been named 'DynoWiper'. This incident underscores Sandworm's continued focus on targeting critical infrastructure with new cyber weapons.

FCC Warns Telecoms of 4x Increase in Ransomware, Urges Better Security

The U.S. Federal Communications Commission (FCC) has issued a formal alert to the telecommunications industry regarding the escalating threat of ransomware. Citing data that shows a fourfold increase in attacks on the sector between 2022 and 2025, the FCC's Public Safety and Homeland Security Bureau is urging providers to adopt fundamental cybersecurity best practices. The warning emphasizes that vulnerable communications networks pose a significant risk to national security and public safety, and calls for actions like patching, MFA, and network segmentation.

CISA, NSA, and Canada Warn of New BRICKSTORM Malware Variant Used by Chinese Hackers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and the Canadian Centre for Cyber Security (Cyber Centre) have jointly released an updated Malware Analysis Report (MAR) for the BRICKSTORM backdoor. This new advisory, published February 11, 2026, details a new variant of the malware discovered during an incident response engagement. The investigation revealed that state-sponsored actors from the People's Republic of China (PRC) deployed BRICKSTORM on a VMware vCenter server to maintain long-term persistence within a victim network, having first gained access in April 2024. The agencies have released new YARA and Sigma rules to help organizations hunt for this threat and are urging government and critical infrastructure entities to immediately search their networks for signs of compromise.

Tax Season Phishing Frenzy: Microsoft Details Campaigns Abusing ScreenConnect and QR Codes

Microsoft has uncovered several large-scale, sophisticated phishing campaigns exploiting the U.S. tax season. In a report on February 10, 2026, the company detailed one massive campaign targeting over 29,000 users that aimed to install the legitimate remote access tool ScreenConnect for malicious use. This campaign broadly targeted organizations in financial services, technology, and retail. Another concurrent campaign used QR codes embedded in Word documents with 'W-2' themes to redirect victims to a credential harvesting site running the 'SneakyLog' phishing kit. A third attack wave leveraged lures impersonating CPAs to deliver the 'Energy365' Phishing-as-a-Service (PhaaS) kit. These multi-faceted campaigns demonstrate attackers' increasing sophistication in social engineering and their abuse of legitimate tools to bypass security.

Healthcare Provider's Ransomware Attack Traced to Compromised SonicWall Cloud Backups

Marquis Health Services, a major provider of skilled nursing care, has reported a disruptive ransomware attack that it attributes to a compromise of its SonicWall cloud backup systems. The incident, reported on February 10, 2026, allowed attackers to encrypt critical data, causing operational issues across its healthcare facilities. By targeting the backup system directly, the threat actors not only deployed ransomware but also aimed to sabotage the company's ability to recover, a tactic known as double extortion. This attack serves as a critical reminder of the security risks inherent in the third-party supply chain and the need to secure backup and recovery environments with the same rigor as primary production systems.

Undetected Go-Based Malware Emerge: GREENBLOOD Ransomware and Moonrise RAT

Security researchers have identified two new and dangerous malware families written in the Go programming language. The discoveries, reported on February 11, 2026, include a ransomware variant named GREENBLOOD and a remote access trojan (RAT) called Moonrise RAT. GREENBLOOD is designed for high-speed encryption and evidence removal, maximizing damage before detection. More alarmingly, the Moonrise RAT was found to be fully-featured, with extensive credential theft capabilities, and had zero detections on VirusTotal at the time of its analysis. The emergence of these potent Go-based threats highlights a trend of attackers using less common languages to develop malware that evades traditional signature-based antivirus and security tools, posing a significant challenge for defenders.

EU Greenlights Google's $32 Billion Acquisition of Cybersecurity Firm Wiz

The European Commission has granted unconditional antitrust approval for Google's proposed $32 billion acquisition of cybersecurity firm Wiz. The decision, announced on February 10, 2026, allows Google to move forward with its largest-ever deal, significantly bolstering its cloud security portfolio. EU regulators concluded that the acquisition would not harm competition in the cloud infrastructure market. They reasoned that Google remains a smaller player compared to Amazon and Microsoft, and customers will continue to have credible alternative security solutions and the ability to switch cloud providers. This approval from a major regulatory body signals a significant consolidation in the cybersecurity industry as cloud hyperscalers aim to deeply integrate security into their platforms.

Critical BeyondTrust Flaw Actively Exploited in Ransomware Attacks

A critical vulnerability in BeyondTrust's remote access solutions is being actively exploited by threat actors, with security firm Darktrace reporting anomalous activity linked to the flaw starting on February 10, 2026. Attackers are leveraging the vulnerability to gain unauthorized control of systems, which then serves as an entry point for follow-on attacks, including ransomware intrusions. Observed malicious activity includes compromised devices making suspicious outbound connections to Out-of-Band Application Security Testing (OAST) services, a technique used to validate successful exploitation. The active exploitation has prompted urgent calls for all BeyondTrust customers to apply patches immediately and hunt for signs of compromise within their networks.

Supply Chain Attacks Now a Dominant 'Ecosystem' of Crime, Warns Group-IB

A new report from cybersecurity firm Group-IB warns that supply chain attacks have evolved from being a specific attack type into a dominant 'ecosystem' of interconnected criminal activity. The 'High-Tech Crime Trends Report,' released on February 11, 2026, states that attackers are increasingly targeting upstream software vendors and managed service providers (MSPs) to compromise thousands of downstream victims in a single stroke. According to the report, 68% of major global incidents in the last year were linked to supply chain compromises. The firm's CEO highlights that phishing, ransomware, and data breaches are often just different stages of a larger campaign built on exploiting trusted third-party relationships, fueled by a booming dark web market for initial access credentials.

Hackers Expand Attacks on ICS/OT and Enterprise AI Systems

Research from Cyble, published January 20, 2026, reveals a dangerous convergence of threats, with adversaries increasingly targeting both industrial control systems (ICS/OT) and enterprise artificial intelligence (AI) systems. The report highlights that hacktivists and cybercriminals are exploiting internet-exposed Human-Machine Interfaces (HMI) and SCADA systems to disrupt critical infrastructure. Simultaneously, they are weaponizing AI workflows through techniques like prompt injection and data poisoning. This dual-front attack creates unprecedented challenges for defenders. The report also notes that ransomware remains the most disruptive threat, with RaaS affiliates collaborating and shifting towards extortion-only models, while the industrialized Phishing-as-a-Service (PhaaS) economy continues to fuel initial access campaigns.

CISA Adds Actively Exploited SolarWinds RCE Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in SolarWinds Web Help Desk (WHD) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2025-40551 with a CVSS score of 9.8, is a deserialization of untrusted data vulnerability. Its inclusion in the KEV catalog serves as a definitive warning that the vulnerability is being actively exploited in the wild. CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies must patch this flaw by February 6, 2026, and all organizations using the product are strongly urged to do the same.

Patch Now: Critical ScreenConnect Auth Bypass (CVSS 10.0) Under Active Attack

ConnectWise has disclosed and patched two critical vulnerabilities affecting its ScreenConnect remote access software, with one flaw, CVE-2026-1014, receiving a maximum CVSS score of 10.0. This authentication bypass vulnerability allows a remote, unauthenticated attacker to create a new administrator account on an exposed server. A second path traversal flaw, CVE-2026-1219 (CVSS 8.4), allows an authenticated attacker to upload arbitrary files. Security researchers and CISA have confirmed that threat actors are actively chaining these vulnerabilities in the wild to gain initial access, upload malicious payloads, and achieve remote code execution on vulnerable on-premise instances. The flaws impact ScreenConnect versions 23.9.7 and older. ConnectWise has released version 23.9.8 to address the issues, and CISA has added CVE-2026-1014 to its Known Exploited Vulnerabilities (KEV) catalog, underscoring the urgency for immediate patching.

New '0APT' Extortion Group Fakes Data Breach in Bluff Attack on Australian Hospital

A new extortion group calling itself '0APT' has targeted Australia's Epworth HealthCare, claiming to have stolen 920GB of sensitive patient and financial data. The group listed the hospital on its darknet leak site on February 4, 2026, threatening to publish the data if a ransom was not paid. However, Epworth HealthCare conducted a thorough investigation with external cybersecurity experts and found "no verified evidence of any impact to our systems or data." Cybersecurity researchers have corroborated this, assessing that 0APT is likely a "fake" ransomware operation. The group's modus operandi involves posting a high volume of victims without providing credible proof of a breach, instead using empty files or random data streams. This tactic relies on psychological pressure and the threat of reputational damage to extort payment, representing a shift from technical intrusion to pure intimidation.

KillSec Ransomware Group Claims Attack on Nigerian Tech Startup Getly

The ransomware group known as KillSec has claimed responsibility for a cyberattack on Getly, a Nigerian technology startup. On February 9, 2026, the group posted the claim on its platform, stating it had breached the company and exfiltrated sensitive data. KillSec has threatened to leak the stolen information if its unspecified ransom demands are not met. Getly, which operates the `getly.app` domain, has not yet publicly commented on the alleged breach, and the claims have not been independently verified. The incident highlights the global reach of ransomware gangs and the increasing risk they pose to startups and small businesses in emerging markets, not just large enterprises.

Australia Post Phishing Scam Harvests Credit Card and OTP Data

A widespread phishing campaign is actively targeting Australians by impersonating Australia Post. Cybersecurity firm MailGuard intercepted the scam on February 9, 2026, which uses emails with the subject line "Parcel Awaiting Instructions." The emails claim a delivery has failed due to an incomplete address and trick recipients into clicking a link to pay a small, fraudulent shipping fee of 1.99 AUD. The link leads to a sophisticated, multi-stage credential harvesting site designed to look like an official Australia Post portal. The site first captures the victim's full credit card details and phone number, and then, in a final crucial step, prompts for the one-time passcode (OTP) sent to their mobile. This allows the attackers to authorize fraudulent transactions immediately. The sender's email address is a clear giveaway, and users are advised to be vigilant.

AI Supply Chain Attack: Hundreds of Malicious 'Skills' on ClawHub Marketplace Steal Credentials

A significant software supply chain attack is targeting users of the OpenClaw AI assistant through its community marketplace, ClawHub. Security researchers have discovered hundreds of malicious 'skills'—add-ons that extend the AI's functionality—that have been published by threat actors. These skills masquerade as useful tools, such as wallet trackers or content summarizers, but their installation instructions trick users into downloading malware. The primary payloads include the Atomic Stealer infostealer for macOS and other backdoors and keyloggers for Windows. The attack leverages the trusted, open-source nature of the marketplace, which lacked a formal review process for submissions. In response to the discovery by KOI Security and SlowMist, the OpenClaw team has partnered with VirusTotal to automatically scan all skills uploaded to ClawHub to prevent further abuse.

'Bloody Wolf' APT Deploys NetSupport RAT in Espionage Campaign

Security researchers have uncovered an active spear-phishing campaign attributed to the threat actor 'Bloody Wolf' (also tracked as Stan Ghouls). The campaign targets organizations primarily in Uzbekistan and Russia, with a focus on manufacturing, finance, and IT sectors, though government and other entities have also been targeted. The attackers use phishing emails with password-protected ZIP archives containing a malicious LNK file. When executed, this file downloads and installs the legitimate remote administration tool, NetSupport RAT, which gives the attackers full control over the victim's system. The motives appear to be mixed, pointing towards both financially motivated cybercrime and state-aligned cyber espionage. This campaign marks a shift in tooling for the group, which previously used the STRRAT malware.

China-Linked UNC3886 Hits All Major Singapore Telcos in Coordinated Zero-Day Attack

Singaporean authorities have revealed that all four of the nation's major telecommunication providers were targeted in a sophisticated and coordinated cyber espionage campaign. The attack is attributed to UNC3886, a Chinese-linked advanced persistent threat (APT) group known for targeting critical infrastructure. The attackers exploited a zero-day vulnerability in the telcos' perimeter firewalls to gain initial access. Once inside, the group stole a limited amount of technical data and used advanced techniques to evade detection. While the attackers have not yet penetrated the core networks, officials noted their capability to deploy tools that could disrupt internet and telecommunications services. In response, Singapore has launched one of its largest-ever coordinated cyber defense operations, involving government agencies and the affected telcos working together to hunt for the intruders and harden national infrastructure.

CRITICAL: Ivanti Patches Two Actively Exploited RCE Zero-Days in EPMM

Ivanti has released urgent security patches for two critical remote code execution (RCE) vulnerabilities, CVE-2026-1281 and CVE-2026-1340, affecting its Endpoint Manager Mobile (EPMM) solution, formerly MobileIron Core. Both flaws are rated 9.8 out of 10 on the CVSS scale and are confirmed to be actively exploited in the wild as zero-days. An unauthenticated attacker can exploit these vulnerabilities to execute arbitrary code on an affected appliance, granting them access to sensitive mobile device management data. Given the active exploitation, administrators are urged to apply the temporary RPM script patches immediately while awaiting a permanent fix in the upcoming version 12.8.0.0.

Nationwide Outage: BridgePay Payment Gateway Confirms Ransomware Attack Crippled Production Systems

U.S. payment gateway provider BridgePay Network Solutions has confirmed a ransomware attack was the cause of a massive service outage that began on February 6, 2026. The attack took down numerous production systems, including the BridgePay Gateway API, virtual terminals, and hosted payment pages, disrupting credit and debit card processing for merchants across the United States in sectors like retail, hospitality, and government. Many businesses were forced to revert to cash-only operations. BridgePay has engaged the FBI and U.S. Secret Service. While the company states that an initial investigation suggests no usable payment card data was exposed due to encryption, a timeline for full service restoration has not been provided, and the process is expected to be lengthy.

EDR-Killer Malware Weaponizes Decade-Old EnCase Driver in BYOVD Attacks

Threat actors are using a new EDR-killing malware that leverages a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to disable endpoint security products. Researchers at Huntress discovered the malware during an intrusion that began with compromised SonicWall SSL VPN credentials. The attackers abuse `EnPortv.sys`, a legitimate but long-revoked kernel driver from Guidance Software's EnCase forensic toolkit. Despite its certificate being revoked in 2010, a gap in Windows' driver signature enforcement allows it to be loaded, granting the attackers kernel-level privileges. The malware uses these privileges to terminate 59 different processes associated with major EDR vendors like CrowdStrike, SentinelOne, and Microsoft, clearing the way for ransomware deployment.

U.S. Finalizes Ban on Chinese and Russian Tech in Connected Vehicles, Forcing Massive Supply Chain Overhaul

The United States has finalized new regulations from the Commerce Department that will ban hardware and software from China and Russia in connected vehicles sold in the U.S. The rules are designed to mitigate national security risks, preventing foreign adversaries from collecting sensitive data or manipulating vehicle functions. The ban will be phased in, starting with software for the 2027 model year and extending to hardware by 2029. The auto industry is facing what is being called 'one of the most consequential and complex auto regulations in decades,' forcing a massive and difficult overhaul of their deeply embedded global software and hardware supply chains.

European Commission Contains Cyberattack on its Mobile Device Management (MDM) System

The European Commission disclosed on February 5, 2026, that it had identified and contained a cyberattack against its central infrastructure for managing mobile devices. The attack, detected on January 30, was reportedly contained and the system cleaned within nine hours. The Commission stated that the incident may have resulted in unauthorized access to some staff names and mobile numbers, but there is no evidence that any mobile devices themselves were compromised. The incident comes shortly after the Commission proposed a new, comprehensive cybersecurity package (CSA2) to strengthen security across the EU.

Malicious VS Code Extension 'ClawdBot Agent' Deployed ScreenConnect RAT via Marketplace

A malicious extension named 'ClawdBot Agent' was discovered in the official Visual Studio Code Marketplace, impersonating a popular AI coding assistant to trick developers. The trojanized extension was fully functional, helping it evade suspicion while its malicious payload executed in the background upon VS Code launch. The attack chain fetched a remote configuration file that initiated the deployment of a weaponized version of the legitimate remote support tool, ConnectWise ScreenConnect, effectively turning it into a Remote Access Tool (RAT). This gave attackers full remote control over compromised developer machines. The extension was quickly removed by Microsoft, but the incident highlights the growing risk of supply chain attacks targeting developer ecosystems.

EU Proposes Revised Cybersecurity Act to Bolster Supply Chain Security & ENISA's Role

The European Commission has introduced a new cybersecurity package that includes a proposal for a revised Cybersecurity Act (CSA) and targeted amendments to the NIS2 Directive. The initiative aims to strengthen the EU's collective resilience against cyber threats by establishing a framework for ICT supply chain security, promoting 'cyber-secure by design' principles through certification, and enhancing the role of ENISA, the EU's cybersecurity agency. The amendments to NIS2 seek to clarify rules on jurisdiction and streamline ransomware incident data collection. Once adopted, member states will have one year to transpose the new provisions into national law.

CISA Adds Critical SmarterMail RCE Flaw to KEV Catalog Amid Active Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in SmarterTools' SmarterMail, CVE-2026-24423, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which allows for unauthenticated RCE, is being actively weaponized by ransomware operators. The vulnerability stems from a missing authentication check in an API endpoint, enabling attackers to execute arbitrary commands on vulnerable email servers. CISA has directed all federal agencies to apply patches by February 26, 2026, and strongly urges all organizations using the affected software to update immediately to mitigate the significant risk of compromise.

Transparent Tribe (APT36) Shifts Focus, Targeting Indian Startups with Crimson RAT

The Pakistan-aligned APT group Transparent Tribe (also known as APT36) has strategically shifted its targeting from Indian government and military entities to the country's growing startup sector. A new campaign, identified by researchers, uses the group's signature Crimson RAT malware delivered via malicious ISO files in phishing emails. The lures are themed around startups, with some attacks leveraging scraped personal information of real founders to appear more legitimate. The focus on startups in the cybersecurity and intelligence fields suggests the group aims to steal intellectual property and potentially use compromised companies as a supply chain vector to attack their government clients.

Ransomware Gangs Like LockBit and BlackCat Use Legitimate ISP Software for Anonymous Server Provisioning

Researchers at Sophos have discovered how bulletproof hosting (BPH) providers are abusing legitimate server management software from ISPsystem to anonymously provision virtual machines for cybercriminals. The software, VMmanager, leaves a default hostname fingerprint (`WIN-J9D866ESIJ2`) that allowed researchers to link thousands of malicious servers to BPH providers like Stark Industries Solutions and MasterRDP. This infrastructure is actively being used to support operations for top-tier ransomware groups, including LockBit, BlackCat (ALPHV), and Conti, highlighting a critical link between legitimate tools and the cybercrime underworld.

Aggressive Odyssey Stealer Malware Campaign Targets macOS Users Globally

A new and aggressive campaign featuring the Odyssey Stealer malware is actively targeting Apple macOS users across the globe. Initially focused on the US and Europe, the attack's reach expanded within 24 hours to South America, Africa, and Asia. Odyssey Stealer is an info-stealer designed to harvest browser credentials, crypto wallets, and system data. This latest variant uses builders to automatically generate unique, obfuscated samples, making it difficult for signature-based antivirus to detect. The malware spreads via social engineering, using fake or cracked software downloads and phishing lures to trick users into installing it.

Attackers Abuse Windows Screensaver (.scr) Files to Drop RMM Tools for Persistent Access

A novel attack technique has been observed where threat actors are abusing Windows screensaver (.scr) files as droppers for legitimate remote monitoring and management (RMM) tools. By tricking users into executing a malicious screensaver file, attackers can bypass security controls that might block direct RMM installation. Because .scr files are executables, they can be weaponized to install the RMM software, providing the attacker with persistent, stealthy remote access to the compromised machine for data theft, surveillance, or lateral movement. This method highlights the ongoing trend of attackers using living-off-the-land techniques.

Evolving Telegram Phishing Campaign Tricks Users into Approving Account Takeover

A sophisticated phishing campaign targeting Telegram users has re-emerged, using the platform's own features to hijack accounts. As reported by CYFIRMA, the attack tricks users with fake security alerts, directing them to a malicious site or bot that mimics an official Telegram service. The core of the attack is manipulating the user into approving a legitimate-looking authorization prompt for a 'new device' within their own Telegram app. Approving this prompt grants the attacker's device full session access, enabling them to take over the account, read private chats, and exfiltrate data. The campaign highlights the effectiveness of social engineering attacks that exploit user trust in a platform's native functions.

Ransomware Attacks on Education Sector Slowed in 2025, But U.S. Remains Top Target

A 2025 report from Comparitech indicates a slowdown in the growth of ransomware attacks against the global education sector. There were 251 attacks recorded worldwide, a slight 2% increase from the previous year. These incidents resulted in at least 3.96 million breached records. The United States was the most affected country with 130 attacks, though this marked a 9% decrease for the nation year-over-year. High-profile incidents included demands of $400,000 against school districts by the Medusa ransomware gang, highlighting the continued financial and operational strain these attacks place on educational institutions.

CISA: Critical SmarterMail RCE Flaw Actively Exploited in Ransomware Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution (RCE) vulnerability in SmarterTools' SmarterMail, CVE-2026-24423, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which has a CVSS score of 9.3, allows an unauthenticated attacker to take full control of a mail server by abusing an API method with a missing authentication check. CISA confirms the vulnerability is being actively used in ransomware campaigns and has mandated that federal agencies patch by February 26, 2026. All organizations using the affected email server software are strongly urged to update to build 9511 or later immediately.

CISA Issues Directive Forcing Removal of Unsupported Edge Devices from Federal Networks

In response to increasing exploitation by nation-state actors, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-02. The directive mandates that all Federal Civilian Executive Branch (FCEB) agencies inventory and remove all unsupported network edge devices, such as firewalls and routers, within one year. Devices that are end-of-life (EOL) or end-of-support (EOS) no longer receive security updates and represent a significant risk. The order requires agencies to replace unsupported hardware and software, report their inventory to CISA, and establish a mature lifecycle management process to prevent future risks from technical debt.

Betterment Data Breach Exposes 1.4M Customers After Social Engineering Attack

Automated investment platform Betterment has disclosed a data breach affecting 1.4 million customers, originating from a sophisticated social engineering attack. Threat actors, claiming to be the 'ShinyHunters' group, used voice phishing (vishing) to manipulate employees and steal Okta single sign-on codes, gaining access to third-party marketing and support systems. The compromised data includes names, email addresses, phone numbers, and physical addresses. While core financial accounts were not compromised, the attackers used the stolen contact information to launch a fraudulent cryptocurrency scam targeting Betterment's customers. The incident highlights the growing threat of social engineering targeting employees to bypass technical security controls.

Financial Sector Cyberattacks Doubled in 2025, Fueled by Geopolitical Hacktivism

A new report from Check Point Software reveals a dramatic escalation in cyber threats targeting the global financial sector, with incidents more than doubling in 2025. The primary driver was a 105% increase in Distributed Denial-of-Service (DDoS) attacks, which were largely motivated by geopolitically-driven hacktivism rather than direct financial gain. Hacktivist campaigns aimed to disrupt banking portals and payment systems in countries involved in geopolitical conflicts, including Israel, the U.S., and Ukraine. The report also highlights a 73% jump in data breaches and the persistent threat of multi-extortion ransomware, indicating a complex and evolving threat landscape for financial institutions.

Critical RCE Flaw in n8n Automation Platform Allows Full Server Takeover

A critical sandbox escape vulnerability, CVE-2026-25049, has been discovered in the popular n8n workflow automation platform. The flaw, rated 9.4 on the CVSS scale, allows an authenticated user with permission to edit workflows to bypass security controls and execute arbitrary system commands on the host server. This could lead to a full server compromise, exposing sensitive credentials, API keys, and OAuth tokens stored in the environment. The vulnerability is a bypass for a previously patched RCE flaw, and administrators are urged to update to n8n versions 1.123.17 or 2.5.2 immediately to prevent potential hijacking of connected cloud services and AI pipelines.

New 'Milkyway' Ransomware Strain Surfaces with Aggressive Extortion Tactics

A new Windows-based ransomware strain named 'Milkyway' has been identified by researchers at CYFIRMA. Currently in a developing state, the malware encrypts files and appends a '.milkyway' extension. It employs aggressive extortion tactics via a full-screen ransom note, threatening not only to leak or sell stolen data but also to report victims to tax authorities and law enforcement if the ransom is not paid. The operators also threaten to contact the victim's clients and partners. Experts warn that Milkyway could evolve into a more sophisticated threat, potentially adopting a Ransomware-as-a-Service (RaaS) model, which would significantly broaden its impact.

Everest Ransomware Group Claims Attack on Japanese Manufacturer Hosokawa Micron

The Everest ransomware group has claimed responsibility for a cyberattack against Hosokawa Micron Corporation, a leading Japanese manufacturer of industrial processing technology. The group announced the breach on an underground forum, threatening to publish approximately 30 GB of exfiltrated confidential company data if their ransom demands are not met. This incident aligns with Everest's typical double-extortion strategy. The group is known for targeting organizations in manufacturing, finance, and IT across the U.S., Europe, and Asia, and also acts as an initial access broker, selling network access to other threat actors.

'Shadow Campaign' Hacks Governments in 37 Countries, China-Linked Group Suspected

Security researchers have uncovered a massive, long-running cyber-espionage operation dubbed 'Shadow Campaign.' The campaign is attributed to a suspected Chinese nation-state group, TGR-STA-1030, and has successfully compromised at least 70 government and critical infrastructure organizations in 37 countries. The group's reconnaissance activities have been even broader, targeting government infrastructure in 155 countries. Targets include high-value entities like national law enforcement, border control, finance ministries, and telecommunications companies. The operational footprint, including tools and timezone activity (GMT+8), strongly points towards a China-based actor.

Cisco and F5 Release Urgent Patches for High-Severity DoS and RCE Vulnerabilities

Networking giants Cisco and F5 have released a wave of security updates to address multiple high-severity vulnerabilities across their product lines. Cisco patched five flaws, including a remote DoS bug in TelePresence/RoomOS (CVE-2026-20119) and a root-level command execution flaw in Meeting Management software (CVE-2026-20098). Concurrently, F5 addressed five vulnerabilities in its BIG-IP and NGINX products, two of which are rated high-severity: a DoS flaw in BIG-IP (CVE-2026-22548) and a man-in-the-middle vulnerability in NGINX (CVE-2026-1642). Customers are strongly advised to apply the patches promptly to mitigate risks of service disruption and system compromise.

Chinese APT 'Amaranth-Dragon' Hits Southeast Asian Governments with WinRAR Exploit

A newly identified China-linked APT group, dubbed 'Amaranth-Dragon,' is conducting targeted cyber espionage campaigns against government and law enforcement agencies in Southeast Asia. The group, believed to be affiliated with the broader APT41 ecosystem, is exploiting a known WinRAR vulnerability (CVE-2025-8088) for initial access. Amaranth-Dragon demonstrates a high degree of stealth, using custom tools like 'Amaranth Loader' and a new 'TGAmaranth RAT' that leverages Telegram for command-and-control. The campaigns are tightly scoped, targeting countries like Cambodia, Thailand, and the Philippines, and appear to be motivated by geopolitical intelligence gathering.

Voicemail-Themed Phishing Campaign Deploys Legitimate RMM Tools for Backdoor Access

A widespread social engineering campaign is using convincing voicemail-themed lures to trick victims into installing legitimate remote monitoring and management (RMM) software. The attack begins with an email, often from a bank-themed subdomain, leading to a webpage that prompts the user to 'listen to your message.' Instead of playing a message, the page guides the user through a series of installation steps for a legitimate tool called 'Remotely RMM.' Once installed, the software enrolls the device into an attacker-controlled environment, providing them with persistent remote access for data theft and further malware deployment.

Microsoft Mandates TLS 1.2 for Azure Blob Storage, Sunsetting Older Versions

Microsoft has officially deprecated support for Transport Layer Security (TLS) versions 1.0 and 1.1 for its Azure Blob Storage service, effective February 3, 2026. TLS 1.2 is now the minimum required version for all new and existing blob storage accounts across all Azure clouds. This mandatory security enhancement aims to protect data in transit from known cryptographic vulnerabilities present in the older protocols. Customers with applications or clients still relying on TLS 1.0 or 1.1 must update them to ensure continued connectivity and avoid service disruptions.

Futile Ransom: Nitrogen Ransomware Contains Fatal Coding Error, Decryption Impossible

In a case of profound operational failure, security researchers have discovered a fatal coding error in the Nitrogen ransomware group's malware that targets VMware ESXi systems. The flaw, found in the encryption routine, causes the malware to use the wrong public key during the encryption process. As a result, the decryptor provided by the gang after a ransom is paid is mathematically incapable of reversing the encryption. This means that any victim who pays the ransom for their encrypted ESXi virtual machines has zero chance of recovering their data, reinforcing law enforcement advice to not pay ransoms.

UK Advances New Bill to Regulate Managed Service Providers (MSPs)

The United Kingdom government is advancing a new Cyber Security and Resilience Bill aimed at strengthening the nation's digital supply chain. A key provision of the bill is to bring Managed Service Providers (MSPs) under direct regulatory oversight for the first time. Citing the systemic risk demonstrated by attacks like the one on Synnovis that impacted the NHS, the legislation will impose security duties on MSPs similar to those already applied to essential services. The goal is to establish a higher baseline of security across the thousands of organizations that rely on MSPs for their IT and security operations.

SolarWinds Discloses Five Critical RCE & Auth Bypass Flaws in Web Help Desk

SolarWinds has disclosed a set of five critical vulnerabilities in its Web Help Desk (WHD) platform, a tool used by over 300,000 organizations. The flaws include two unauthenticated remote code execution (RCE) vulnerabilities and two authentication bypasses, each with a CVSS score of 9.8. This incident highlights a troubling pattern of recurring patch failures, as one of the new flaws, CVE-2025-40553, is the second bypass of an original deserialization vulnerability (CVE-2024-28986) first patched in 2024. Given the critical nature of the flaws, organizations with internet-facing WHD instances are at extreme risk and must patch immediately.

CISA Criticized for Silently Updating KEV Catalog with Ransomware Data

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is facing criticism for its practice of silently updating its Known Exploited Vulnerability (KEV) catalog. In 2025, the agency updated 59 entries to indicate that the flaws were being used in ransomware attacks, but it did not issue any notifications for these changes. Security experts argue that this lack of communication is a significant missed opportunity for defenders, who use the ransomware designation as a key factor in prioritizing patching.

Massive AT&T Customer Dataset with 148M SSNs Resurfaces in Criminal Circles

A massive and highly sensitive dataset allegedly containing the personal information of AT&T customers has resurfaced and is being circulated in criminal forums. The data trove reportedly includes approximately 176 million records, featuring over 133 million full names and addresses, and, most critically, up to 148 million full and partial Social Security numbers. The re-emergence of this consolidated data poses a severe and renewed risk of identity theft, phishing, and fraud for millions of individuals.

LinkedIn Phishing Campaign Targets Executives Using Legitimate Pen-Testing Tools

A new phishing campaign discovered by ReliaQuest is abusing LinkedIn's private messaging feature to target executives and IT professionals. The attackers use social engineering to trick victims into downloading and running a malicious archive file. The attack's novelty lies in its use of a legitimate, open-source Python script designed for penetration testing. This 'living off the land' technique makes the malicious activity difficult to distinguish from normal administrative tasks, significantly reducing the risk of detection by security software.

Fake LINE Messenger Installer Spreads ValleyRAT Malware

A malware campaign attributed to the Silver Fox APT group is distributing the ValleyRAT remote access trojan by disguising it as an installer for the popular LINE messaging app. The campaign, which primarily targets Chinese-speaking users, uses the trojanized software as a lure to infect systems. Once installed, ValleyRAT establishes persistence and focuses on stealing user credentials, leveraging advanced evasion techniques to remain undetected.

Critical Flaws in Django Framework Expose Sites to DoS and SQL Injection

The maintainers of the Django web framework have released important security updates to address critical vulnerabilities. The flaws could allow remote attackers to conduct Denial-of-Service (DoS) and potential SQL injection attacks against web applications built with the framework. Due to the severity of these issues, which could lead to service disruption and data compromise, administrators are strongly urged to patch their Django instances immediately.

Critical RCE Flaw in Ingress-NGINX Threatens Kubernetes Clusters

A critical vulnerability has been discovered in the widely used Ingress-NGINX controller for Kubernetes. The flaw could allow a remote attacker to achieve arbitrary code execution within the context of the ingress controller. A successful exploit could lead to a full compromise of the ingress, enabling traffic interception, data theft, and providing a powerful foothold for lateral movement into the underlying Kubernetes cluster environment. Users are urged to patch immediately.

Samsung's February 2026 Update Fixes 37 Flaws in Galaxy Devices

Samsung has released its February 2026 security update for its Galaxy smartphones, tablets, and foldable devices. The update addresses a total of 37 vulnerabilities. This includes 25 patches from Google for the core Android OS and 12 Samsung-specific patches (SVEs) for its One UI software. The Samsung-specific fixes address flaws rated as high and moderate severity, including an access control vulnerability in the 'Emergency Sharing' feature. Users are advised to install the update promptly.

Google Patches Multiple Vulnerabilities in February 2026 Pixel Update

Google has released its monthly security update for all supported Pixel devices as part of its February 2026 patch cycle. The update addresses numerous security vulnerabilities detailed in the Android and Pixel-specific security bulletins. Installing the update will bring all supported Pixel devices to the 2026-02-05 patch level, ensuring they are protected against the latest discovered threats. The update also includes various functional improvements.

UK Law Criminalizing AI-Generated Deepfake Intimate Images Takes Effect

A new law in the United Kingdom is set to come into force on February 6, 2026, making it a criminal offense to create or share AI-generated 'deepfake' intimate images of an adult without their consent. The law, part of the Data (Use and Access) Act 2025, amends the Sexual Offences Act 2003 to specifically address the malicious use of artificial intelligence to create harmful and abusive content. This legislative action is a direct response to the growing problem of non-consensual deepfake pornography.

Notepad++ Update Mechanism Hijacked in 6-Month Supply Chain Attack by Chinese APT

The maintainers of the widely-used Notepad++ text editor have disclosed a major supply chain attack that compromised their update infrastructure for six months in 2025. The attack, attributed to the Chinese espionage group Lotus Blossom (Billbug), involved hijacking update requests to selectively deliver a custom backdoor named 'Chrysalis' and other malware like Cobalt Strike to a targeted set of organizations. Victims were primarily located in Southeast Asia and included government and financial entities, highlighting a sophisticated, long-running espionage campaign.

Qilin Ransomware Claims Breach of Tulsa International Airport, Leaks Data

The Russian-affiliated Qilin ransomware group has claimed responsibility for a cyberattack against Tulsa International Airport. The group has listed the airport on its data leak site, alleging the theft of sensitive data including financial records and employee information. While airport operations reportedly remain unaffected, the incident highlights the ongoing trend of ransomware gangs targeting critical infrastructure. Qilin has been identified as a highly active group, responsible for a significant number of recent attacks.

Sophisticated Phishing Attack Uses PDF Lures and Cloud Services to Steal Dropbox Credentials

A new, multi-stage phishing campaign is using procurement-themed emails with benign-looking PDF attachments to bypass email security filters. The attack chain redirects victims through a legitimate cloud service, Vercel Blob, before presenting a convincing fake Dropbox login page. The goal is to harvest corporate credentials, which are then exfiltrated to an attacker-controlled Telegram bot. This layered approach is designed to appear legitimate and evade detection by both automated systems and wary users.

Canada Computers Discloses Data Breach Affecting Guest Checkout Customers

Canada Computers Inc., a major Canadian electronics retailer, has announced a data breach that exposed the personal and credit card information of customers. The incident affected individuals who used the 'guest' checkout feature on the company's website between December 29, 2025, and January 22, 2026. The company discovered the breach on January 22 and has since launched an investigation with law enforcement. Customers who were logged into member accounts are not believed to be affected.

Play Ransomware Hits US Instrument Manufacturer Deatak in Data Breach

The Play ransomware group has claimed another victim in the manufacturing sector, listing U.S.-based instrument maker Deatak on its data breach forum. The attackers allege they have compromised and exfiltrated a wide range of private and confidential data, including client documents, employee payroll details, and financial information. This attack underscores the persistent threat that ransomware poses to specialized manufacturing firms, which often possess valuable intellectual property and sensitive corporate data.

INC Ransomware Group Breaches Two U.S. Law Firms, Leaks Sensitive Client Data

The INC ransomware group is actively targeting the U.S. legal sector, claiming responsibility for attacks on at least two law firms: Hawk Law Group and Eisenberg Lowrance Lundell Lofgren. The group alleges it has stolen highly sensitive client information, including data related to civil and criminal litigation cases, government-issued IDs, and personal details. These attacks highlight the significant risk faced by law firms, which are high-value targets for cybercriminals due to the confidential nature of the data they hold.

Ransomware Attack Cripples City of New Britain, CT, Forcing Manual Operations

A ransomware attack has caused significant and ongoing disruption to the municipal network systems of New Britain, Connecticut. The attack, which began last week and was later confirmed as ransomware, has impacted the city's entire internet server. As a result, city departments have been forced to abandon digital systems and revert to manual 'pen and paper' operations. Federal authorities have been called in to assist with the investigation and response efforts.

Health-ISAC Report: AI-Enabled Attacks Named Top Threat to Healthcare Sector in 2026

The Health Information Sharing and Analysis Center (Health-ISAC) has released its 2026 Global Health Sector Threat Landscape report, identifying AI-enabled attacks as the number one projected concern for the year. Based on surveys of healthcare executives and security professionals, the report highlights a shift in focus towards emerging, sophisticated threats. Alongside AI, the report emphasizes the persistent dangers of major supply chain vulnerabilities and the continued high impact of ransomware. The findings, drawn from extensive data including over 1,200 targeted alerts in 2025, urge healthcare organizations to move towards a more proactive and resilient security posture.

Open VSX Marketplace Hit by Supply Chain Attack Spreading "GlassWorm" Malware

On January 30, 2026, the Open VSX Registry, a popular marketplace for Visual Studio Code extensions, fell victim to a supply chain attack. Threat actors compromised the account of a legitimate developer, 'oorzc', and published malicious updates to four of their popular extensions. These updates embedded the 'GlassWorm' malware loader. The compromised extensions had been downloaded over 22,000 times, exposing a large number of developers to the malware before the malicious versions were removed by the Open VSX security team.

Microsoft Patches Actively Exploited Office Zero-Day (CVE-2026-21509) Under Targeted Attack

Microsoft has released an emergency out-of-band security update for CVE-2026-21509, a high-severity security feature bypass vulnerability in Microsoft Office. The flaw, which has a CVSS score of 7.8, is being actively exploited in targeted attacks, allowing attackers to bypass Object Linking and Embedding (OLE) protections by tricking users into opening malicious documents. In response to the in-the-wild exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply the patch by February 16, 2026. The update applies to Office 2016, Office 2019, and Office LTSC, while Microsoft 365 Apps customers will receive a service-side update.

New "Pulsar RAT" Evades Detection with In-Memory Execution and LoTL Techniques

Security researchers have uncovered a new, stealthy Remote Access Trojan (RAT) targeting Windows systems, named 'Pulsar RAT'. This modular, .NET-based malware utilizes a multi-stage infection chain that heavily relies on in-memory execution and living-off-the-land techniques to evade detection. It features advanced anti-analysis capabilities, including anti-VM and anti-debugging checks. Once active, Pulsar RAT provides operators with live, interactive control for credential harvesting and data exfiltration, using legitimate services like Discord and Telegram for command-and-control.

Warning: Malicious ChatGPT Chrome Extensions Steal Session Tokens to Hijack Accounts

Researchers have identified 16 malicious Google Chrome extensions that masquerade as helpful tools for OpenAI's ChatGPT. Once installed, these extensions inject malicious scripts into the ChatGPT web application. The scripts are designed to monitor outbound requests, intercept sensitive data such as authorization details and session tokens, and exfiltrate them to an attacker-controlled server. This allows the attackers to hijack active user sessions, granting them full access to the victim's account and chat history.

AI Social Network "Moltbook" Breach Exposes 1.5M API Keys and 29k User Emails

A significant data breach at the AI-focused social network 'Moltbook' has exposed 1.5 million API keys, 29,000 user emails, and other sensitive data tables. The investigation, conducted by security firm Wiz, not only uncovered the data exposure but also revealed systemic security flaws, such as a lack of rate-limiting on agent registration. The breach also provided a skewed insight into the platform's user base, showing that its 1.5 million 'agents' were owned by only 17,000 human users. Moltbook has since deployed fixes to secure the exposed data.

New Iran-Linked 'RedKitten' Group Targets Human Rights NGOs with AI-Suspected Malware

A new cyber-espionage campaign by a Farsi-speaking threat actor dubbed 'RedKitten' is targeting human rights NGOs and activists documenting abuses in Iran. The campaign, observed by HarfangLab in January 2026, uses phishing emails with macro-laced Excel files as an initial vector. The malware is notable for its modularity and its use of legitimate public services like GitHub, Google Drive, and Telegram for C2 and payload delivery, a technique to evade detection. Researchers suspect the attackers may have used Large Language Models (LLMs) to assist in the development of their sophisticated tooling, marking a potential new trend in malware creation.

Fortinet Scrambles to Fix Actively Exploited SSO Auth Bypass (CVE-2026-24858) Hijacking Devices

Fortinet has disclosed and patched a critical authentication bypass vulnerability, CVE-2026-24858, in its FortiCloud Single Sign-On (SSO) feature. The flaw is being actively exploited, allowing attackers with a FortiCloud account to log into devices registered to other users, leading to unauthorized configuration changes and account creation. The vulnerability affects a wide range of products, including FortiOS, FortiManager, and FortiAnalyzer. Due to the active exploitation and severity, CISA has added CVE-2026-24858 to its Known Exploited Vulnerabilities (KEV) catalog, urging users to patch and hunt for signs of compromise immediately.

Microsoft Office Zero-Day Under Active Attack Bypasses Security Features

Microsoft has issued an emergency out-of-band patch for a high-severity zero-day vulnerability in Microsoft Office, CVE-2026-21509. The flaw, a security feature bypass with a CVSS score of 7.8, is being actively exploited in the wild through malicious documents. It allows attackers to circumvent Object Linking and Embedding (OLE) protections, leading to code execution if a user opens a specially crafted file. The vulnerability affects a wide range of Office products, including Office 2016 through LTSC 2024 and Microsoft 365 Apps. CISA has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent patching for federal agencies and signaling a significant risk to all organizations.

AI to Overtake Human Error as Top Cause of Breaches, Experian Predicts

In its 13th Annual Data Breach Industry Forecast, Experian predicts a paradigm shift in cybersecurity for 2026, with autonomous AI agents potentially surpassing human error as the leading cause of data breaches. The report warns that threat actors are weaponizing AI to create sophisticated polymorphic malware, execute highly personalized attacks, and generate 'pristine synthetic identities' at scale from stolen data. This new wave of AI-driven threats, combined with the looming risk of quantum computing, is expected to fuel a massive spike in identity theft and fundamentally change the nature of cyberattacks.

Attacks on Industrial Environments Doubled in 2025, Report Warns

A new report from cybersecurity firm Cyble reveals a dramatic escalation in threats targeting industrial environments. According to its Annual Threat Landscape Report 2025, exploits against industrial technology (IT) and operational technology (OT) systems almost doubled last year. The report, published on January 15, 2026, documented nearly 6,000 ransomware attacks and identified numerous vulnerabilities in internet-exposed assets across critical infrastructure. Cyble predicts that in 2026, attackers will increasingly target exposed Human-Machine Interfaces (HMIs) and SCADA systems. This trend poses a significant risk to major global events, such as the 2026 Winter Olympics, where interconnected vendor systems create a rich target environment for disruption and extortion.

FBI Shuts Down RAMP, a Notorious Ransomware Recruitment and Trading Hub

In a significant blow to the ransomware ecosystem, the U.S. Federal Bureau of Investigation (FBI) has seized the RAMP (Russian Anonymous MarketPlace) forum. The Russian-language site, which operated on both the clear and dark web, was a central hub for ransomware-as-a-service (RaaS) operations. It served as a recruitment ground for affiliates for major gangs like ALPHV/BlackCat and Qilin, a marketplace for initial access brokers, and a trading post for stolen data. The takedown, conducted with the DOJ, disrupts a key piece of infrastructure that enabled numerous high-profile cyberattacks.

Supply Chain Attack: eScan Antivirus Update Server Compromised to Distribute Malware

Indian antivirus provider eScan, a product of MicroWorld Technologies, has suffered a supply chain attack. On January 20, 2026, a regional update server was compromised, causing it to push a malicious file named 'Reload.exe' to enterprise and consumer customers. According to security firm Morphisec, the malware disables the antivirus product by modifying the local HOSTS file to block future updates and then proceeds with a multi-stage infection to download additional payloads. While MicroWorld Technologies acknowledged the breach and isolated the server, it has disputed the 'supply chain attack' label. Affected users require a manual cleaning utility from eScan support for remediation.

'WhisperPair' Bluetooth Flaw Exposes Millions of Headphones and Speakers to Eavesdropping

A newly discovered vulnerability named 'WhisperPair' affects millions of Bluetooth audio devices from major brands, including Sony, JBL, and Logitech. The flaw allows a nearby attacker to bypass standard Bluetooth pairing security protocols. Successful exploitation could enable an attacker to eavesdrop on private audio streams or inject malicious audio commands into the connected device. This discovery highlights significant security and privacy risks in widely used consumer electronics and the persistent challenges of securing wireless communication protocols.

UStrive Mentoring Platform Exposes Data of 238,000 Users, Including Minors, via Leaky API

The non-profit mentoring platform UStrive has inadvertently exposed the sensitive personal data of over 238,000 users due to a misconfigured GraphQL API endpoint. A significant portion of the exposed user base includes minors, elevating the severity and privacy implications of the incident. The leaky API could have allowed unauthorized individuals to query and retrieve vast amounts of user data. This breach highlights the critical need for robust cybersecurity practices and secure API implementation, particularly for organizations in the non-profit sector that handle sensitive information, including that of children.

Automated Attacks Wipe Exposed MongoDB Databases, Demanding $500 Ransom

An automated data extortion campaign is actively targeting publicly exposed and misconfigured MongoDB databases. A threat actor is systematically wiping data from these unsecured servers and leaving a ransom note demanding approximately $500 in Bitcoin for its return. Research from Flare identified over 3,100 MongoDB instances accessible without authentication, with nearly half (1,400) already compromised by this attacker. This campaign highlights the persistent threat of automated scanning and exploitation of basic security misconfigurations, demonstrating that even with lower ransom demands, such attacks remain a profitable venture for criminals preying on low-hanging fruit.

Air Conditioning Giant Blue Star Discloses Data Breach Affecting Product Installation Data

Blue Star, a major Indian multinational specializing in air conditioning and commercial refrigeration, has announced it experienced a data security incident. The company reported unauthorized access to its product installation data. The breach was reported to its Compliance Officer on January 31, 2026. Blue Star has engaged external cybersecurity experts to investigate the incident's scope, perform a root cause analysis, and strengthen its security posture. Further details on the extent of the compromise and the responsible party have not yet been released as the investigation is ongoing.

Cybersecurity Risks Mount as Partial US Government Shutdown Begins

A partial U.S. government shutdown began at midnight on January 31, 2026, after funding for several federal agencies, including the Department of Homeland Security (DHS), lapsed. Security experts are warning that such shutdowns create a period of heightened cybersecurity risk for the nation. With reduced staffing and coordination at key agencies like CISA, the government's ability to detect, respond to, and share intelligence about threats is diminished. Threat actors, both criminal and nation-state, are known to exploit these periods of disruption to launch targeted phishing, credential harvesting, and ransomware campaigns against government agencies and adjacent sectors.

Cognizant Sued in Class-Action Lawsuits After TriZetto Data Breach

IT services giant Cognizant Technology Solutions is facing multiple class-action lawsuits in the U.S. following a significant data breach at its healthcare subsidiary, TriZetto Provider Solutions (TPS). The lawsuits, filed in New Jersey and Missouri, allege that Cognizant failed to adequately protect sensitive patient health and personal information processed by the TriZetto platform. Plaintiffs also claim the company unreasonably delayed notifying affected individuals, preventing them from taking timely steps to protect themselves from fraud and identity theft. The breach at TriZetto, a major processor of healthcare claims, has wide-ranging privacy implications for a large number of patients.

Novel Phishing Attack Abuses Vercel and Telegram to Deliver RATs

A novel phishing campaign, observed between November 2025 and January 2026, is abusing trusted `*.vercel.app` domains to bypass email security filters and deliver malware. The attack, detailed by Cloudflare, uses financial lures like fake invoices to trick victims into clicking. A unique feature is its Telegram-gated payload delivery, which requires interaction with a Telegram bot to receive the final payload. This technique effectively filters out automated sandboxes and security researchers, ensuring the malware is only delivered to genuine targets. The campaign's ultimate goal is to install GoTo Resolve, a legitimate remote access tool, which is then abused by attackers for persistent access and control.

New 'Sicarii Ransomware' RaaS Emerges, Targeting U.S. Manufacturing

A new ransomware-as-a-service (RaaS) operation named 'Sicarii Ransomware' has been discovered by researchers at CYFIRMA. Active since late 2025, the group is targeting the manufacturing sector in the United States. The malware encrypts victim files using AES-GCM and appends a '.sicarii' extension to them. In addition to encryption, the malware is capable of collecting system information and credentials from infected hosts, suggesting a double-extortion tactic may be part of their playbook. Tactical recommendations to defend against this threat include enhanced monitoring, maintaining offline backups, and strengthening network segmentation.

Industry Responds to Threats with New Tools for Supply Chain, AI, and Malware Analysis

In response to the evolving threat landscape, several cybersecurity firms have launched new products in January 2026. SpyCloud has released its Supply Chain Threat Protection solution to address identity threats within vendor ecosystems. Vectra AI has enhanced its platform to specifically counter attacks that leverage AI, focusing on the AI attack lifecycle. Additionally, Booz Allen Hamilton has made its Vellox Reverser tool generally available, aiming to accelerate malware reverse engineering and threat intelligence analysis for cyber defenders. These releases highlight key areas of focus for the industry: securing the supply chain, defending against AI-powered threats, and speeding up incident analysis.

Global Phishing Campaign Lures Victims with Fake Job Offers

A multi-lingual phishing campaign is targeting job seekers across the United States, United Kingdom, France, Italy, and Spain. According to research from Bitdefender, attackers are impersonating well-known employers and staffing companies, sending emails with fake job offers that promise easy work and fast interviews. The messages are tailored to the recipient's language and location. When a victim clicks a link in the email, they are taken to a credential harvesting webpage designed to steal personal data and login information. This campaign capitalizes on social engineering tactics that prey on individuals' career aspirations.

Apple Boosts Privacy in iOS 26.3 with 'Limit Precise Location' Feature

Apple has introduced a new privacy feature called 'limit precise location' in its iOS 26.3 update. This setting is designed to give users more control over their data by reducing the precision of location information shared with cellular networks. While carriers still receive location data for operational purposes, the feature prevents them from obtaining a user's exact, fine-grained location, making it more difficult to track their precise movements. This update is part of a broader industry trend toward providing users with more granular privacy controls and addressing concerns about location tracking by mobile carriers.

Critical 1-Click RCE Flaw in IDIS Cloud Manager Puts Users at Risk

A critical remote code execution (RCE) vulnerability, CVE-2025-12556, has been discovered in the IDIS Cloud Manager (ICM) viewer by researchers at Claroty's Team82. The flaw, which has a CVSS v4 score of 8.7, allows an attacker to execute arbitrary code on a user's machine by convincing them to click a specially crafted link. This '1-click RCE' vulnerability bypasses the browser sandbox, making it a potent weapon for spear-phishing campaigns. IDIS has released version 1.7.1 to address the issue and urges users to upgrade or uninstall the software immediately.

AI-Fueled Cyberattacks Surge by 70%, Check Point's 2026 Report Reveals

Check Point's 14th annual Cyber Security Report highlights a dramatic escalation in the global threat landscape, revealing a 70% increase in cyberattacks since 2023. The 2026 report, analyzing trends from 2025, found that organizations faced an average of 1,968 attacks per week. A primary driver of this surge is the weaponization of Artificial Intelligence (AI), which attackers are using to enhance social engineering, accelerate malware development, and automate reconnaissance. The report also notes a shift in ransomware tactics towards data-only extortion and an increase in attacks targeting network edge devices like VPNs and IoT.

Canada's Cyber Security Centre Warns of AI-Fueled Ransomware Evolution

The Canadian Centre for Cyber Security has issued a new 'Ransomware Threat Outlook,' warning that the ransomware threat to Canadian organizations is growing and evolving rapidly. The report highlights that criminals are increasingly leveraging artificial intelligence (AI) to make their attacks more sophisticated, easier to execute, and harder to detect. A key trend identified is the shift towards 'multi-extortion' tactics, where attackers steal data and threaten to leak it in addition to encrypting it. The report stresses that despite the advanced tactics, strong cyber hygiene remains a primary defense.

Clop Ransomware Group Claims Attack on Canadian Helicopter Company

The notorious Clop ransomware group has claimed responsibility for a cyberattack against CMHHELI.COM, a Canadian company. On January 29, 2026, the group added the company to its dark web leak site, threatening to publish stolen data if a ransom is not paid. This incident highlights the persistent and indiscriminate nature of major ransomware gangs, who continue to target organizations of all sizes. Security experts advise victims to initiate incident response, validate backups, and engage professionals before considering any communication with the attackers.

SoundCloud Breach Exposes Private Emails of 29.8 Million Users

A significant data breach at the music streaming service SoundCloud has resulted in the public release of a database containing the personal details of 29.8 million users. The data was leaked in January 2026 after the company reportedly refused to pay a ransom demand. The primary risk from this breach stems from the linking of users' private email addresses with their public profile metadata. This combination provides a rich source of data for attackers to launch targeted phishing, credential stuffing, and social engineering campaigns. The breach has been indexed by the notification service HaveIBeenPwned.

ShinyHunters Claims Breach of Crunchbase, Betterment via Okta Vishing Attacks

The notorious cyber extortion syndicate ShinyHunters has claimed responsibility for breaching business intelligence firm Crunchbase and financial advisory company Betterment. According to the threat actor, the initial access was gained by using sophisticated voice phishing (vishing) attacks to socially engineer employees and compromise their Okta single sign-on (SSO) credentials. This method allows attackers to bypass weaker forms of multi-factor authentication. Neither of the targeted companies has publicly confirmed the breach.

ShinyHunters Claims Breach of 10M Match Group Users from Hinge & OkCupid

The notorious cybercrime group ShinyHunters has claimed responsibility for a major data breach impacting Match Group, the parent company of popular dating apps like Hinge, OkCupid, and Match.com. The group posted on a dark web forum that it has stolen over 10 million user records, and released a 1.7GB sample as proof. The data allegedly includes sensitive user information such as names, phone numbers, IP addresses, and match logs, as well as internal corporate documents. ShinyHunters asserts the data was exfiltrated from a third-party analytics provider, AppsFlyer, highlighting a potential supply chain attack vector.

Critical RCE Flaws in n8n Workflow Platform Put Thousands of Instances at Risk

Two new high-severity vulnerabilities have been discovered in the n8n workflow automation platform, a tool that often holds credentials to critical corporate systems. The most severe flaw, CVE-2026-1470, is a critical eval injection vulnerability (CVSS 9.9) that allows an authenticated attacker to bypass the expression sandbox and achieve full remote code execution. A second flaw, CVE-2026-0863 (CVSS 8.5), allows for a similar sandbox escape in the Python execution environment. A compromise could provide an attacker with a 'skeleton key' to an organization's infrastructure. This news is compounded by data showing over 39,000 n8n instances remain unpatched for a previous critical flaw.

Malicious PyPI Packages `spellcheckerpy` & `spellcheckpy` Deliver RAT via Hidden Payload

A software supply chain attack has been uncovered on the Python Package Index (PyPI), involving two malicious packages named `spellcheckerpy` and `spellcheckpy`. Downloaded over 1,000 times, the packages contained a hidden, dormant payload. A later version update activated the malware, which was designed to fingerprint the compromised developer's system and deploy a Remote Access Trojan (RAT). The attack was cleverly concealed, with the malicious code base64-encoded and hidden inside a Basque language dictionary file. The C2 domain used has been linked to a hosting provider known to service nation-state actors, suggesting a potentially sophisticated adversary.

US Indicts 31 More in ATM Jackpotting Ring Linked to Tren de Aragua Gang

A U.S. federal grand jury has indicted an additional 31 individuals for their participation in a widespread 'ATM jackpotting' conspiracy, bringing the total number of defendants to 87. The sophisticated scheme involved using malware to force ATMs to dispense large sums of cash. Many of the newly charged individuals are Venezuelan and Colombian nationals, including several identified members of the transnational criminal gang Tren de Aragua (TdA) who are in the U.S. illegally. The case highlights the growing convergence of organized crime and specialized cybercrime tactics.

Nova Ransomware Group Claims Cyberattack on KPMG Netherlands, Sets 10-Day Deadline

The Nova ransomware group has claimed responsibility for a cyberattack against the Netherlands division of global professional services firm KPMG. The claim, which appeared on ransomware monitoring services on January 23, 2026, alleges that the group successfully breached KPMG's systems and exfiltrated sensitive data. In a classic double-extortion tactic, the Nova group has reportedly set a ten-day deadline for KPMG Netherlands to enter into ransom negotiations before they potentially leak the stolen data. KPMG has not yet publicly confirmed the attack.

'Stanley' MaaS Sells Malicious Chrome Extensions Guaranteed for Web Store Publication

A new Malware-as-a-Service (MaaS) platform named 'Stanley' has appeared on Russian-language cybercrime forums, specializing in the sale of malicious Google Chrome extensions. A key feature of the service is a guarantee that the malicious extensions will be successfully published to the official Chrome Web Store, lending them an air of legitimacy. The primary purpose of these extensions is to facilitate phishing and credential theft by spoofing legitimate websites. The emergence of 'as-a-service' models like Stanley significantly lowers the barrier to entry for less sophisticated cybercriminals to launch effective attacks.

Mustang Panda APT Deploys Signed Kernel-Mode Rootkit to Hide Backdoor

The Chinese-linked cyber-espionage group Mustang Panda has significantly upgraded its stealth capabilities by using a signed kernel-mode rootkit to deploy its TONESHELL backdoor. Observed by Kaspersky, the rootkit, named 'ProjectConfiguration.sys', is signed with a leaked digital certificate from a Chinese tech company. By operating at the kernel level as a minifilter driver, the rootkit can effectively hide its malicious processes, files, and registry keys from security software. This new technique allows the group to inject its TONESHELL backdoor directly into the memory of legitimate processes like 'svchost.exe', enhancing its persistence and evasion in attacks targeting government organizations in Southeast Asia.

Illinois DHS Exposes Data of 700,000 Residents in Massive Misconfiguration Breach

The Illinois Department of Human Services (IDHS) has disclosed a major data breach affecting approximately 705,000 state residents. The breach was caused by incorrect privacy settings on internal planning maps that were inadvertently made public on a mapping website for up to four years. The exposed data includes addresses, case numbers, and medical plan information for Medicaid recipients, and names, addresses, and case details for customers of the Division of Rehabilitation Services. The exposure, which constitutes a HIPAA violation, was discovered in September 2025 but only announced in January 2026. IDHS has since secured the data and implemented new policies to prevent a recurrence.

Fortinet Confirms Active Exploitation of FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

Fortinet has confirmed that a critical Single Sign-On (SSO) authentication bypass vulnerability affecting FortiCloud is being actively exploited in the wild. The attacks, linked to CVE-2025-59718 and CVE-2025-59719, are reportedly successful even against fully patched FortiGate firewalls. Attackers are exploiting the flaw by sending specially crafted SAML messages to bypass authentication. Once inside, they are creating persistent administrative accounts, enabling VPN access, and exfiltrating firewall configurations. This allows for long-term persistence and deep network compromise. Customers are urged to review Fortinet's advisories and take immediate mitigation steps.

Microsoft Scrambles to Patch Actively Exploited Office Zero-Day, CISA Issues Urgent Directive

Microsoft has issued an emergency out-of-band security update for a high-severity zero-day vulnerability in Microsoft Office, tracked as CVE-2026-21509. The flaw, a security feature bypass with a CVSS score of 7.8, is being actively exploited in targeted attacks, allowing threat actors to bypass OLE mitigations via specially crafted Office files. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply the patch by February 16, 2026. The vulnerability affects multiple versions of Office, including Office 2016, 2019, LTSC 2021, and Microsoft 365 Apps for Enterprise.

Cyberattack Cripples Digital Services at Germany's Dresden State Art Collections

Germany's Dresden State Art Collections (SKD), one of Europe's most significant museum networks, has been hit by a cyberattack that caused widespread disruption to its digital infrastructure. The attack knocked out the SKD's online ticketing system, visitor services, museum shop website, and internal communications. On-site services were severely impacted, with ticket sales reverting to cash-only. While the operational disruption is significant, the SKD has stated that there is currently no evidence that any data, including sensitive collection or visitor data, was stolen during the incident. The attack highlights the increasing vulnerability of cultural institutions to cyber threats.

Widespread Phishing Campaign Abuses Microsoft Teams Guest Invites to Target 6,000+ Users

A large-scale phishing campaign is abusing Microsoft Teams' guest invitation feature to target thousands of users with fake billing notices. Researchers at Check Point have observed over 12,000 phishing emails sent to more than 6,100 users, primarily in the manufacturing, technology, and education sectors in the United States. Attackers create Teams groups with finance-related names and send guest invitations to targets. The invitation email, which comes from a legitimate Microsoft address, contains obfuscated text that appears to be a billing notification, lending it an air of authenticity and increasing the likelihood that a user will click the malicious link.

Everest Ransomware Leaks Data of 72 Million Under Armour Customers After Failed Talks

The Everest ransomware group has claimed a massive data breach against athletic apparel giant Under Armour. After negotiations allegedly failed, the group announced on its dark web leak site that it has published the full dataset, which it claims contains 191 million records, including 72.7 million unique email addresses. The compromised data reportedly includes sensitive customer information such as full names, phone numbers, physical locations, and purchase histories. This breach places a huge number of individuals at significant risk for targeted phishing campaigns, identity theft, and other fraudulent activities.

Zoom & GitLab Race to Patch Critical Flaws, Including a 9.9 CVSS RCE Bug

Both Zoom and GitLab have released critical security updates to address several high-severity vulnerabilities. The most severe flaw, CVE-2026-22844, is a remote code execution vulnerability in Zoom Node Multimedia Routers (MMRs) with a near-perfect CVSS score of 9.9. This flaw could allow an unauthenticated attacker with network access to compromise the devices. GitLab's updates address multiple vulnerabilities, including two high-severity flaws (CVE-2025-13927 and CVE-2025-13928) that could allow an unauthenticated user to cause denial-of-service conditions. Users of all affected products are urged to apply the patches immediately.

New 'Osiris' Ransomware Borrows TTPs from Medusa and Inc Gangs, Uses Signed Driver to Kill AV

A new ransomware strain named Osiris is demonstrating a high level of sophistication by combining tactics from established ransomware groups like Medusa and Inc. The attackers use Rclone for data exfiltration to Wasabi cloud storage and deploy a version of Mimikatz named `kaz.exe`, both TTPs linked to the Inc group. More significantly, Osiris uses a custom-developed and signed malicious driver, 'Abyssworker' (aka Poortry), in a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack to terminate security software. This driver and its loader, 'Stonestop,' have been previously associated with the Medusa ransomware gang. The use of these advanced, borrowed TTPs suggests Osiris is operated by experienced actors, possibly former affiliates of other groups.

Warning: Fully Patched FortiGate Firewalls Are Being Compromised via New SSO Bypass

Security analysts are warning of a new wave of attacks compromising even fully patched Fortinet FortiGate firewalls. The activity, observed since January 15, 2026, allows attackers to bypass SAML-based single sign-on (SSO) authentication to gain administrative access. The attacks result in unauthorized configuration changes, creation of persistent user accounts, and exfiltration of device configurations. Fortinet has reportedly identified a new, distinct attack path related to previously disclosed vulnerabilities (CVE-2025-59718, CVE-2025-59719), suggesting existing patches may not be fully effective.

New QuantumLeap Ransomware Demands $50M, Halts Global Shipments at NaviGistics

The global logistics firm NaviGistics has suffered a catastrophic cyberattack from a new ransomware strain dubbed 'QuantumLeap'. The attack, orchestrated by a group calling itself 'Entropy Collective', has encrypted critical systems and brought the company's worldwide shipping and freight operations to a standstill. The threat actors gained initial access via a compromised VPN account lacking multi-factor authentication, demonstrating a sophisticated lateral movement campaign before deploying the payload. The group is demanding a $50 million ransom and has threatened to leak over 2 terabytes of exfiltrated data, including sensitive customer and financial records. This incident highlights the extreme vulnerability of the global supply chain to targeted cyber-extortion and the devastating operational and financial impact of modern ransomware attacks.

Urgent Patch Required: Critical RCE Zero-Day (CVE-2026-12345) in NexusFlow API Gateway Under Active Attack

A critical pre-authentication remote code execution (RCE) zero-day vulnerability, CVE-2026-12345, is being actively exploited in the wild against the popular NexusFlow API Gateway. The flaw, which carries the maximum CVSS score of 10.0, allows unauthenticated attackers to gain complete control of vulnerable servers by sending a single, specially crafted HTTP request. Security firm Horizon Security Labs discovered the exploitation during a breach investigation. The vulnerability is wormable, creating a risk of rapid, widespread compromise. NexusFlow's parent company, Voltara, has released an emergency patch (version 3.8.1) and is urging all customers to update immediately. CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by February 9, 2026.

Medusa Ransomware Exploits Cybersecurity Gaps, Escalating Attacks Across Africa

Ransomware attacks are a pervasive and highly damaging threat across the African continent, where a significant cybersecurity skills and resources gap creates a fertile ground for cybercriminals. Notorious ransomware groups, including Medusa, are increasingly targeting organizations in the region, leveraging double extortion tactics to maximize pressure on their victims. These attacks involve not only encrypting critical data but also stealing it and threatening public release if the ransom is not paid. Key sectors such as healthcare, finance, and critical infrastructure are prime targets. According to reports, a high percentage of African organizations hit by ransomware end up paying the ransom, perpetuating the cycle of attacks. The situation underscores an urgent need for increased investment in cybersecurity infrastructure, skills development, and awareness across the continent.

Nation-State Actor 'SteelHydra' (APT47) Deploys 'GeoShifter' ICS Malware to Spy on Geothermal Energy Firms

The nation-state threat actor 'SteelHydra' (also tracked as APT47) is behind a sophisticated cyber-espionage campaign targeting the geothermal energy sector. According to research from Mandiant, the campaign has impacted firms in the United States, Canada, and Iceland. The attackers are using a novel, custom-built malware framework called 'GeoShifter', which is specifically designed to operate in Industrial Control System (ICS) environments and interface with SCADA/PLC systems from vendors like Siemens and Schneider Electric. The initial infection vector is a spear-phishing campaign that deploys a backdoor named 'PipeDreamer'. The ultimate goal of the campaign appears to be the theft of intellectual property and operational data related to geothermal technology, which could be used for economic advantage or to plan future disruptive attacks.

NPM Package 'js-utility-kit' Hijacked in Supply Chain Attack to Steal Crypto Keys and Credentials

A significant software supply chain attack has compromised the popular NPM package 'js-utility-kit', which is downloaded over 5 million times per week. Security firm Snyk discovered that malicious versions (2.1.8, 2.1.9, and 2.2.1) were published after the maintainer's account was hijacked via a credential stuffing attack. The compromised packages contained a post-install script that downloaded and executed a sophisticated information stealer. The malware was designed to steal cryptocurrency private keys, browser extension data for crypto wallets, and sensitive credentials such as environment variables and cloud provider CLI configurations from developers' machines and CI/CD pipelines. The NPM security team has removed the malicious versions, but any project that installed them between January 24 and 26 is considered compromised and requires immediate auditing and credential rotation.

Fintech Startup VoltPay Leaks 5 Million Customer Records via Misconfigured Cloud Database

The financial technology startup VoltPay has confirmed a massive data breach affecting approximately 5 million users. The leak was caused by a misconfigured Elasticsearch database that was left publicly accessible on the internet without a password for over three months. A security researcher discovered and reported the exposure. The leaked data includes highly sensitive information: full names, email addresses, phone numbers, physical addresses, dates of birth, hashed passwords, and full transaction histories. The last four digits of credit card and bank account numbers were also exposed. This incident, attributed to 'human error during a server migration', places millions of users at significant risk of identity theft and targeted phishing attacks, and has reportedly triggered investigations by U.S. and European regulators.

International Operation 'Echidna' Dismantles 'Crimson Market' Dark Web Hub, 50+ Arrested

A coordinated international law enforcement action, codenamed 'Operation Echidna', has successfully dismantled 'Crimson Market', one of the largest dark web marketplaces for cybercrime tools and stolen data. The operation, involving the FBI, Europol, and the UK's NCA, resulted in the seizure of the market's server infrastructure and the arrest of over 50 individuals worldwide, including its alleged administrator. Crimson Market was a key hub for selling billions of stolen credentials, malware-as-a-service (including ransomware and info-stealers), and phishing kits. The 18-month investigation involved undercover operations to trace cryptocurrency transactions. The takedown represents a major disruption to the cybercrime economy, and data from the seized servers is expected to lead to further arrests.

Volt Typhoon Linked to Breach at U.S. Water Utility, Exfiltrating Operational Documents

The Chinese state-sponsored group Volt Typhoon has been attributed to a data breach at the Park County Water District in Colorado. According to a joint advisory from CISA, the FBI, and the NSA, the hackers exploited a known vulnerability in an internet-facing network appliance to gain initial access. Consistent with their known TTPs, Volt Typhoon then used 'living off the land' techniques, leveraging built-in network administration tools to blend in and evade detection. The attackers moved laterally within the IT network and exfiltrated sensitive operational documents, including engineering schematics and maintenance schedules. While officials stated that the operational technology (OT) network and water supply were not affected, the incident highlights the group's continued focus on reconnaissance against U.S. critical infrastructure.

Researchers Detail 'ChronoStealer', a New Modular Info-Stealing Malware-as-a-Service

Security researchers at Check Point have published a deep-dive analysis of 'ChronoStealer', a new and highly modular information-stealing malware sold on a subscription basis in underground forums. This Malware-as-a-Service (MaaS) model allows low-skilled criminals to rent the sophisticated tool and its infrastructure for as little as $200 per month. ChronoStealer's core function is to steal credentials from over 50 web browsers and other applications. Its capabilities can be expanded with add-on modules for stealing cryptocurrency wallets, logging keystrokes, and capturing session cookies. The malware uses the Telegram API for C2 communications to better blend in with legitimate traffic. The rise of such user-friendly, powerful MaaS platforms represents a significant force multiplier for the cybercrime ecosystem.

Massive 149 Million Credential Leak Exposes Gmail, Facebook, and Financial Service Users

A publicly accessible, unencrypted 96 GB database containing 149.4 million unique login credentials has been discovered by a security researcher. The data, believed to be compiled from various infostealer malware logs and past breaches, impacts an estimated 48 million Gmail accounts, alongside users of Facebook, financial services, government portals, and numerous other online platforms. The leak includes usernames, passwords, and the direct login URLs, posing a significant risk of account takeover and fraud for millions of individuals globally.

Nike Probes Data Breach Claim by 'WorldLeaks' Extortion Group

Global apparel giant Nike has launched an investigation into a potential data breach after being listed as a victim by the 'WorldLeaks' data extortion group. The group, which emerged in 2025 and focuses on data theft without deploying ransomware, threatened to publish stolen Nike data on January 24. Nike has confirmed it is assessing the situation. The type and volume of the allegedly stolen data have not been disclosed by the attackers.

Phishing Campaign Hits Russia with Amnesia RAT, Uses GitHub and Dropbox for Payload Delivery

A sophisticated, multi-stage phishing campaign is targeting users in Russia, delivering a combination of the Amnesia remote access trojan (RAT) and ransomware. The attack, analyzed by Fortinet FortiGuard Labs, is notable for its use of public cloud services like GitHub and Dropbox to host payloads and its use of a tool called 'defendnot' to disable Microsoft Defender antivirus. The campaign relies on social engineering and abuse of native Windows features rather than software exploits to achieve system compromise.

Everest Ransomware Group Leaks 343GB of Under Armour Customer Data

The Russia-linked Everest ransomware group has leaked 343 GB of data allegedly stolen from global sportswear brand Under Armour. The massive data dump, which occurred on January 24, 2026, followed a failed extortion attempt. The leaked data is reported to contain the personally identifiable information (PII) of millions of customers, highlighting the 'double extortion' tactic where data publication is the primary threat. Under Armour has not yet commented on the incident.

Trend Micro Details New RCE Flaw in MetaGPT (CVE-2026-0761)

Trend Micro has published details and a detection rule for a new high-severity remote code execution (RCE) vulnerability in Foundation Agents MetaGPT, tracked as CVE-2026-0761. The exploit, which occurs over HTTP, can be leveraged by an attacker for initial access into a network or for lateral movement. Trend Micro has released DDI RULE 5627 to detect exploitation attempts and advises organizations to update security products and scan for signs of compromise.

Microsoft Issues Emergency Out-of-Band Patches for Flawed January Updates

Microsoft has released several emergency out-of-band (OOB) updates on January 24, 2026, to address significant bugs introduced by its January 13 Patch Tuesday release. The faulty updates caused a range of issues, including Remote Desktop connection failures, application hangs when accessing cloud storage like OneDrive, and system restart failures. The new cumulative updates, including KB5078136 and KB5078238, are available for various Windows versions and are intended to restore stability and functionality for affected users.

Pwn2Own Automotive: Hackers Earn $1M+ Exposing 76 Zero-Days in Tesla and Other Vehicle Systems

At the Pwn2Own Automotive 2026 event, security researchers earned over $1 million by successfully demonstrating 76 unique zero-day exploits against a range of modern vehicle systems. A major focus was Tesla, where researchers chained multiple vulnerabilities to gain root access to an infotainment system, accounting for $516,500 of the total prize money. The competition also targeted EV chargers and other in-vehicle infotainment (IVI) systems, highlighting the expanding and critical attack surface of the connected automotive industry. Vendors have been given a 90-day disclosure deadline to patch the flaws.

LastPass Users Targeted in Phishing Campaign to Steal Master Passwords

Password manager service LastPass is warning its users of an active phishing campaign aimed at stealing their master passwords. Attackers are sending fraudulent emails that impersonate official LastPass maintenance alerts, creating a false sense of urgency to trick users into 'backing up' their password vaults. The links in these emails lead to a convincing but malicious clone of the LastPass login page designed to capture user credentials. LastPass has confirmed it is working to take down the attacker infrastructure and advises users to be vigilant.

DragonForce Ransomware Claims Attack on U.S. Bank, Threatens Data Leak

The DragonForce ransomware group has claimed responsibility for a cyberattack against Uinta Bank, a community bank based in Wyoming, USA. In a post on their data leak site on January 23, 2026, the threat actors announced the breach and threatened to publish a "full dump" of the bank's data if negotiations are not initiated. This double extortion tactic, which involves both data encryption and data exfiltration, puts significant pressure on the victim organization. The incident underscores the ongoing threat ransomware poses to the financial services sector, regardless of the institution's size.

CISA Mandates Patching for Four Actively Exploited Flaws in Zimbra, Vite, and More

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active attack. The flaws affect a diverse range of products, including Synacor Zimbra Collaboration Suite (CVE-2025-68645), the Vite frontend framework (CVE-2025-31125), Versa Concerto SD-WAN (CVE-2025-34026), and the 'eslint-config-prettier' NPM package (CVE-2025-54313). Due to evidence of ongoing exploitation, Federal Civilian Executive Branch (FCEB) agencies are required to apply patches or mitigations by February 12, 2026. CISA strongly urges all organizations to prioritize remediation to defend against these immediate threats.

North Korean Hackers Lure Developers with Fake Job Interviews, Backdoor macOS via VS Code

State-sponsored threat actors from North Korea, including the Lazarus Group, are targeting software developers in a sophisticated campaign dubbed 'Contagious Interview.' According to Jamf Threat Labs, the attackers use fake job offers to entice developers, particularly in the crypto and fintech sectors, into cloning malicious repositories from GitHub and GitLab. The attack abuses a feature in Microsoft's Visual Studio Code (VS Code), where trusting a repository can automatically execute a hidden `tasks.json` file. This triggers a backdoor on macOS systems, establishing persistence, collecting system data, and opening a C2 channel for remote code execution.

PcComponentes Denies Data Breach, Blames Credential Stuffing for Account Takeovers

Spanish electronics retailer PcComponentes has denied claims of a massive data breach affecting 16 million customers, stating its internal systems were not compromised. The announcement came after a threat actor, 'daghetiaw,' attempted to sell a large customer database on a hacking forum. The company's investigation concluded the incident was a large-scale credential stuffing attack, where attackers used credentials stolen from other breaches to access user accounts. While denying the breach, PcComponentes confirmed that customer data such as names, addresses, and phone numbers were exposed for accounts with reused passwords. In response, the company has mandated two-factor authentication (2FA) for all users and invalidated all active sessions.

INC Ransomware OPSEC Fail: Reused Infrastructure Leads to Data Recovery for 12 U.S. Victims

A significant operational security (OPSEC) failure by the INC ransomware group has allowed cybersecurity firm Cyber Centaurs to recover stolen data for twelve U.S. organizations. The discovery was made after analyzing an attack involving the RainINC ransomware variant. Researchers found artifacts from the open-source backup tool, Restic, including hardcoded S3 access keys and passwords. By pivoting to this attacker-controlled infrastructure, Cyber Centaurs found that the gang had been reusing the same cloud storage repositories across multiple attacks, leaving the encrypted data of a dozen unrelated victims accessible. This rare win for defenders highlights how even sophisticated groups can make critical mistakes.

Anubis RaaS Ups the Ante with Destructive 'Wipe Mode' to Maximize Extortion

A new Ransomware-as-a-Service (RaaS) operation named Anubis is gaining attention for its destructive capabilities. Evolving from a prototype called 'Sphinx,' Anubis offers its affiliates a dual-execution model. In addition to standard encryption, the malware can be run with a `/WIPEMODE` parameter that irreversibly overwrites and destroys victim files, rendering them unrecoverable. This tactic fundamentally changes the extortion negotiation, as paying a ransom cannot restore the data. It indicates a strategy where attackers rely solely on the threat of leaking exfiltrated data for payment, using permanent data destruction as additional leverage. The group is targeting organizations opportunistically across the globe.

China-Linked APT 'UAT-8837' Targets North American Critical Infrastructure

A new report from Cisco Talos has identified a China-nexus Advanced Persistent Threat (APT) group, tracked as UAT-8837, actively targeting critical infrastructure organizations in North America since at least 2025. The group gains initial access by exploiting public-facing vulnerabilities, including a zero-day in SiteCore products (CVE-2025-53690), and using compromised credentials. Once inside, UAT-8837 employs a variety of open-source tools, such as the Earthworm utility for creating reverse tunnels, to conduct reconnaissance, exfiltrate data, and maintain persistence. Cisco Talos assesses with medium confidence that the group is linked to China, highlighting the ongoing threat of state-sponsored espionage against vital sectors.

New Zealand's 'Manage My Health' Portal Breached; Data of 120,000 Patients Held for Ransom

New Zealand's largest patient portal, Manage My Health, is responding to a significant data breach that occurred in late December 2025. An attacker using the alias 'Kazu' claims to have stolen over 400,000 files, including sensitive medical records like lab results and clinical notes, affecting up to 126,000 individuals. The attacker has demanded a $60,000 ransom. The breach originated from a vulnerability in the 'Health Documents' module of the application. Manage My Health has since closed the security gap and is working with New Zealand authorities, while the government has launched an urgent review of the incident.

Oracle's January 2026 Patch Update Fixes 337 Flaws, Including Critical Remote Exploits

Oracle has released its January 2026 Critical Patch Update (CPU), a massive security update containing 337 new patches for vulnerabilities across more than 30 product families. The update resolves approximately 230 unique CVEs, with the discrepancy due to shared components like third-party libraries affecting multiple products. Alarmingly, over 235 of the patched vulnerabilities can be exploited remotely without authentication, significantly increasing their risk. The update includes fixes for over two dozen critical-rated flaws, such as CVE-2025-66516, a 10.0 CVSS vulnerability in the Apache Tika library embedded in Oracle products. Oracle strongly urges customers to apply these patches without delay.

Cisco Scrambles to Patch Actively Exploited RCE Zero-Day in Comms Products

Cisco has issued an urgent warning and emergency patches for a critical remote code execution (RCE) vulnerability, CVE-2026-20045, affecting a wide range of its Unified Communications and Webex Calling products. This zero-day flaw is being actively exploited in the wild, allowing unauthenticated attackers to send crafted HTTP requests to the web management interface and execute arbitrary code, potentially leading to full root access on the underlying server. In response to the active threat, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by February 11, 2026. Cisco has confirmed there are no workarounds and is urging all customers to apply the updates immediately.

Exposed Security Training Apps Like OWASP Juice Shop Create Backdoors into Corporate Clouds

A new report reveals a dangerous trend where intentionally vulnerable security training applications, such as OWASP Juice Shop and DVWA, are being deployed on live, production cloud infrastructure and left exposed to the internet. Threat actors are actively scanning for and exploiting these misconfigured applications to compromise the cloud environments of numerous organizations, including Fortune 500 companies and security vendors. The exploits have been used to achieve remote code execution, deploy webshells, install cryptominers, and steal sensitive cloud credentials, turning these training tools into unmonitored backdoors.

'Skeleton Key' Attacks Bypass Defenses by Weaponizing Legitimate RMM Tools

A sophisticated attack campaign dubbed "Skeleton Key" is bypassing traditional, malware-focused security defenses by weaponizing legitimate remote monitoring and management (RMM) software. A report from KnowBe4 Threat Labs details how attackers first compromise user credentials and then abuse trusted IT tools to create persistent, stealthy backdoors inside enterprise networks. This 'living-off-the-land' (LotL) technique allows attackers to blend in with normal administrative activity, making their presence extremely difficult to detect and highlighting the need for security teams to shift focus from signature-based detection to behavioral analysis and identity security.

Spotlight on Supply Chain Risk: Reports Warn of Escalating SaaS-to-SaaS Attacks

The digital supply chain has become a primary focus of cyber risk, as highlighted by multiple events on January 22, 2026. A new report from security firm Black Kite warns that the retail and wholesale sectors are highly exposed to attacks that exploit interconnected IT systems and shared vendors. Concurrently, SaaS security leader Obsidian Security launched the industry's first end-to-end SaaS supply chain security solution to combat the growing threat of SaaS-to-SaaS attacks, where a compromise in one application (like Salesloft) can cascade to affect hundreds of integrated partner applications (like Drift). These developments underscore the urgent need for organizations to gain visibility and control over their sprawling, interconnected digital ecosystems.

osTicket Flaw Lets Attackers Read Server Files via Malicious PDF Export

A high-severity vulnerability, CVE-2026-22200, has been disclosed in osTicket, a popular open-source helpdesk system. The flaw allows an unauthenticated, anonymous attacker to read arbitrary files from the server by injecting a malicious PHP filter chain into a support ticket. When a privileged user exports the ticket to PDF, the vulnerability is triggered, embedding the contents of sensitive server files (like configuration files) into the generated PDF as a bitmap image. Researchers warn this flaw can be chained with other vulnerabilities for full remote code execution (RCE). Patches are available in versions 1.18.3 and 1.17.4.

Critical Flaw in Popular Node.js Library 'binary-parser' Allows Code Execution

The CERT Coordination Center (CERT/CC) has issued a warning about a critical vulnerability, CVE-2026-1245, in the popular 'binary-parser' npm library for Node.js. The flaw, which has a CVSS score of 6.5, allows for arbitrary JavaScript execution. The vulnerability exists because the library dynamically generates parser code from user-supplied input without proper sanitization, creating a code injection sink. This poses a significant software supply chain risk, as any application using the library to parse untrusted data could be compromised. Developers are urged to update to the patched version 2.3.0 immediately.

New Android Malware Uses AI to Mimic Human Behavior and Evade Detection

A new and sophisticated family of Android malware is leveraging artificial intelligence to commit ad fraud while evading detection. The malware uses TensorFlow, Google's open-source machine learning framework, to mimic human-like behavior, such as realistic clicks and swipes on hidden advertisements. This advanced technique allows it to bypass traditional ad fraud detection systems that rely on identifying the predictable, scripted patterns of bots. The malware can also stream video of its operations back to attackers, likely for model refinement, representing a significant evolution in mobile threat capabilities.

Critical GNU Inetutils Flaw Allows Root Access via Telnet Authentication Bypass

A critical authentication bypass vulnerability, CVE-2026-24061, has been disclosed in the telnet daemon (telnetd) of GNU Inetutils, a common package of networking utilities for many Unix-like operating systems. The flaw allows a remote attacker to bypass authentication and gain root access to the system simply by providing a specially crafted username. Successful exploitation, achieved by passing '-f root' as the USER environment variable, leads to a complete compromise of the machine. All versions of GNU Inetutils up to and including 2.7 are affected. Administrators are urged to disable the telnetd service immediately.

Everest Ransomware Claims 861GB Data Breach at McDonald's India

The Everest ransomware group has claimed a major cyberattack against McDonald's India, alleging the theft of 861 gigabytes of sensitive data. In a post on its dark web leak site on January 20, 2026, the group threatened to publicly release the information if a ransom is not paid. The compromised data reportedly includes a vast amount of personal information on customers and employees, as well as internal corporate documents. This incident, if confirmed, would be the latest in a series of data security issues for the fast-food giant's Indian operations, which suffered previous breaches. The Everest group, a Russian-speaking operation active since 2020, is known for its double-extortion tactics, and the potential leak of customer data poses a significant risk of identity theft and phishing campaigns.

Oracle Issues Critical Patch for CVSS 10.0 Auth Bypass in WebLogic Server

Oracle has released its January 2026 Critical Patch Update (CPU), a massive security release containing 337 fixes for vulnerabilities across its product portfolio. The most severe flaw addressed is CVE-2026-21962, a critical authentication bypass vulnerability in the Oracle WebLogic Server Proxy Plug-in with a CVSS score of 10.0. This vulnerability can be exploited remotely by a low-privileged attacker without user interaction, potentially allowing complete takeover of the affected component. The flaw impacts WebLogic Server Proxy Plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Oracle strongly urges customers to apply these cumulative patches immediately, highlighting the continued risk of exploitation of previously patched vulnerabilities due to slow enterprise adoption rates.

EU Moves to Ban High-Risk Tech Suppliers from 18 Critical Sectors

On January 20, 2026, the European Commission introduced a revised EU Cybersecurity Act (CSA 2) aimed at bolstering the bloc's supply chain security. The proposal establishes a framework to identify and exclude high-risk technology suppliers from 18 critical sectors, including energy and telecommunications. This move is widely interpreted as a measure to reduce dependency on Chinese technology providers. The act mandates the derisking of mobile networks by requiring operators to replace equipment from designated high-risk vendors within three years. It also aims to streamline the European Cybersecurity Certification Framework (ECCF) to make compliance faster and more accessible, particularly for SMEs, and strengthens the mandate of the EU's cybersecurity agency, ENISA.

RansomHub Hits Apple Supplier Luxshare, Claims Theft of R&D Data for Apple, Nvidia, and Tesla

The RansomHub ransomware group has claimed a significant data breach against Luxshare Precision Industry, a major Chinese electronics manufacturer and a critical partner for Apple, Nvidia, Tesla, and other tech giants. In a dark web post on January 21, 2026, the group alleged it had stolen and encrypted sensitive intellectual property, including 3D CAD models and engineering designs for products related to its high-profile clients. RansomHub threatened to leak the data, accusing Luxshare's IT department of attempting to hide the incident. Luxshare is a primary assembler for Apple's iPhone and Vision Pro. Independent analysis of sample data released by the attackers appears to confirm it contains confidential project details, validating the severity of this major supply chain breach.

Drones Emerge as Urgent Cyber Threat to Critical Infrastructure

A report published on January 21, 2026, by the University of Canberra and Cisco warns of the urgent and escalating cyber threat posed by drones to critical infrastructure. The study highlights that as drone technology becomes more advanced, accessible, and affordable, its potential for use in cyber warfare is growing significantly. Researchers found that drones can be used as platforms to launch sophisticated cyberattacks against targets like data centers and telecommunications networks, exploiting gaps in physical and cybersecurity defenses. The report stresses a significant disconnect between the current level of threat awareness among infrastructure operators and the real-world capabilities of modern drones, urging industries to integrate drone-related risks into their security and resilience programs.

NYDFS Enforces Stricter Cybersecurity Rules for Financial Firms

The New York Department of Financial Services (NYDFS) has now fully implemented the final amendments to its landmark Part 500 Cybersecurity Regulation. These changes impose significantly more prescriptive and stringent requirements on regulated financial and insurance entities. As of May 2025, firms are mandated to have automated vulnerability scanning, enhanced access controls, and robust logging and monitoring capabilities, including endpoint detection and response (EDR). The amendments also place a strong emphasis on proactive governance of third-party service providers, including cloud and AI vendors. With the rules now fully in effect in 2026, the NYDFS is expected to have lower tolerance for non-compliance and will likely intensify its cybersecurity examinations.

Ingram Micro Breach Exposes Data of 42,000 After Safepay Ransomware Attack

Global IT distributor Ingram Micro has officially notified 42,521 individuals that their personal and sensitive information, including Social Security numbers, was stolen during a ransomware attack in July 2025. The incident, attributed to the Safepay ransomware group, compromised employment and job applicant records. After Ingram Micro reportedly refused to pay the ransom, the threat actors published the stolen 3.5 terabytes of data on their dark web leak site.

CEOs Optimistic, CISOs Wary: Survey Reveals Deep Divide on AI's Cybersecurity Impact

A new survey by specialty insurer AXIS Capital, released on January 20, 2026, reveals a significant perception gap between CEOs and CISOs regarding the role of artificial intelligence in cybersecurity. While CEOs are largely optimistic about AI's productivity and security benefits, CISOs are more acutely aware of the new risks it introduces, including data leakage, model manipulation, and sophisticated AI-driven attacks. This disconnect could lead to misaligned security strategies and underinvestment in critical risk areas.

North Korean 'Konni' APT Weaponizes Google Ads to Deliver EndRAT Malware

The North Korean state-sponsored threat group Konni is conducting a sophisticated spear-phishing campaign dubbed "Operation Poseidon." The advanced persistent threat (APT) actor is weaponizing Google advertising URLs to make malicious links appear legitimate, thereby bypassing security filters and tricking users. The campaign's ultimate goal is to deliver the 'EndRAT' malware, a remote access trojan, onto victim systems.

Stealthy 'PDFSIDER' Backdoor Uses DLL Side-Loading to Bypass EDR and AV

Security researchers at Resecurity have uncovered a new stealthy backdoor, dubbed 'PDFSIDER,' that uses a DLL side-loading technique to evade EDR and antivirus solutions. The malware masquerades as a legitimate PDF application to load a malicious DLL, establishing an encrypted command-and-control channel for long-term, covert access. The backdoor is already being actively used by ransomware groups, including the notorious Qilin gang, for payload delivery.

South Korean Giant Kyowon Group Hit by Ransomware, 9.6 Million Accounts at Risk

The South Korean conglomerate Kyowon Group has confirmed it suffered a significant ransomware attack that disrupted operations and resulted in data exfiltration. The attack, detected on January 10, 2026, compromised approximately 600 of the company's 800 servers. South Korean authorities estimate that up to 9.6 million user accounts (representing 5.5 million unique individuals) may have been affected, as attackers reportedly exploited an open external port to gain initial access.

Fake Ad Blocker Crashes Chrome, Tricks Users into Installing 'ModeloRAT' Malware

A novel malware campaign dubbed "CrashFix" is using a malicious Google Chrome extension that impersonates the 'uBlock Origin Lite' ad blocker to intentionally crash victims' browsers. The attack, attributed to a group called 'KongTuke,' then uses social engineering, presenting a fake crash report that tricks users into running a PowerShell command to "fix" the issue. This command ultimately downloads and installs 'ModeloRAT,' a previously undocumented Python-based remote access trojan.

GTMaritime Launches 'GT Identify' to Tackle Maritime Cybersecurity and Compliance

Maritime technology firm GTMaritime has launched GT Identify, a new cybersecurity system designed to help ship operators comply with increasingly stringent regulations. Announced on January 20, 2026, the system provides fleet-wide hardware and software asset inventory, vulnerability reporting, and aligns with the NIST Cybersecurity Framework. The launch addresses the growing need for robust cyber risk management to meet IMO and IACS E26/E27 requirements.

Threat Landscape Converges as Attackers Target ICS and AI Systems

New research from Cyble highlights a dangerous convergence of threats, as both hacktivists and financially motivated cybercriminals are increasingly targeting Industrial Control Systems (ICS), Operational Technology (OT), and enterprise AI systems. The report, published January 20, 2026, notes that attackers are exploiting exposed HMI and SCADA systems while also leveraging AI to create polymorphic malware and more effective social engineering lures.

'DragonForce' Emerges as New Ransomware Cartel Built on LockBit and Conti DNA

A new Ransomware-as-a-Service (RaaS) operation named DragonForce has emerged, positioning itself as a "ransomware cartel." The group is reportedly building its operations on the leaked source code of the notorious LockBit 3.0 and Conti ransomware variants. Operating a RaaS platform called 'Ransombay,' DragonForce's strategy includes absorbing smaller rival operations, signaling a trend towards consolidation in the cybercrime ecosystem.

Weaponized Invites: Google Gemini Flaw Allows Calendar Data Theft via Prompt Injection

Security researchers from Miggo Security have uncovered a significant vulnerability in Google Gemini's integration with Google Calendar. The flaw allowed attackers to use an indirect prompt injection technique to exfiltrate summaries of private meetings. By sending a specially crafted calendar invitation containing a hidden malicious prompt, an attacker could trick the AI into executing unauthorized actions when the user made a legitimate query about their calendar. This attack bypassed Google's privacy controls without requiring the user to interact directly with the malicious payload, highlighting emerging security risks in applications integrated with large language models (LLMs).

Evelyn Stealer: New Malware Hits Developers Through Malicious VS Code Extensions

A new information-stealing malware, named Evelyn Stealer, is being distributed through malicious extensions on the Microsoft Visual Studio Code (VS Code) Marketplace. Researchers at Trend Micro and Koi Security report the campaign specifically targets software developers to steal credentials, cryptocurrency wallet data, and other sensitive information. Three malicious extensions—`BigBlack.bitcoin-black`, `BigBlack.codo-ai`, and `BigBlack.mrbigblacktheme`—have been identified as the distribution vectors. This supply chain attack highlights the significant risk posed by unvetted third-party tools in development environments, as compromising a single developer can provide a gateway into an entire organization's critical infrastructure.

Patch Now: Critical Flaw Exposes Thousands of TP-Link VIGI Cameras to Remote Hacking

TP-Link has issued urgent firmware updates for a critical vulnerability in its VIGI line of security cameras. The flaw could allow an unauthenticated remote attacker to gain unauthorized access to the devices, potentially viewing, modifying, or deleting surveillance footage. At the time of disclosure, researchers discovered over 2,500 VIGI cameras were exposed to the public internet and vulnerable to this attack. Owners are strongly advised to update their camera firmware immediately and ensure their devices are not directly accessible from the internet to mitigate the significant risk of compromise.

16.6 Million Records Exposed: Raaga and Pass'Sport Breaches Added to Have I Been Pwned

The Have I Been Pwned (HIBP) data breach notification service has been updated with over 16.6 million user records from two separate incidents. The first breach involves 10.2 million users of the Indian music streaming service Raaga, which occurred in December 2025 and exposed names, email addresses, and MD5-hashed passwords. The second breach affects 6.4 million users of the French government's Pass'Sport program, also from December 2025, exposing names, dates of birth, and email addresses. Users of these services are urged to check HIBP and change their passwords, especially for the Raaga breach, due to the high risk of credential stuffing attacks from the weakly hashed passwords.

ScarCruft APT: North Korean Hackers Evolve Tactics in 'Artemis' Campaign

The North Korean advanced persistent threat (APT) group ScarCruft, also known as APT37 or Reaper, has launched a new campaign dubbed 'Artemis'. Active since late 2025, the campaign targets entities likely in South Korea using malicious Hanword Word Processor (HWP) documents. Researchers report that ScarCruft has evolved its tactics, now employing steganography to hide malicious code within image files and leveraging legitimate cloud services, specifically Yandex Cloud, for its command and control (C2) infrastructure. This shift makes the group's activities harder to detect, as their C2 traffic blends in with legitimate cloud service activity.

Manhunt: Black Basta Ransomware Leader Added to EU's Most Wanted List After Raids

An international law enforcement operation has targeted the prolific Black Basta ransomware group, which is linked to over 600 attacks and millions in ransom payments. Police in Ukraine conducted raids against two suspected members of the syndicate. Concurrently, an international arrest warrant and an INTERPOL Red Notice have been issued for a Russian national believed to be the group's founder and leader. The individual has been placed on the EU's Most Wanted list, signaling a high-priority, coordinated effort to dismantle one of the world's most active ransomware operations.

Public Exploits Released for Critical SQLi and RCE Flaws in Business Software

Multiple critical and high-severity vulnerabilities have been disclosed in various business software products, with proof-of-concept (PoC) exploits made public, elevating the risk of immediate attack. A critical SQL injection flaw (CVE-2026-1179) affects Yonyou KSOA 9.0. A critical command injection vulnerability (CVE-2026-1192) was found in Tosei Online Store Management System 1.01. Additionally, a high-severity improper authorization bug (CVE-2026-1193) impacts MineAdmin. Since vendors reportedly did not respond before disclosure, users of these products are urged to apply immediate mitigations to prevent compromise.

Access Broker Pleads Guilty After Selling Access to 50 Companies to Undercover FBI Agent

A Jordanian national has pleaded guilty in a U.S. court for his role as an Initial Access Broker (IAB) in the cybercrime ecosystem. The man admitted to compromising and selling unauthorized access to the corporate networks of approximately 50 different enterprise organizations. The operation was uncovered when he unknowingly sold this access to an undercover U.S. federal agent. The case highlights the critical role IABs play in the cybercrime supply chain, providing the initial foothold for major threat actors like ransomware groups, and demonstrates the effectiveness of law enforcement sting operations in disrupting these criminal enterprises.

Warning: Malicious Chrome Extensions Hijack Workday, NetSuite Sessions to Bypass MFA

Security researchers have uncovered five malicious Google Chrome extensions that impersonate legitimate add-ons for popular enterprise SaaS applications like Workday and NetSuite. The extensions are designed to perform session hijacking by stealing active session cookies and tokens after a user logs in. This technique allows attackers to completely bypass security controls, including multi-factor authentication (MFA), and gain full, authenticated access to the user's account. The stolen sessions can be used to exfiltrate sensitive corporate data, such as financial records and employee PII, highlighting the significant threat posed by unvetted browser extensions in corporate environments.

Healthcare Data Breaches Double, Fueled by 'Shadow AI' and Vendor Risk

The healthcare industry is facing a cybersecurity crisis, with a new report indicating that the number of data breaches doubled in the past year. The surge is being driven by two key factors: the unmanaged use of generative AI tools by staff, termed 'shadow AI,' and persistent, unmitigated risks from third-party vendors. This dangerous trend is exemplified by the McLaren data breach, where a ransomware attack compromised the sensitive health information of over 743,000 patients. The report highlights a lack of confidence within the sector to handle these evolving threats, urging organizations to gain visibility into AI usage and implement far more stringent vendor risk management programs.

2025 in Review: Simple Errors, Not 0-Days, Caused Biggest Breaches

A year-end analysis of 2025's major data breaches reveals a recurring theme: fundamental security failures, not sophisticated zero-day exploits, were the primary cause. The report, published on December 26, 2025, highlights cloud security misconfigurations and third-party supply chain attacks as the dominant root causes. High-profile incidents at McDonald's (default password '123456'), TalentHook (public Azure Blob storage), Harrods, and TransUnion (both breached via third-party vendors) serve as stark examples of how neglecting basic security hygiene leads to massive data exposure.

RedVDS Takedown: Microsoft and Law Enforcement Disrupt $40M Cybercrime-as-a-Service Operation

In a major international operation, Microsoft's Digital Crimes Unit, alongside law enforcement from the U.S., U.K., and Germany, has disrupted the RedVDS cybercrime-as-a-service (CaaS) platform. The service, operated by a group tracked as Storm-2470, provided criminals with cheap, disposable RDP servers used to launch large-scale phishing, BEC, and fraud campaigns. The operation, which took down key domains like redvds[.]com, has been linked to over $40 million in fraud losses in the U.S. and impacted more than 191,000 organizations globally.

NSA Kickstarts Zero Trust Adoption with New Foundational Implementation Guides

The U.S. National Security Agency (NSA) has released the first two documents in its new Zero Trust Implementation Guidelines (ZIGs) series. The 'Primer' and 'Discovery Phase' guides are designed to provide federal agencies and other organizations with a foundational roadmap for adopting a Zero Trust security architecture. This initiative aligns with the Department of War's mandate for agencies to achieve specific Zero Trust targets and emphasizes the critical first step of gaining comprehensive visibility across all data, applications, assets, and services (DAAS).

Infoblox to Acquire Axur, Expanding into AI-Powered External Threat Disruption

Infoblox, a leader in DNS security and network services, has announced a definitive agreement to acquire Axur, a company specializing in AI-driven external threat detection and takedown. The acquisition will extend Infoblox's preemptive security offerings, enabling customers to combat threats like phishing, brand abuse, and credential theft that originate outside the corporate network. By integrating Axur's rapid takedown capabilities with its own DNS-level controls, Infoblox aims to significantly reduce the uptime of active cyberattacks.

ColorTokens Xshield Platform Gains FedRAMP Moderate Authorization, Boosting Federal Zero Trust Adoption

ColorTokens has achieved FedRAMP Moderate Authorization for its Xshield microsegmentation platform, a significant milestone that makes the solution readily available to U.S. federal agencies via the FedRAMP Marketplace. This authorization validates Xshield's security posture and enables government bodies to adopt the platform to accelerate their Zero Trust initiatives, particularly in preventing the lateral movement of cyberattacks across complex on-premise, cloud, and OT environments.

Asimily Boosts Cisco ISE Integration with Enhanced Microsegmentation for IoT/OT Devices

Asimily, a provider of cyber asset and exposure management, has launched enhanced microsegmentation capabilities, including new support for Security Group Access Control Lists (SGACL) in Cisco Identity Services Engine (ISE). This integration allows organizations to translate rich device context—such as risk, behavior, and classification—from the Asimily platform into dynamically enforced security policies in Cisco ISE. The goal is to automate the containment of threats across complex IT, IoT, and OT environments.

SpyCloud Unveils Supply Chain Threat Protection to Combat Third-Party Identity Risks

SpyCloud has launched its Supply Chain Threat Protection solution, a new platform designed to give organizations visibility into identity-related compromises within their vendor and supplier ecosystems. By leveraging a massive repository of recaptured data from breaches and malware infections, the solution provides actionable intelligence on compromised credentials and infected devices affecting third parties. This allows security teams to move beyond static questionnaires and proactively address active threats within their supply chain.

Noction IRP v4.3 Launches with Automated DDoS Detection and Routing-Native Mitigation

Noction has released version 4.3 of its Intelligent Routing Platform (IRP), introducing a major new feature called Automatic Anomaly Detection (AAD). This capability uses behavior-based traffic analysis to rapidly identify DDoS attacks and other network anomalies. Once an attack is detected, the platform can automatically trigger mitigation actions using routing-native mechanisms like BGP FlowSpec or Remote Triggered Blackholing (RTBH), enabling network operators to respond to threats in seconds without relying on external systems.

JumpCloud Unveils AI-Powered Tools to Govern Shadow AI and Manage Autonomous Agents

JumpCloud has introduced a suite of AI-powered capabilities for its identity and access management (IAM) platform, designed to help organizations manage the security risks of modern AI adoption. The new features focus on discovering and governing 'shadow AI'—the unsanctioned use of AI tools by employees—and applying Zero Trust principles to manage access for non-human autonomous agents. The goal is to provide IT and security teams with the visibility and control needed to turn a potential liability into a secure source of productivity.

Acronis Debuts S3-Compatible Archival Storage for MSPs with Predictable Pricing

Acronis has launched Acronis Archival Storage, a new long-term, S3-compatible cold storage solution aimed at Managed Service Providers (MSPs) and their SMB clients. Powered by Seagate's Lyve Cloud, the service is integrated into the Acronis Cyber Protect Cloud platform and features a predictable pricing model with no egress or API fees. This addresses a key need for compliant, cost-effective data retention for large volumes of infrequently accessed data, offering WORM immutability and high durability.

Armis Revamps Channel Strategy with Flexible, Tier-Free 'Select Partner Program'

Armis, a leader in cyber exposure management, has launched its new Armis Select Partner Program. The revamped global channel initiative moves away from traditional, rigid tiers in favor of a flexible, three-route model: selling, delivering services, and building solutions. This approach allows partners to engage with Armis in a way that best suits their business model, aiming to accelerate the adoption of the Armis Centrix platform and build a more collaborative partner ecosystem.

Darktrace Hires Terry Doyle as First Chief Information Officer to Scale Enterprise IT

AI cybersecurity leader Darktrace has appointed Terry Doyle as its first-ever Chief Information Officer (CIO). Doyle, a veteran technology executive with nearly 30 years of experience, will join the executive committee and be responsible for consolidating the company's enterprise IT and data functions. This strategic hire aims to build enterprise-scale systems and processes to support Darktrace's rapid global growth and enhance its operational discipline.

AWS Patches 'CodeBreach' Flaw, Averting Massive GitHub Supply Chain Attack

Amazon Web Services (AWS) has remediated a critical vulnerability in its AWS CodeBuild service, dubbed 'CodeBreach' by Wiz researchers. The flaw, which stemmed from a misconfigured webhook filter, could have allowed unauthenticated attackers to inject malicious code into the build processes of major open-source projects, including the AWS JavaScript SDK. An exploit could have granted attackers administrative control over key GitHub repositories, creating a catastrophic supply chain risk for the millions of applications and cloud environments that depend on these libraries. The vulnerability was discovered following a separate, failed attack attempt, highlighting the real-world threat. AWS has since patched the issue and implemented global hardening measures.

Hacker Group 'HawkSec' Claims Breach of 184 Million TotalEnergies Records

A hacking group calling itself 'HawkSec' has claimed a massive data breach against the French energy supermajor, TotalEnergies. In a post on a data leak forum, the group alleged the theft of a database containing nearly 184 million records, including sensitive customer information such as names, email addresses, phone numbers, and bank account details for French customers. To substantiate their claims, HawkSec posted sample data on social media. However, the full extent and legitimacy of the breach remain unverified. TotalEnergies has not yet confirmed the incident. The group's erratic behavior on forums has led some researchers to question their experience, though the potential impact if the claims are true is significant.

Critical Flaw in WordPress Plugin 'Modular DS' Actively Exploited for Admin Takeover

A critical, unauthenticated privilege escalation vulnerability in the 'Modular DS' WordPress plugin is being actively exploited in the wild. The flaw, tracked as CVE-2026-23550 with a CVSS score of 10.0, affects over 40,000 websites. It allows attackers to bypass authentication and gain full administrator privileges by sending a specially crafted HTTP request. Security firm Patchstack, which discovered the exploitation, observed attackers creating rogue admin accounts named 'PoC Admin'. The vulnerability lies in the plugin's custom routing and login logic, which can be tricked into logging an unauthenticated user into an existing administrator account. The vendor released a patch in version 2.5.2, and all users are urged to update immediately.

Palo Alto Networks Patches High-Severity DoS Flaw in PAN-OS Firewalls

Palo Alto Networks has issued security updates to address a high-severity denial-of-service (DoS) vulnerability, CVE-2026-0227, in its PAN-OS software. The flaw, which has a CVSS score of 7.7, allows an unauthenticated, remote attacker to crash firewalls that have a GlobalProtect gateway or portal enabled. A successful exploit forces the device into maintenance mode, disrupting all network traffic. While Palo Alto Networks is not aware of active exploitation, a proof-of-concept (PoC) exploit reportedly exists. The vulnerability affects multiple versions of PAN-OS, and customers are urged to apply the patches as soon as possible, as there are no workarounds.

GlassWorm Malware Pivots to Attack macOS Developers via Malicious VS Code Extensions

The GlassWorm malware campaign has evolved, now specifically targeting macOS developers through malicious extensions for Visual Studio Code and OpenVSX. This new wave of attacks, detailed in a security digest from Acronis, uses a self-propagating worm to deliver its payload. The malware embeds an encrypted payload within JavaScript files, uses a 15-minute execution delay to evade sandboxes, and establishes persistence using LaunchAgents. The primary goal of GlassWorm is to steal a wide range of developer-centric data, including credentials for GitHub and npm, browser data, and information from over 50 different cryptocurrency wallets, highlighting a significant supply chain threat.

Central Maine Healthcare Breach Exposes Data of Over 145,000 Patients and Employees

Central Maine Healthcare (CMH) has disclosed a major data breach affecting 145,381 patients and employees. The incident involved an unauthorized third party maintaining access to its network for over two months, from March to June 2025. The compromised data includes highly sensitive personal, medical, and financial information, such as Social Security numbers and treatment details. CMH is offering complimentary credit monitoring services to those affected and has stated it is enhancing its security monitoring to prevent future incidents.

Massive Unsecured Database Leaks Personal, Health, and Financial Data of 45 Million French Citizens

Security researchers have discovered a massive, unprotected database on a cloud server containing the sensitive records of approximately 45 million French citizens. The data, which has since been secured, appears to be an aggregation from at least five separate breaches, compiled by a data broker or cybercriminal. The exposed archive included voter registration data, healthcare records, IBANs, and CRM contact information, creating comprehensive and dangerous profiles on a significant portion of the French population.

VoidLink: New Modular Linux Malware Framework Discovered Targeting Cloud and Container Environments

Security researchers at Check Point have discovered 'VoidLink,' a highly sophisticated and modular Linux malware framework. Written in the modern Zig programming language, VoidLink is purpose-built for espionage in cloud and containerized environments. It can detect if it's running in AWS, GCP, Azure, Kubernetes, or Docker and adapt its behavior. With a plugin-based architecture inspired by Cobalt Strike, it features advanced rootkit capabilities, an in-memory plugin system, and tools for credential theft from cloud services and Git repositories. Though not yet seen in the wild, its advanced design poses a significant future threat.

Microsoft Copilot Flaw Allowed Data Theft via "Reprompt" Session Hijacking Attack

Researchers discovered a significant vulnerability in Microsoft's Copilot AI assistant that allowed for a "Reprompt" attack, enabling threat actors to bypass safety features, hijack user sessions, and exfiltrate data. The flaw, which has been patched in the January 2026 security update, abused URL parameters to inject hidden, follow-up prompts that executed within the victim's authenticated session. This allowed attackers to chain commands and steal information without the user's knowledge, highlighting the security risks of AI assistants processing untrusted input.

CISA Mandates Patch for Exploited Windows Zero-Day Used in Attack Chains

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a zero-day vulnerability in the Windows Desktop Window Manager (CVE-2026-20805) by February 3, 2026. The medium-severity information disclosure flaw is being actively exploited in the wild as a crucial component in multi-stage attack chains, allowing attackers to bypass Address Space Layout Randomization (ASLR) and enable more severe exploits like remote code execution. The flaw was addressed in Microsoft's January 2026 Patch Tuesday update.

Spanish Energy Giant Endesa Hit by Massive Data Breach, 20M Records Allegedly For Sale

Spain's largest electric utility, Endesa, has confirmed a data breach after detecting unauthorized access to a commercial platform. The company admitted that customer PII, contact details, and bank account IBANs were potentially exposed. The situation is amplified by a threat actor on a cybercrime forum who claims to have stolen a 1.05 TB database containing the data of over 20 million people, which is now up for sale. Endesa, which serves over 10 million customers, is urging vigilance against phishing and fraud.

Pax8 Data Leak Exposes Sensitive MSP and Customer Info via Accidental Email

Cloud commerce marketplace Pax8 has confirmed a data exposure incident caused by human error. On January 13, an employee mistakenly sent an email containing a CSV file with sensitive, non-PII business data for approximately 1,800 Managed Service Provider (MSP) partners. The email, sent to fewer than 40 UK-based partners, exposed valuable information such as customer names, Microsoft license counts, pricing, and contract renewal dates, creating a significant risk of targeted phishing and competitive poaching.

CISA Warns of Critical Flaws in Rockwell & YoSmart ICS Equipment

CISA has released several Industrial Control Systems (ICS) advisories, warning of significant vulnerabilities in widely deployed equipment from Rockwell Automation and YoSmart. A high-severity SQL injection flaw (CVE-2025-12807) in Rockwell's FactoryTalk platform could allow for database takeover, while another flaw (CVE-2025-9368) can cause a denial-of-service condition. Separately, multiple flaws in YoSmart smart home hubs could permit remote device control and data interception, posing risks to both manufacturing and communications sectors.

Russian GRU Hackers (APT28) Evolve Credential-Harvesting Tactics

The Russian GRU-linked threat group BlueDelta, also known as APT28 or Fancy Bear, has been observed refining its credential-harvesting operations. According to research from Recorded Future, campaigns between February and September 2025 targeted energy, defense, and policy organizations in Europe and Eurasia. The group uses tailored spear-phishing emails, multi-stage redirection, and abuses low-cost, disposable infrastructure like ngrok and other free hosting services to enhance stealth and complicate attribution.

Russian Hackers Target Ukrainian Military with "PluggyApe" Malware

A Russian-linked hacking group, Void Blizzard (also known as UAC-0190), has been targeting the Ukrainian Defense Forces with a new cyber-espionage campaign. According to CERT-UA, the attacks, which occurred between October and December 2025, use a novel malware strain called PluggyApe. The campaign employs sophisticated social engineering, with attackers making direct contact with targets on secure messaging apps like Signal and WhatsApp, using charity-themed lures to build trust and deliver the malware.

ConnectPOS Exposed Admin GitHub Token for Over Four Years, Creating Massive Supply Chain Risk

Point-of-sale vendor ConnectPOS exposed a GitHub Personal Access Token (PAT) with full administrative privileges in its public documentation for over four years, from September 2021 until its discovery in January 2026. The blunder, found by security firm Sansec, put the vendor's entire software supply chain at risk. An attacker could have used the token to inject malicious code, such as a payment card skimmer, into the POS software, which would then be distributed to its 12,000+ customers, including major brands like Asus and Indiana University.

Microsoft's January 2026 Patch Tuesday Fixes 114 Flaws, Including One Exploited Zero-Day

Microsoft has released its first Patch Tuesday of 2026, a substantial update that addresses 114 security vulnerabilities across a wide range of its products, including Windows, Office, Azure, and SharePoint. The release includes fixes for eight critical remote code execution (RCE) vulnerabilities and, most notably, one moderate-severity information disclosure zero-day (CVE-2026-20805) that is confirmed to be actively exploited in the wild. This makes it the third-largest January update on record, urging administrators to prioritize deployment.

Ransomware Evolves: Groups Recruit Insiders, Add DDoS as Profits Fall

The ransomware landscape is undergoing a significant evolution heading into 2026. Despite a 47% surge in publicly reported attacks in 2025, analysis from Recorded Future shows that overall profits for threat actors have declined. This financial pressure is forcing a tactical shift. Key trends to watch for include the bundling of DDoS services with ransomware to increase victim coercion, a more aggressive focus on recruiting corporate insiders to gain initial access, and a notable globalization of new ransomware groups emerging outside of the traditional Russian sphere of influence.

Urgent Patch: CISA Adds Actively Exploited Gogs RCE Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical path traversal vulnerability, CVE-2025-8110, in the Gogs self-hosted Git service to its Known Exploited Vulnerabilities (KEV) catalog. This flaw, which allows for remote code execution (RCE) via symlink manipulation, is confirmed to be actively exploited in the wild. With a CVSS score of 8.7, it bypasses a previous patch for CVE-2024-55947. Federal agencies are mandated to remediate by February 2, 2026. The vulnerability affects an estimated 1,600 internet-exposed Gogs servers, posing a significant risk to organizations using the platform for source code management.

Poetic Justice: BreachForums Hacked, Database of 324,000 Cybercriminals Leaked

In a significant turn of events for the cybercrime community, the user database for the notorious hacking marketplace BreachForums was leaked online on January 9, 2026. The dump contains sensitive records for 323,986 users, including usernames, email addresses, IP addresses, private messages, and Argon2-hashed passwords. The breach, allegedly occurring in August 2025 and claimed by an individual named "James," represents a major operational security failure and provides a trove of intelligence for law enforcement agencies seeking to identify and prosecute threat actors like 'IntelBroker' and 'ShinyHunters' who were active on the forum.

Oregon DEQ Kept Data Breach of 4,800 People Secret for Nine Months

The Oregon Department of Environmental Quality (DEQ) confirmed on January 13, 2026, that a cyberattack in April 2025 exposed the personal data of approximately 4,800 people. The agency opted not to issue a broad public disclosure, citing that Oregon law did not require it, and instead began sending notification letters to affected individuals in late December 2025, over eight months after the incident. The initial attack, which the Rhysida ransomware gang later claimed, caused significant operational disruption. The delay in notification has drawn criticism and raises questions about the agency's transparency and incident response process.

French Immigration Agency Data Leaked via Third-Party Breach

France's Office for Immigration and Integration (OFII) has confirmed a data breach originating from a compromised third-party service provider. In early January 2026, a hacker claimed to be selling a database of up to 2.1 million records of foreign residents on BreachForums, posting samples that included names, contact details, and nationalities. OFII clarified that its own systems were not breached, but that the attack targeted a private training provider responsible for mandatory integration courses. The incident highlights the significant risks of supply chain attacks for government agencies and could lead to GDPR penalties for OFII as the data controller.

G7 Urges Financial Sector to Prepare for Quantum Computing Threat

The G7 Cyber Expert Group (CEG), co-chaired by the U.S. Department of the Treasury and the Bank of England, has issued a public statement and roadmap advising the global financial sector to begin a coordinated transition to quantum-resilient technology. The guidance warns that advanced quantum computers will eventually be able to break the public-key cryptography that secures the world's financial transactions. The roadmap encourages financial institutions to start assessing their quantum risks and developing formal plans for migrating to post-quantum cryptography (PQC) standards, such as those being developed by NIST, to counter 'harvest now, decrypt later' attacks.

Supply Chain Attack: Malicious npm Packages Steal Credentials from n8n Automation Platform

A novel supply chain attack discovered by Endor Labs is targeting users of the n8n workflow automation platform. Attackers are publishing malicious packages to the npm registry, disguised as legitimate 'community nodes' for popular services. When an unsuspecting user installs one of these nodes and enters their credentials (e.g., OAuth tokens, API keys), the malicious code exfiltrates the entire credential store from the n8n instance to an attacker-controlled server. This gives the attackers access to all services connected to the victim's n8n workflows, such as Salesforce and Stripe, creating a significant risk of widespread data breaches and financial fraud.

Cyber-Fraud Now Top Global Threat, Surpassing Ransomware, WEF Report Finds

The World Economic Forum's (WEF) 'Global Cybersecurity Outlook 2026' report, produced with Accenture, reveals a major shift in the threat landscape: cyber-enabled fraud and phishing have now surpassed ransomware as the top concern for global business leaders. The report highlights that fraud has reached 'record highs,' with 77% of leaders reporting an increase. It also identifies Artificial Intelligence as the most consequential force shaping cybersecurity in 2026, with 94% of leaders agreeing it will be the biggest factor. AI is seen as a double-edged sword, accelerating both offensive capabilities and defensive solutions, while growing concerns about data leaks from generative AI persist.

GoBruteforcer Botnet Exploits Weak Credentials on Linux Servers to Target Crypto Wallets

A modular Go-based botnet named GoBruteforcer is actively compromising internet-facing Linux servers by brute-forcing weak credentials for services like FTP, MySQL, and PostgreSQL. According to Check Point Research, the campaign's success is fueled by the widespread use of default or weak passwords, often found in AI-generated server deployment examples. Once compromised, servers are added to an IRC-controlled botnet and used to scan for more victims. The attackers have a clear financial motive, as they have been observed deploying tools on compromised hosts to scan for and drain TRON and Binance Smart Chain cryptocurrency wallets.

High-Severity Code Injection Flaw in Open WebUI (CVE-2025-64496) Allows RCE

A high-severity vulnerability, tracked as CVE-2025-64496, has been discovered in Open WebUI, a popular self-hosted interface for large language models (LLMs). The flaw, found by Cato Networks, allows a malicious AI server to inject arbitrary JavaScript code into a user's browser session. This can be exploited to steal authentication tokens and take over the user's account. If the compromised user has specific permissions enabled, the vulnerability can be escalated to achieve full remote code execution (RCE) on the host server. The issue affects Open WebUI versions 0.6.34 and older and was patched in version 0.6.35.

Iran's MuddyWater APT Unveils 'RustyWater' RAT in Middle East Espionage

The Iranian state-sponsored advanced persistent threat (APT) group MuddyWater, also known as Mango Sandstorm and TA450, has been observed deploying a new, custom-built Remote Access Trojan (RAT) named 'RustyWater'. According to research from CloudSEK, this new implant, written in the Rust programming language, is being used in a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities across the Middle East. The shift to a Rust-based tool marks a significant evolution in the group's capabilities, aimed at enhancing stealth and evading detection during long-term espionage operations.

Qilin Ransomware Hits French Infra Giant Bouygues, Claims 80GB Data Theft

The prolific Qilin ransomware group has listed French multinational infrastructure firm Bouygues Energies & Services as its latest victim on its dark web leak site. The group claims to have exfiltrated 80 GB of highly sensitive data, comprising 31,000 files. Most alarmingly, the threat actors allege the stolen data includes documents related to industrial control systems (ICS), such as SCADA interfaces and network plans for critical infrastructure projects like tunnels and tramways. This attack highlights the severe risk ransomware poses to physical safety and national security, extending beyond simple data encryption.

Apex Legends 'Remote Control' Hack Patched After Streamers Hijacked

Respawn Entertainment, the developer of the popular battle royale game Apex Legends, rapidly deployed a patch on January 10, 2026, to fix a significant security exploit. The vulnerability allowed a malicious actor to remotely take control of other players' characters during a live match, an incident that affected several high-profile streamers. The developer was quick to reassure the community that the exploit was not a Remote Code Execution (RCE) vulnerability, meaning attackers could not execute malicious code on victims' computers. The issue was resolved within a day of being publicly acknowledged.

Everest Ransomware Claims 900 GB Data Theft from Nissan

The Everest ransomware group has claimed a massive data breach against Japanese automotive giant Nissan Motor Co., Ltd. In a post on its dark web leak site on January 10, 2026, the group alleged it had stolen approximately 900 GB of sensitive corporate data. To back up its claim, Everest published screenshots showing internal directory structures and file names related to dealerships, finance, and audits. The group, which employs a double-extortion model, has given Nissan a five-day deadline to respond before it threatens to release the data publicly. Nissan has not yet officially confirmed the breach.

High-Severity Flaw in Mailpit Dev Tool Allows Email Interception

A high-severity vulnerability, tracked as CVE-2026-22689, has been discovered in Mailpit, a popular email testing tool for developers. The flaw is a Cross-Site WebSocket Hijacking (CSWSH) issue affecting all versions prior to 1.28.2. It allows a remote attacker to intercept sensitive data, including the full content of test emails, by tricking a developer running a vulnerable Mailpit instance into visiting a specially crafted malicious website. Users are strongly urged to upgrade to the patched version to mitigate the risk of data exposure.

French Bank Customers Hit by 'Quishing' Scam Using Fake Physical Cards

A highly deceptive phishing campaign, dubbed 'quishing,' is targeting bank customers in France using a blend of physical and digital tactics. Scammers are sending official-looking letters by postal mail that contain a high-quality counterfeit bank card. The letter instructs the recipient to 'activate' the new card by scanning an included QR code. This QR code directs the victim to a fraudulent website designed to mimic their bank's portal, where their banking credentials and personal information are harvested. This hybrid attack method is effective at bypassing traditional email security filters.

Texas Health System Breach Exposes Data of Over 34,000 Patients

Vida Y Salud Health Systems Inc., a nonprofit health center serving rural communities in South Texas, has reported a data breach that exposed the sensitive personal and medical information of 34,504 patients. The organization detected unauthorized access to its network in October 2025, where an attacker copied files containing names, Social Security numbers, driver's license numbers, and protected health information (PHI). Vida Y Salud is notifying affected individuals and offering complimentary credit monitoring services as law firms begin to investigate the incident.

Financial Sector Warned of Systemic Supply Chain Risk and 'Indirect Ransomware'

A new threat intelligence report for 2025-2026 reveals a perilous cyber landscape for the financial sector, dominated by systemic supply chain risks and evolving ransomware tactics. Citing data that 97% of U.S. banks were breached via third-party suppliers in 2024, the report underscores the critical vulnerability posed by partners. It also highlights the rise of 'indirect ransomware,' where attackers compromise a supplier to bypass a bank's defenses. Geopolitical threats also persist, with pro-Russian hacktivists targeting European banks and the North Korean Lazarus Group remaining a primary state-aligned threat.

YARA-X Update Helps Analysts Avoid Flawed Detection Rules

Version 1.11.0 of YARA-X, a popular tool for malware analysis, has been released with a key enhancement aimed at improving the accuracy of detection rules. The update introduces 'hash function warnings,' a feature that alerts security analysts when they make common errors in hash string comparisons, such as providing a SHA1 hash where a SHA256 hash is expected. This quality-of-life improvement helps prevent silent false negatives, where a flawed rule fails to detect malware without providing any error, thereby strengthening threat hunting and security operations.

Chinese State Hackers 'Salt Typhoon' Breach U.S. Congressional Committee Emails

The Chinese state-sponsored hacking group known as Salt Typhoon has reportedly compromised the email systems of staff members for several key U.S. House of Representatives committees. The cyberespionage campaign, detected in December 2025, targeted aides on influential panels including those overseeing China, foreign affairs, intelligence, and armed services. While lawmakers' personal accounts are not believed to have been accessed, the infiltration of staff networks raises significant national security concerns about the potential for long-term intelligence gathering from sensitive, unclassified communications. Salt Typhoon is a known actor with a history of targeting U.S. critical infrastructure.

Cisco Patches Medium-Severity Flaws in Snort 3 Engine That Could Lead to DoS and Data Leaks

Cisco has disclosed two medium-severity vulnerabilities, CVE-2026-20026 and CVE-2026-20027, in its widely used Snort 3 detection engine. The flaws exist in the processing of DCE/RPC traffic and can be triggered by a remote, unauthenticated attacker. CVE-2026-20026 (CVSS 5.8) is a use-after-free issue that could cause the engine to crash, leading to a denial-of-service. CVE-2026-20027 (CVSS 5.3) is an out-of-bounds read that could leak sensitive memory data. The vulnerabilities affect numerous Cisco products, including Secure Firewall, IOS XE with UTD, and Meraki MX appliances. Patches are available for some products, but others are pending.

Google Patches High-Severity Chrome Flaw That Could Allow Attackers to Bypass Security Policies

Google has issued a security update for its Chrome browser, patching a high-severity vulnerability tracked as CVE-2026-0628. The flaw, which affects Chrome on Windows, macOS, and Linux, is described as an "insufficient policy enforcement" issue within the WebView component. An attacker could exploit this by tricking a user into installing a malicious extension, which could then bypass security controls to execute unauthorized code on normally protected browser pages. This could lead to data theft or session hijacking. While there is no evidence of active exploitation, Google urges all users to update to the patched versions immediately.

Online Betting Giant BetVictor Discloses Major Data Breach, Customer Data Compromised

BetVictor, a major European online gambling company, has officially disclosed a significant data breach that compromised sensitive customer information. The security incident was first detected on January 8, 2026, during routine security audits and has caused unspecified operational disruptions. The company has not yet detailed the nature of the attack or the exact types of data accessed. An investigation is underway as BetVictor works to secure its systems and manage the fallout, which could include regulatory scrutiny and a loss of customer trust in the highly competitive online gaming market.

Data of 17.5 Million Instagram Users Leaked on Hacker Forum After Scraping Attack

The personal data of approximately 17.5 million Instagram users has been leaked on the BreachForums hacking forum. The data, posted by a user named 'Solonik,' was allegedly obtained via automated data scraping from public APIs. The leaked information includes full names, email addresses, phone numbers, and user IDs, exposing the affected individuals to a high risk of targeted phishing, identity theft, and SIM swapping attacks. Following the leak, users have reported a surge in fraudulent password reset attempts. As of January 10, 2026, Instagram's parent company, Meta, has not formally acknowledged the incident.

Critical OpenSSH Flaw Exposes Moxa Industrial Switches to Remote Code Execution

Industrial networking vendor Moxa has issued a security advisory for a critical vulnerability, CVE-2023-38408, affecting its EDS-G4000 and RKS-G4000 series industrial Ethernet switches. The flaw resides in the OpenSSH service integrated into the device firmware and could allow a remote attacker to execute arbitrary code. These switches are commonly used in critical infrastructure and industrial control systems (ICS), making the vulnerability particularly high-risk. The Canadian Centre for Cyber Security has echoed the warning, and both organizations are urging administrators to apply the provided firmware updates immediately to mitigate the threat.

HPE OneView Flaw Scores Perfect 10.0, Grants Attackers 'Keys to the Kingdom'

Hewlett Packard Enterprise (HPE) has disclosed CVE-2025-37164, a critical unauthenticated remote code execution vulnerability in its OneView infrastructure management software. The flaw, rated with a maximum CVSS score of 10.0, allows a remote attacker to gain complete control of the centralized management appliance without any credentials. Given OneView's extensive privileges over servers, storage, and firmware, a successful exploit could lead to a catastrophic compromise of an organization's entire infrastructure. CISA has added the vulnerability to its KEV catalog, mandating immediate patching for federal agencies.

FBI: North Korea's Kimsuky APT Using 'Quishing' to Bypass MFA

The U.S. Federal Bureau of Investigation (FBI) has issued a formal advisory warning that the North Korean state-sponsored threat group Kimsuky (also known as APT43) is actively using malicious QR codes in spear-phishing emails. This tactic, dubbed 'quishing,' is designed to bypass traditional email security by tricking users into scanning the code with a personal mobile device. The goal is to harvest credentials and session tokens from high-value targets in government, academic institutions, and think tanks, effectively bypassing multi-factor authentication (MFA) through session hijacking.

London Councils Hit by Major Cyberattack, Resident Data Exposed

A significant cyberattack targeting a shared IT system used by multiple London councils has resulted in a data breach exposing the sensitive personal information of thousands of residents. The incident, which affected Kensington and Chelsea Council among others, has caused widespread service disruptions and has triggered an investigation by the UK's National Cyber Security Centre (NCSC) and the Metropolitan Police. The attack highlights the systemic risks associated with interconnected IT platforms in the public sector, where a single point of failure can have cascading consequences.

Critical 9.8 CVSS RCE Flaw Hits Trend Micro Apex Central

Trend Micro has released patches for multiple vulnerabilities in its on-premise Apex Central security management console, including a critical remote code execution (RCE) flaw, CVE-2025-69258, with a CVSS score of 9.8. The vulnerability allows an unauthenticated remote attacker to load a malicious DLL and execute code with SYSTEM-level privileges. The flaw resides in the 'MsgReceiver.exe' component listening on TCP port 20001. Two other high-severity denial-of-service flaws were also fixed. Customers are urged to update to Build 7190 or later.

Qilin Ransomware Gang Claims Attack on Italian Manufacturer Cressi

The prolific Russia-linked Qilin ransomware gang has claimed responsibility for a cyberattack on Cressi, a major Italian manufacturer of diving and water sports equipment. The claim was posted on the group's darknet leak site. As of January 9, 2026, the gang has not leaked any stolen data or set a public ransom deadline, which is a common extortion tactic. Cressi has not yet commented on the allegation. The Qilin group is one of the most active ransomware operations, known for targeting manufacturing and healthcare sectors and for its high-profile attacks in 2025.

CISA Issues Six New Advisories for Hitachi and Mitsubishi ICS Flaws

On January 8, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released six new Industrial Control Systems (ICS) advisories. The alerts detail vulnerabilities discovered in products from Hitachi Energy and Mitsubishi Electric. These products, including the Hitachi Energy Asset Suite and Mitsubishi Electric's ICONICS Digital Solutions, are widely deployed across multiple critical infrastructure sectors, with a specific mention of the Energy sector. CISA is urging organizations using this equipment to review the advisories and remediate the flaws to prevent potential disruption of industrial processes.

Cisco Patches Zero-Day Information Disclosure Flaw in ISE Platform

Cisco has patched a high-severity zero-day vulnerability, CVE-2026-20029, in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw could allow an authenticated, remote administrator to read arbitrary files from the underlying system. The vulnerability is due to improper parsing of XML in the web-based management interface. An attacker could exploit it by uploading a malicious file. Cisco has released software updates to address the issue and urges customers to apply them promptly to prevent sensitive data exposure.

Cyberattacks on Automotive and Logistics Supply Chains Skyrocket

A new report from Everstream Analytics reveals a dramatic escalation in cyberattacks targeting global supply chains. In 2025, the automotive manufacturing industry experienced a staggering 722% increase in cyber incidents compared to the previous year. The logistics industry was also heavily impacted, with attacks growing by 61%. The report identifies this surge in cyber warfare as a primary factor set to disrupt trade and logistics in 2026, alongside hybrid warfare, aging infrastructure, and the weaponization of trade regulations. This transforms supply chain risk from a cost issue to a major security challenge.

NZ Patient Portal Breach Exposes Health Records of 126,000

ManageMyHealth, New Zealand's largest online patient portal, has confirmed a significant data breach discovered on December 30, 2025. The cyberattack compromised the 'My Health Documents' module, exposing the sensitive medical records of between 108,000 and 126,000 users. A threat actor using the alias 'Kazu' has claimed responsibility, alleging the exfiltration of 108 gigabytes of data and issuing a ransom demand. Compromised information includes clinical notes, lab results, and hospital discharge summaries. ManageMyHealth has engaged cybersecurity specialists, notified authorities including the Office of the Privacy Commissioner, and obtained a High Court injunction to prevent the stolen data's distribution.

State-Sponsored "BRICKSTORM" Backdoor Targets VMware and Windows in Critical Infrastructure

CISA, the NSA, and the Canadian Centre for Cyber Security have released an updated report on BRICKSTORM, a sophisticated backdoor malware. The report links the malware to Chinese state-sponsored threat actors who are using it to compromise VMware vSphere and Windows environments, primarily within public sector and critical infrastructure organizations. BRICKSTORM is designed for long-term persistence, credential theft, and data exfiltration, posing a significant espionage threat to enterprise virtualization platforms.

Zero-Day in End-of-Life D-Link Routers Actively Exploited; No Patch Will Be Released

A critical zero-day command injection vulnerability, CVE-2026-0625, is being actively exploited in the wild, affecting multiple end-of-life (EOL) D-Link DSL router models. The flaw, rated 9.3 on the CVSS scale, allows unauthenticated remote attackers to execute arbitrary code by sending a malicious request to the 'dnscfg.cgi' endpoint. Exploitation has been observed since at least November 2025, with attackers using it for 'DNSChanger' style attacks. D-Link has confirmed the vulnerability but stated that since the affected products are discontinued, no security patches will be issued. Owners are strongly advised to immediately retire and replace the vulnerable devices to prevent compromise.

Black Cat Group Targets Notepad++ Users in Massive SEO Poisoning Campaign

The notorious Black Cat (ALPHV) cybercrime group is behind a large-scale SEO poisoning campaign that uses malicious advertisements and manipulated search results to distribute an information-stealing backdoor. The campaign targets users searching for popular software like Notepad++. Victims are lured to convincing fake download sites, which redirect them to a GitHub clone to download a trojanized installer. The malware uses DLL side-loading to execute its payload, which is capable of stealing browser credentials, cookies, and keystrokes. A report from CNCERT/CC and ThreatBook revealed the campaign was highly effective, compromising nearly 278,000 hosts in China in just two weeks.

Brightspeed Investigates Breach Claim by Crimson Collective Affecting 1M+ Customers

US fiber broadband provider Brightspeed is actively investigating a data breach claim made by the 'Crimson Collective' extortion group. The threat actors allege they have stolen a massive dataset containing the personally identifiable information (PII) of over one million customers, including names, addresses, phone numbers, and some payment data. The group, known for targeting AWS cloud environments, has threatened to leak the data if their demands are not met and has reportedly offered the dataset for sale. Brightspeed serves 20 states and has acknowledged the claim, stating it is working to determine its validity. The incident follows a pattern for Crimson Collective, which previously breached Red Hat.

CISA Warns of RCE Flaw in Hitachi Energy ICS Product