Major Incidents or Breaches

• Microsoft attributed a year-long series of intrusions into corporate Salesforce environments to threat actors linked to the ShinyHunters data-extortion group, who gained access without exploiting technical vulnerabilities in the Salesforce platform ^[3].
• Japan’s largest taxi operator, Nihon Kotsu, shut down parts of its infrastructure following a cyberattack that compromised its systems ^[12].
• Lidl disclosed a data breach affecting customers in Germany, Belgium, and the Netherlands, resulting from a compromise at a third-party service provider ^[16].
• The Jscrambler npm package was backdoored with infostealer malware and downloaded nearly 1,500 times before being taken down ^[13].
• Google and Microsoft removed the ModHeader browser extension, used by 1.6 million users, after researchers discovered a hidden component collecting browsing history ^[5].
• The Cybersecurity and Infrastructure Security Agency (CISA) published details of a data leak caused by a contractor uploading internal credentials, including AWS Govcloud keys, to GitHub ^[26].
• Progress Software instructed customers to shut down ShareFile Storage Zone Controllers due to a credible security threat under investigation ^[35].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A data breach at Centers Laboratory has impacted 540,000 individuals. The WorldLeaks extortion group has claimed responsibility, stating they exfiltrated 720 GB of data from the healthcare testing and laboratory services provider ^[9].
• Progress has instructed customers to manually shut down ShareFile Storage Zone Controller servers due to an ongoing investigation into a credible security threat ^[8].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The jscrambler npm package was compromised, with its 8.14.0 release containing a preinstall hook that executes a Rust-based infostealer on installation, exposing developers and users to credential theft and other risks ^[1].

Newly Discovered Vulnerabilities

• Researchers identified a technique named ‘Ghostcommit’ that embeds prompt injection attacks within PNG images to bypass AI code reviewers and steal repository secrets, demonstrating a novel supply chain attack vector targeting AI-integrated development workflows ^[4].
• Wireshark version 4.6.7 was released to address 12 security vulnerabilities and 16 additional bugs in the network protocol analysis tool ^[6].
• An AI system uncovered a root-level vulnerability in the Linux kernel that had gone undetected for 15 years, highlighting a significant long-term risk in widely deployed operating systems ^[5].

Notable Threat Actor Activity

Major Incidents or Breaches

• Progress Software has instructed ShareFile customers to immediately shut down Windows Storage Zone Controllers due to a “credible external security threat” targeting these servers. The company is actively responding to the incident and has communicated directly with affected customers ^[5][20].
• Researchers uncovered that a cybercrime group left one of its servers exposed, revealing details about the WP-SHELLSTORM campaign, which has backdoored thousands of WordPress sites. The exposure included hacking tools, logs, and target lists ^[13].
• The Dutch National Police reported strong indications that Dutch hackers were involved in the February breach at telecommunications provider Odido ^[19].
• A data breach at AssuranceAmerica has affected 7 million individuals, as disclosed in a roundup of recent incidents ^[33].
• The US Department of Homeland Security (DHS) database was reportedly hacked, according to recent reports ^[33].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Japanese telecommunications company KDDI suffered a data breach affecting 12 million individuals after hackers exploited a zero-day vulnerability in a third-party system to gain access to a KDDI email platform used by ISPs ^[36].
• AssuranceAmerica reported a breach in which attackers accessed the driver’s license numbers and other personal information of approximately 6.9 million customers ^[42].
• Mount Royal University confirmed that data was stolen in a ransomware attack, with hackers accessing the internal network and deleting two drives containing employee, student, and university data ^[39].
• The OpenMandriva Linux project disclosed an attempted internal sabotage by a contributor following a dispute among project members ^[13].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• AssuranceAmerica disclosed a data breach affecting approximately 6.9 million drivers after attackers accessed its systems earlier this year, exposing sensitive driver records ^[15].
• Mount Royal University in Calgary confirmed a breach in which hackers accessed and deleted data from the university’s file storage systems, including employee, student, and university data ^[17][35].
• Accenture confirmed a data breach following hacker claims of source code theft. The company stated the incident was contained and did not impact operations or service delivery ^[40].
• Japanese telecommunications company KDDI reported a breach impacting 12 million individuals, caused by attackers exploiting a zero-day in a third-party system to access an ISP email system ^[32].
• Madison Square Garden was found to have maintained a database categorizing celebrities, including sensitive labels such as “LGBTQIA” and risk ratings, raising privacy and surveillance concerns ^[28].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online ^[17].
• A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data ^[31].
• A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories ^[10][27].
• Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates ^[15].
• A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel ^[19].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Attackers are actively exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, enabling remote code execution^[17].
• River Bank & Trust, a US financial institution, has experienced a data breach, with customer data exposed^[32].
• Armored Likho, an APT group, has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan using modular RATs and information stealers^[18][27].
• The NetNut residential proxy botnet, built on millions of hijacked devices and used by criminals, was disrupted through a coordinated operation involving Google, the FBI, and others^[35].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Researchers demonstrated a new attack, TrojPix, which enables data exfiltration from air-gapped systems by manipulating on-screen pixels to emit electromagnetic signals via video cables, allowing nearby receivers to capture sensitive information^[1].
• A vulnerability in the Opera GX browser allowed malicious websites to silently install add-ons which could then be used to steal data from pages visited by the user^[3].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A U.S. government entity paid approximately $1 million to the Kairos extortion group to prevent the public release of stolen files. The incident details were revealed via a leaked negotiation chat and case study^[1].

Newly Discovered Vulnerabilities

• Apple’s Hide My Email service was found to have a flaw that allows the exposure of users’ real email addresses, undermining the intended privacy protections^[4].

Notable Threat Actor Activity