Major Incidents or Breaches

• Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
• Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
• LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17][19].
• The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
• Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
• The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Threat actors gained access to personal and protected health information affecting 1.4 million individuals in a breach at Xsolis, impacting data received from its clients ^[27].
• The JaredFromSubway Ethereum MEV bot suffered a $15 million theft after an attacker manipulated its opportunity-detection logic using fake cryptocurrency trading opportunities ^[15].
• Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed impact from the Klue hack ^[34].
• A large-scale credential harvesting campaign, dubbed FortiBleed, targeted Fortinet FortiGate devices using custom sniffers to steal authentication secrets, resulting in a database of over 86,000 confirmed working credentials ^[17][33].
• Thousands of outdated D-Link routers have been compromised and are now under the control of the AryStinger botnet, with no available security updates ^[36].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Multiple cybersecurity firms including HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium disclosed they were impacted by the Klue hack, which affected customers of the Klue platform ^[5].
• A data breach at Texas Parks & Wildlife, resulting from a compromise of a third-party license vendor, exposed personal information of approximately 3 million individuals ^[6].

Notable Threat Actor Activity

Major Incidents or Breaches

• Threat actors are exploiting a recently patched vulnerability in the Gravity SMTP WordPress plugin, which has approximately 100,000 installations. The flaw, tracked as CVE-2026-4020, allows attackers to expose API keys used for email delivery services, potentially leading to further compromise of affected sites ^[1].
• Hackers claim to have leaked stolen data from Madison Square Garden, indicating a potential data breach affecting the venue’s systems ^[4].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hackers exploited a vulnerability in the Klue Battlecards app integration to steal OAuth tokens, allowing unauthorized access to Salesforce customer data. The breach impacted several organizations, including cybersecurity firms such as Huntress and Recorded Future. The Icarus threat group has claimed responsibility for the attack, and Salesforce has disabled the Klue integration in response ^[9][10][24].
• The Texas Parks and Wildlife Department disclosed a data breach at its license system vendor, exposing personal information for over three million individuals, including driver’s license data ^[12].
• A large-scale credential theft campaign known as FortiBleed compromised credentials for approximately 86,000 Fortinet firewalls and VPN devices, representing about half of all internet-accessible Fortinet devices. CISA has issued warnings to Fortinet customers regarding ongoing malicious activity targeting FortiGate appliances ^[6][23].
• Operation Endgame, involving law enforcement agencies from the Netherlands, Canada, Germany, and the US, disrupted infrastructure associated with the SocGholish malware network and remediated nearly 15,000 infected WordPress sites ^[5][25].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
• Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17][29].
• Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
• Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
• Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13][21].
• Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
• International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19][36].
• Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
• A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors ^[11][18].
• Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident ^[24].
• Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data ^[34].
• Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games ^[32].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
• iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35][42].
• The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
• More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Council of Europe is investigating claims by the ShinyHunters extortion group that it has stolen and is threatening to leak 297 GB of data, including employee personal information ^[21][42].
• The Infinite Campus K-12 student information system suffered a data breach by ShinyHunters, resulting in the theft of personal information from more than 137,000 school staff accounts ^[26].
• Novo Nordisk, the pharmaceutical company behind Ozempic, disclosed that hackers breached its IT systems and accessed personal data ^[40].
• French government officials confirmed a breach of the Tchap messaging platform, affecting approximately 73,000 government accounts, with the attacker claiming theft of messages and user data ^[41].
• iRhythm Holdings, a digital healthcare company, reported a data breach in which hackers stole patients’ personal and health information from third-party-hosted business applications ^[16].
• Chinese espionage actors breached REDCap servers at a North American medical institution, deploying InfiniteRed malware to steal sensitive research data ^[24][29][37].
• Mackay Sugar, Australia’s second-largest sugar producer, was forced to shut down mills following a ransomware attack attributed to the group “The Gentlemen” ^[36].
• The University of Nottingham, a UK research university, experienced a cyber incident, as noted in a threat intelligence bulletin ^[44].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The ShinyHunters extortion group stole personal information from over 137,000 school staff accounts via a Salesforce data theft attack targeting the Infinite Campus K-12 student information system ^[8].
• The pharmaceutical company Novo Nordisk confirmed attackers breached its IT systems and accessed personal data stored on compromised infrastructure ^[17].
• The French government’s Tchap messaging platform was breached by a threat actor known as “Misere,” affecting approximately 73,000 government accounts. The attacker claims to have stolen messages and user data ^[18].
• ShinyHunters claimed responsibility for a breach of the Council of Europe, threatening to leak 297 GB of allegedly stolen data, including employee personal information ^[19].
• The state of Maine disabled its public data breach portal after fake VRChat and Discord data breach reports were submitted to the system ^[21].

Newly Discovered Vulnerabilities