Major Incidents or Breaches

• 7-Eleven suffered a data breach in April resulting in the compromise of personal information belonging to over 183,000 individuals. The ShinyHunters extortion group was responsible for the attack, which targeted the systems of the convenience store chain^[7][25].
• The Oncology Institute disclosed a data breach caused by a third-party vendor, with the specific vendor not named^[20].
• Radiology Associates of Richmond experienced a data breach affecting 266,000 individuals, with threat actors stealing files containing names and protected health information^[21].
• DocketWise reported a data breach impacting 143,000 people, involving the compromise of names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories^[24].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Over 5,500 GitHub repositories were compromised in the ‘Megalodon’ supply chain attack, where malicious actors used fake automated commits to inject GitHub Actions workflows containing payloads designed to steal credentials, CI secrets, keys, and tokens ^[6].
• A large-scale exploitation campaign is targeting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, enabling attackers to inject malicious JavaScript code and initiate ClickFix attack flows ^[2].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A coordinated supply chain attack has compromised eight packages on Packagist, infecting them with malicious code that executes a Linux binary retrieved from a GitHub Releases URL. This campaign targets developers using these packages and leverages GitHub as a distribution channel for the malware payload ^[2].
• Multiple PHP packages belonging to the Laravel-Lang project were compromised to deliver a cross-platform credential-stealing malware. Attackers abused GitHub version tags to distribute the malicious payload, exposing developers to credential theft ^[4][5].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Cloud Atlas has targeted public sector and diplomatic entities in Russia and Belarus, employing new tools including PowerCloud, and leveraging ReverseSocks, SSH, and Tor for persistence on infected systems ^[1].
• The Belarus-aligned threat actor Ghostwriter has conducted phishing campaigns against Ukrainian government entities using lures associated with the Prometheus online learning platform ^[10].
• The Megalodon automated attack campaign pushed over 5,700 malicious commits to more than 5,500 GitHub repositories within six hours, exploiting CI/CD workflows ^[11].
• Authorities in Europe and North America dismantled the “First VPN” criminal VPN service, which was used by at least 25 ransomware groups to facilitate attacks and obscure their origins ^[9][30].
• Dutch authorities seized 800 servers belonging to a hosting provider that enabled cyberattacks, interference operations, and disinformation campaigns, arresting two individuals ^[14].
• A Canadian man was arrested and charged in connection with operating the Kimwolf DDoS botnet, which infected nearly two million devices globally and was used for DDoS-for-hire attacks ^[13][20][29].
• Former US executives pleaded guilty to concealing a tech support fraud scheme that impacted victims worldwide ^[15].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• GitHub disclosed that attackers accessed internal repositories after compromising an employee device via a malicious Visual Studio Code extension. The breach was reportedly limited in scope but highlights successful social engineering against developer tooling ^[1].
• Grafana confirmed that hackers accessed its GitHub repositories and stole codebase and other data by exploiting a token compromised during the TanStack supply chain attack, which had not been rotated ^[34].
• A glitch in Robinhood’s account creation process was exploited to send phishing emails from the platform’s own systems to customers ^[3].
• Canadian authorities arrested an individual alleged to be the botmaster behind Kimwolf, an IoT botnet that enslaved millions of devices for DDoS and credential stuffing attacks ^[28].
• Law enforcement seized the ‘First VPN’ service, which was used to facilitate ransomware and data theft operations ^[16].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• GitHub confirmed a breach involving the exfiltration of over 3,800 internal repositories. The breach was traced to a compromised employee device, which had installed a malicious version of the Nx Console Visual Studio Code extension. This extension was compromised during the recent TanStack npm supply-chain attack. The threat actor TeamPCP has claimed responsibility. The breach also impacted other organisations, such as Grafana, which failed to rotate a GitHub workflow token after the TanStack incident, leading to further compromise^{[4][10][13][16][21]}.
• Microsoft disrupted a malware-signing-as-a-service operation, known as Fox Tempest, which weaponised Microsoft’s Artifact Signing system to deliver malicious code and facilitate ransomware campaigns. The service enabled threat actors to sign malware with fraudulent Microsoft-issued certificates to evade security controls^[7][42].
• Hackers bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, brute-forcing VPN credentials and deploying tools used in ransomware attacks^[15].
• The Ukrainian cyberpolice, in cooperation with US authorities, identified an infostealer operator responsible for compromising 28,000 accounts via malware targeting an online service^[14].
• Grafana suffered a data breach stemming from a missed token rotation following the TanStack npm supply-chain attack, underscoring the ongoing risks in the software supply chain^[16].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• GitHub confirmed that approximately 3,800 internal repositories were breached after an employee installed a malicious Visual Studio Code extension. The threat actor TeamPCP has claimed responsibility for accessing around 4,000 repositories containing private code, and GitHub is actively investigating the incident ^[6][12][14].
• Grafana Labs disclosed a breach involving its source code repositories, attributed to a supply-chain attack via a compromised npm package (TanStack). The company stated that customer production systems and operations were not affected ^[5].
• 7-Eleven confirmed a data breach following a cyberattack claimed by the ShinyHunters extortion group. The incident affected the company’s systems last month ^[23].
• NYC Health + Hospitals reported a significant breach via a third-party vendor compromise, exposing sensitive data including biometrics, medical diagnoses, and bank details of at least 1.8 million individuals ^[46].
• The US FBI reported that Americans lost over $388 million to scams involving cryptocurrency ATMs in 2025 ^[18].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token ^[19].
• 7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data ^[34].
• Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals ^[32].
• Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting ^[37].
• A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend ^[28].
• INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks ^[8][15].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Grafana has confirmed a data breach following claims by the Coinbase Cartel group, which is reportedly linked to ShinyHunters, Scattered Spider, and Lapsus$ threat actors. The extent of data accessed or stolen has not yet been fully disclosed ^[11].
• Historical analysis has revealed that the fast16 malware, a Lua-based tool predating Stuxnet, was specifically designed to sabotage nuclear weapons testing simulations ^[1].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Grafana disclosed that an unauthorized party obtained a token granting access to its GitHub environment, resulting in the download of its codebase and an extortion attempt against the company ^[1].
• Instructure’s Canvas platform was impacted by a ransomware incident, which has now concluded ^[6].
• OpenAI workers were affected by a supply chain attack, though specifics regarding the method or scope were not detailed ^[6].

Newly Discovered Vulnerabilities