Major Incidents or Breaches

• OpenAI disclosed that two employee devices were compromised via the Mini Shai-Hulud supply chain attack on TanStack, resulting in the theft of credential material from code repositories. OpenAI stated that no user data or production systems were affected. The incident is linked to the public release of the Shai-Hulud worm source code by TeamPCP, which is encouraging its use in further supply chain attacks and offering monetary rewards to attackers ^[8][22][23].
• The JDownloader website was compromised, and installer download links were replaced with malware for several days, exposing users who downloaded the installer during this period to potential compromise ^[24].
• American Lending Center reported a ransomware attack affecting 123,000 individuals. The breach was discovered nearly a year ago, but the investigation has only recently concluded ^[21].
• Researchers observed active exploitation of a critical vulnerability in the Funnel Builder WordPress plugin, allowing attackers to inject malicious JavaScript into WooCommerce checkout pages and steal credit card data ^[9].
• Two vulnerabilities in the Avada Builder WordPress plugin, which has around one million active installations, allow attackers to read arbitrary files and extract sensitive information, including site credentials ^[12].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Foxconn suffered a ransomware attack by the Nitrogen group on its North American manufacturing facilities. This is one of over 600 attacks targeting manufacturers this year.
• OpenAI confirmed a security breach resulting from the TanStack supply chain attack, which compromised two employee devices and necessitated code-signing certificate rotation.
• Taiwanese rail operations were disrupted for nearly an hour after a student used software-defined radio to shut down three bullet trains, exposing cybersecurity gaps in rail systems.
• TeamPCP is threatening to leak source code from the Mistral AI project unless a buyer is found, following a breach.
• Dell confirmed its SupportAssist software is causing Windows BSOD crashes, leading to system instability for users.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Foxconn, the world’s largest electronics manufacturer, confirmed a cyberattack on its North American factories. The Nitrogen ransomware group claimed responsibility, stating it stole 8TB of data, including confidential documents.
• West Pharmaceutical Services disclosed a cyberattack resulting in data exfiltration and system encryption.
• OpenLoop Health, a telehealth platform, suffered a data breach in January impacting 716,000 users whose personal information was exfiltrated.
• UK government-related RubyGems packages were targeted by attackers using data dead drops, though the ultimate objective remains unclear.
• Deepfake sextortion incidents at UK schools have led to the removal of student photos from websites after AI-generated images were used for extortion.
• An unnamed Azerbaijani oil and gas company was repeatedly targeted by a China-linked threat actor (FamousSparrow APT) exploiting Microsoft Exchange vulnerabilities from December 2025 to February 2026.
• Iranian threat group MuddyWater conducted a cyber-espionage campaign against at least nine high-profile organizations, including a major South Korean electronics manufacturer.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
• Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
• BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
• Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
• A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
• RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
• The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
• TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Instructure (Canvas): Instructure, the parent company of Canvas, confirmed a significant breach involving the theft of 3.65TB of data by the ShinyHunters extortion group. The breach exploited a vulnerability in Canvas, which allowed attackers to deface login portals and leave extortion messages. Instructure reached a ransom agreement with the attackers to prevent further data leaks, and claims the stolen data was “returned.”
• TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch: Multiple popular npm and PyPI packages were compromised in a supply chain attack orchestrated by the threat actor TeamPCP. The attack also included a rogue version of the Checkmarx Jenkins AST plugin, which contained an infostealer.
• Skoda: Hackers exploited a portal vulnerability to access customer data from Skoda’s online shop, including names, addresses, email addresses, and phone numbers.
• SailPoint: SailPoint disclosed a GitHub repository breach on 20 April. No customer data in production or staging environments was affected.
• cPanel: A threat actor known as Mr_Rot13 is actively exploiting CVE-2026-41940, a critical cPanel vulnerability, to deploy the Filemanager backdoor on compromised systems.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Canvas online learning system experienced a cyberattack that disrupted access for tens of thousands of students globally, particularly impacting those studying for final exams. Service has since been restored.
• Over 500 organizations across sectors including aviation, critical infrastructure, energy, logistics, public administration, and technology have been targeted in a years-long phishing campaign.
• German authorities have shut down the rebooted Crimenetwork criminal marketplace, which had over 22,000 users and more than 100 sellers, and arrested its administrator.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The JDownloader website was compromised to distribute malicious installers for both Windows and Linux users. The Windows installer deployed a Python-based RAT (Remote Access Trojan).
• NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, exposing user information.
• Trellix experienced a source code repository breach, with the RansomHouse threat group claiming responsibility and leaking proof-of-intrusion images.
• Zara suffered a data breach exposing personal information of over 197,000 customers.
• Instructure, the company behind the Canvas educational platform, was hit by a second attack claimed by ShinyHunters, with PII of hundreds of millions at risk. The attack also resulted in defacement of school login portals and ransom demands.
• The Canvas system, used by thousands of educational institutions, went offline due to a cyberattack, disrupting students during finals.
• AI firm Braintrust reported a breach in which attackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
• Polish Security Agency reported ICS (Industrial Control Systems) breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supplies.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, with user information exposed.
• Trellix source code repository breach was claimed by the RansomHouse threat group, who leaked images as proof of intrusion.
• Zara suffered a data breach exposing personal information of 197,000 customers, as reported by Have I Been Pwned.
• Instructure, the edtech company behind the Canvas learning platform, experienced a second attack claimed by ShinyHunters; PII of hundreds of millions potentially at risk.
• The Canvas system used by thousands of schools and universities was taken offline by a cyberattack, disrupting operations during final exams.
• ShinyHunters escalated their attacks on Canvas by defacing school login portals with ransom messages.
• AI firm Braintrust suffered a breach in which hackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
• The Polish Security Agency reported ICS breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supply.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The ShinyHunters extortion group breached Instructure’s Canvas platform, exploiting a new vulnerability to deface login portals across hundreds of colleges and universities, disrupting classes and coursework nationwide. The campaign involved mass ransomware extortion and data theft.
• RansomHouse ransomware group claimed responsibility for a breach of cybersecurity vendor Trellix, publishing screenshots of access to internal services.
• Daemon Tools confirmed a supply chain attack affecting its distribution infrastructure; the vendor reports the attack has been contained, compromised files removed, and installation packages validated.
• A massive AI investment scam operation was uncovered, spanning 15,500 domains and using the Keitaro ad-tracking platform for targeted victim exposure.
• Thousands of web applications built using AI-driven platforms were found to be leaking sensitive corporate and personal data due to misconfiguration and insecure defaults.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Instructure (Canvas) Breach: ShinyHunters claimed responsibility for a breach impacting Instructure, the provider of the Canvas learning management system. The incident exposed personal data of up to 275 million students across educational institutions, highlighting significant vendor risk for schools.
• DAEMON Tools Supply Chain Attack: Disc Soft Limited confirmed a supply chain compromise in DAEMON Tools Lite, with trojanized versions distributed globally. A sophisticated backdoor was selectively deployed on a dozen systems, including government and scientific entities. A clean version has since been released.
• Claude AI Used in Water Utility Intrusion: Dragos reported that threat actors leveraged Claude AI to facilitate access to operational technology (OT) assets during an intrusion at a Mexican water and drainage utility.
• ManageWP Phishing via Google Ads: Attackers used Google-sponsored ads to deliver phishing pages targeting credentials for GoDaddy’s ManageWP platform, affecting WordPress management operations.
• Windows Phone Link Exploited: Multiple reports detail hackers abusing Microsoft’s Windows Phone Link feature with the CloudZ RAT and a plugin called Pheno to steal credentials, text messages, and one-time passwords, enabling multi-factor authentication bypass.
• Google Chrome AI Model Download Issue: Google Chrome was found to silently download and reinstall a 4GB AI model on users’ devices without explicit consent.

Newly Discovered Vulnerabilities