Major Incidents or Breaches

• DAEMON Tools supply chain attack: Installers downloaded from the official DAEMON Tools website since 8 April were trojanised, delivering a sophisticated backdoor to thousands of systems globally. Government and scientific entities were among those targeted, though the backdoor was selectively deployed on a limited number of systems.
• Vimeo data breach: The ShinyHunters extortion group accessed and exfiltrated personal information of over 119,000 users following a breach of the Vimeo platform in April.
• Instructure breach: A hacker claims to have stolen 280 million data records from 8,809 educational institutions by breaching Instructure, exposing student and staff data.
• Trellix source code breach: Attackers accessed source code for Trellix security products, potentially exposing detection mechanisms and product controls.
• Taiwan high-speed rail hack: A university student was arrested for exploiting the TETRA communication system to trigger emergency brakes on Taiwan’s high-speed railway.
• CloudZ RAT exploitation via Windows Phone Link: Researchers disclosed an incident involving the CloudZ remote access tool, leveraging a previously undocumented plugin (“Pheno”) to steal credentials and OTPs.
• Government targeting by UAT-8302: China-linked APT group UAT-8302 was attributed to ongoing attacks against government entities in South America and South Asia, using malware shared across regions.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Trellix disclosed a data breach following unauthorised access to a portion of its source code repository. The investigation found no impact on source code release or distribution processes.
• DigiCert revoked certificates after hackers exploited a customer chat channel to deliver malware, infect an analyst’s system, and access the internal support portal.
• Over 40,000 servers have been compromised in ongoing exploitation of a critical cPanel vulnerability (CVE-2026-41940), with attacks targeting government, military, managed service providers (MSPs), and hosting providers in Southeast Asia.
• Medtronic, a global medical device manufacturer, disclosed a security incident, as referenced in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Instructure, an educational technology company, confirmed a data breach following claims by the ShinyHunters extortion group. Data stolen includes names, email addresses, student ID numbers, and user messages. Service disruptions were also reported.
• A coordinated international law enforcement operation involving U.S. and Chinese authorities resulted in the arrest of 276 suspects, the shutdown of nine cryptocurrency scam centers, and the seizure of $701 million. The operation targeted large-scale cryptocurrency investment fraud schemes.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The “Sorry” ransomware group is conducting mass exploitation of a critical cPanel vulnerability (CVE-2026-41940) to breach websites and encrypt data.

Newly Discovered Vulnerabilities

• CISA has added CVE-2026-31431, a Linux root access vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw impacts multiple Linux distributions and is currently being actively exploited.

Notable Threat Actor Activity

• A Finnish teenager has been formally charged in connection with the Scattered Spider hacking spree.
• The “Sorry” ransomware group is actively exploiting the cPanel vulnerability (CVE-2026-41940) in widespread attacks.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Trellix confirmed a breach involving unauthorized access to a portion of its source code.
• Instructure, the company behind the Canvas learning platform, disclosed a cybersecurity incident and is investigating its impact.
• 30,000 Facebook accounts were compromised in a phishing campaign leveraging Google AppSheet as a phishing relay, attributed to a Vietnamese-linked operation.
• French authorities detained a 15-year-old suspected of selling data stolen in a cyberattack on the French government agency France Titres (ANTS).
• The FBI issued a warning about a surge in hacker-enabled cargo theft, with criminal groups hacking brokers and carriers to facilitate the theft and resale of cargo.
• Hugging Face and ClawHub platforms are being abused by threat actors for malware distribution, using social engineering to trick users into downloading malicious files.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hundreds of thousands of Roblox accounts were compromised through fake “game enhancements” that harvested login credentials, with stolen accounts subsequently sold for profit.
• 90,000 screenshots, including private messages and photos, from a European celebrity’s smartphone were publicly exposed due to spyware, before being reported and taken down.
• A critical authentication bypass vulnerability (CVE-2026-41940) in cPanel, WHM, and WP Squared has been actively exploited as a zero-day since late February, granting attackers administrative access to servers. Proof-of-concept code is publicly available.
• Several npm packages for SAP’s cloud application ecosystem were compromised in a supply chain attack (“Mini Shai-Hulud”), impacting at least 1,800 downstream projects.
• The Lightning Python package and Intercom-client were compromised on PyPI, with malicious versions published to steal credentials. Combined, these packages have nearly 10 million monthly downloads.
• A Brazilian anti-DDoS firm was found to be enabling a botnet that conducted large-scale DDoS attacks against Brazilian ISPs.
• The FBI reported a sharp surge in cyber-enabled cargo theft attacks targeting transportation and logistics in the US and Canada, with losses exceeding $30 million in 2023.
• Law enforcement dismantled nine cryptocurrency investment scam centers, arresting 276 suspects in a joint operation involving US and Chinese authorities.
• PayPal email systems are being abused to distribute tech support scams by hijacking legitimate emails.
• Two former US ransomware negotiators were sentenced to four years in prison each for their role in facilitating BlackCat (ALPHV) ransomware attacks against US companies.
• The leader of an online swatting ring, responsible for targeting over 75 officials and institutions, was sentenced to four years in US federal prison.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Multiple official SAP-related npm packages were compromised in a supply chain attack attributed to TeamPCP, resulting in credential-stealing malware being distributed to developers.
• Checkmarx confirmed data theft from its GitHub environment following a supply chain attack, with exfiltration occurring on March 30.
• The Quick Page/Post Redirect WordPress plugin, active on over 70,000 sites, was found to contain a dormant backdoor for five years, enabling arbitrary code injection.
• Ukrainian authorities arrested three individuals accused of hijacking and selling over 610,000 Roblox accounts, generating $225,000 in illicit profits.
• European law enforcement dismantled a cryptocurrency investment fraud ring responsible for losses exceeding €50 million.
• Anthropic’s Claude Opus LLM was leveraged to insert malicious npm dependencies, facilitating a new wave of DPRK-linked attacks.
• Vercel suffered a breach due to a compromised third-party OAuth integration, highlighting risks of OAuth sprawl and downstream impact.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Vimeo has confirmed a data breach affecting user and customer data, resulting from the Anodot data anomaly detection company breach. The ShinyHunters group is threatening to leak the stolen files unless a ransom is paid.
• Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository.
• Robinhood systems were leveraged to send legitimate-looking phishing emails, luring recipients to malicious websites.
• Electric motorcycles (Zero Motorcycles) and scooters (Yadea) have been found vulnerable to attacks that could compromise rider safety.
• A Chinese engineer reportedly stole US military and NASA software over several years by impersonating researchers and convincing organisations to provide sensitive code.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Checkmarx has confirmed that data from its GitHub repositories was leaked on the dark web following a supply chain attack on March 23. The TeamPCP supply chain campaign has been linked to this and other concurrent compromises, including Bitwarden CLI and xinference PyPI.
• Home security provider ADT suffered a breach affecting 5.5 million individuals, with the ShinyHunters extortion group claiming responsibility for stealing personal information.
• Medtronic, a major medical device manufacturer, confirmed a breach after hackers claimed to have accessed up to 9 million records. The ShinyHunters group is also linked to this incident.
• Itron, an energy and water management firm, reported unauthorized access to its systems detected on April 13.
• Vercel disclosed a security incident, as noted in Checkpoint’s latest threat intelligence bulletin.
• The elementary-data package on PyPI (with 1.1 million monthly downloads) was compromised to distribute information-stealing malware targeting developer data and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Itron, Inc., an American utility firm, disclosed a cybersecurity incident involving unauthorised access to certain internal IT systems. The breach was reported to the U.S. Securities and Exchange Commission via an 8-K filing.
• Discord users reportedly gained unauthorised access to Anthropic’s ‘Mythos’, with the incident highlighting unauthorised data exposure.
• 500,000 UK health records were listed for sale on Alibaba, indicating a significant data exposure event affecting sensitive personal information.

Newly Discovered Vulnerabilities