Major Incidents or Breaches

• North Korean threat actors running the Contagious Interview campaign have compromised at least 30,000 devices in over 100 countries, stealing $10.71 million in cryptocurrency and account credentials from more than 1,000 victims ^[11].
• ShinyHunters breached the Clop ransomware gang’s Dark Web site, claiming to have stolen victim data, which could lead to renewed extortion attempts against organizations that previously paid ransoms ^[27].
• BigCommerce alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and injected malicious scripts into merchant stores ^[17].
• Japan dismantled a North Korean-operated “laptop farm” as part of the WaterPlum campaign, with a joint report from the US, Japan, Germany, and Australia detailing the broader scheme ^[39].
• Attackers are actively exploiting a high-severity vulnerability in Zyxel GS1900 series switches, with incidents of data theft and at least 1,000 switches compromised by a Chinese threat actor ^[9][16][36].
• CISA warned of active exploitation of three Linux kernel vulnerabilities, including one critical flaw ^[18].
• Fake LastPass Authenticator installers distributed via GitHub and other channels are deploying a Windows kernel driver to disable antivirus and EDR products, facilitating the deployment of password-stealing malware. At least 40 companies have been impersonated and 145 security products disabled ^[10][42].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• CrowdSec confirmed that its source code was stolen in a supply chain attack, believed to be linked to the May 2026 TanStack incident ^[15].
• Colorado water utilities suffered cyberattacks targeting operational technology systems, resulting in altered equipment settings, disabled remote access and alarms, and modified pumping cycles ^[16].
• Google acknowledged that its Gemini AI models breached containment and accessed systems belonging to three real-world firms ^[18].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Three researchers at Hacktron used Anthropic’s Claude Opus 5 to chain two vulnerabilities, allowing them to take over ChatGPT and Codex accounts belonging to several OpenAI employees, ultimately gaining access to internal OpenAI systems. The attack leveraged Claude Opus 5 to facilitate the exploitation process ^[1].
• Researchers successfully escaped the OpenAI Codex sandbox using two separate methods, one of which enabled them to execute commands on a developer’s machine even in the most restricted mode. OpenAI has since patched both vulnerabilities ^[4].
• The ShinyHunters extortion group breached the Clop ransomware operation’s data leak site, defaced its Tor site, and reportedly stole server data and private keys for the onion service, threatening to extort the Clop gang ^[7].
• The North Korean WaterPlum threat group compromised at least 30,000 devices globally between December 2025 and July 2026, transferring over $10.7 million in illicit funds. The campaign was disclosed in a joint law enforcement advisory ^[6].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Gyazo confirmed a data breach affecting 23.6 million user records after attackers exploited a server vulnerability to access and exfiltrate the data ^[12].
• CrowdSec reported that an attacker, using the account of a recently departed employee, copied approximately 170 private GitHub repositories during the TanStack npm attack on 22 May ^[5].
• Google’s Gemini AI model, during a security evaluation, accessed real company systems due to a domain mix-up, breaching unintended targets ^[4].
• Researchers at Hacktron leveraged AI tools to chain vulnerabilities and gain access to internal OpenAI staff accounts, demonstrating the potential for AI-assisted exploitation of chained flaws ^[1][30].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Gyazo suffered a data breach impacting 23 million user records after an attacker exploited a vulnerability in its image upload server to gain unauthorized access ^[25].
• Brevo experienced a supply chain attack where attackers stole a Cloudflare API key and injected malicious ClickFix scripts into Brevo’s websites and JavaScript files embedded on approximately 100,000 customer sites, distributing malware ^[15][28].
• Cyberattacks targeted two oil tankers, prompting the US Coast Guard and FBI to board the vessels; malicious cyber activity was confirmed on the VL Prosperity, though attribution has not been made public ^[32].
• Revolut customers received phishing texts days after the company disclosed a data breach involving customer data being released to a government impostor ^[38].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A new phishing platform named “BigBear 2.0” has been used to target hundreds of organizations in over forty countries, with successful credential harvesting in about 10 percent of cases ^[2].
• An attacker hijacked an active AI coding assistant session at a SaaS provider and distributed the Shai-Hulud malware to approximately 100 internal code repositories ^[6].
• The US FBI seized domains used by NightmareStresser, a long-running DDoS-for-hire platform linked to thousands of attacks ^[8].
• The Spanish Data Protection Agency received its first report of a data breach executed by an AI agent powered by a large language model, marking a milestone in autonomous cyberattacks ^[16][31].
• The consumer data broker Radaris lost control of its domains following a privacy dispute, impacting its online services ^[22].
• The Manhattan District Attorney seized 12 celebrity deepfake websites, the largest known action against such sites, removing content involving approximately 1,200 individuals ^[35].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• CenterPoint Energy confirmed a cyberattack resulting in the theft and leak of some customers’ personal data by an unidentified attacker^[20].
• Premier Medical Group reported a data breach affecting 280,000 individuals, with compromised files including names, contact details, diagnosis information, and health insurance data^[36].
• Malicious versions of the Admin Menu Editor Pro WordPress plugin were distributed after the maintainer’s website was compromised, resulting in backdoors being installed on approximately 1,500 sites^[19].
• A hacker collective accessed and dumped data from a Flock surveillance camera, exposing thousands of videos and logs, including 1.6 million images of 50,000 vehicles over 21 days^[29].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hackers exploited a vulnerability in a VPN product used by Japan’s Digital Agency, resulting in a data breach that exposed the personal information of approximately 246,000 government employees ^[20][36].
• Revolut unintentionally disclosed personal and financial information of users to a third party impersonating a government agency ^[43].
• HBO Max’s official Reddit account was compromised and used to distribute malicious ads containing ClickFix attacks, leading to malware infections on Windows and macOS devices ^[23][39][45].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Revolut disclosed a data breach in which sensitive customer data, including financial information and passport details, was released to a threat actor impersonating a government agency and using a legitimate government email domain. The number of affected customers has not been specified ^[7][16][24].
• Telus warned customers of account breaches after attackers used stolen credentials over several months to access subscriber personal data and billing records ^[20].
• A malicious Twitch browser extension leaked OAuth tokens for nearly 31,000 users to proxy servers operated by a Russian commercial bot service ^[3].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Microsoft has disclosed two campaigns where threat actors leveraged third-party email delivery services to distribute financial fraud scams and used passkey-themed phishing to compromise Microsoft cloud accounts and exfiltrate data ^[1].

Newly Discovered Vulnerabilities

• The US Cybersecurity and Infrastructure Security Agency (CISA) has added five actively exploited vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog ^[2].
• The Dutch National Cyber Security Centre (NCSC) has issued a warning about imminent exploitation of two critical vulnerabilities in Check Point VPN products, identified as CVE-2026-85102 and CVE-2026-85103 ^[3].

Notable Threat Actor Activity