Major Incidents or Breaches

• Google confirmed a data breach involving one of its Salesforce CRM instances, exposing information related to potential Google Ads customers.
• The US federal court records system was compromised in a cyberattack, with details on the scope and impact emerging.
• Sixty malicious Ruby gems containing credential-stealing code were downloaded over 275,000 times since March 2023, targeting developer accounts.

Newly Discovered Vulnerabilities

• Vulnerabilities in select Linux-based Lenovo webcam models were disclosed, allowing remote attackers to exploit them as BadUSB devices for injecting keystrokes.
• Researchers identified security flaws in free Wi-Fi systems on buses, enabling remote hacking that could allow attackers to track, control, or spy on bus systems.

Notable Threat Actor Activity

Major Incidents or Breaches

• Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.
• French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.
• Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.
• The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.
• Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.
• FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Bouygues Telecom confirmed a data breach affecting 6.4 million customers, exposing personal information.
• Air France and KLM disclosed a breach via a third-party customer service platform, compromising customer names, email addresses, phone numbers, and other non-financial data.
• Chanel notified clients of a third-party breach impacting customer data, joining other luxury brands affected by similar incidents.
• Google, Adidas, and other organisations suffered breaches after employees were tricked via phone calls into granting access to Salesforce data, attributed to ShinyHunters.
• Mozilla’s Firefox add-on store was targeted by the “GreedyBear” campaign, which uploaded 150 malicious extensions that drained cryptocurrency wallets, stealing an estimated $1 million.
• TeaOnHer, a dating advice app, was found leaking user personal data.
• Recent ransomware attacks against SonicWall Gen 7 firewalls with SSL VPN enabled were linked to exploitation of an older, patched vulnerability, not a zero-day.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Google has suffered a data breach as part of an ongoing campaign targeting Salesforce CRM data, attributed to the ShinyHunters extortion group. Several major companies have been impacted by this wave of attacks.
• DaVita has notified over 1 million individuals that their personal and health information was stolen in a ransomware attack.
• WhatsApp has taken down 6.8 million accounts linked to criminal scam centres, with Meta attributing the activity to a scam centre in Cambodia.
• A hacker, Chukwuemeka Victor Amachukwu, has been extradited from France to the US for spearphishing attacks on US tax preparers, resulting in the theft of $3.3 million from taxpayers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Pandora, the Danish jewelry retailer, confirmed a data breach after customer information was stolen in connection with ongoing Salesforce data theft attacks. The company warned customers of potential phishing attempts using their stolen data.
• Cisco disclosed a data breach affecting Cisco.com user accounts after a voice phishing (vishing) attack targeted a company representative. Stolen data includes names, email addresses, and phone numbers.
• PBS suffered a data breach resulting in the exposure of corporate contact information for employees and affiliates, which was subsequently leaked on Discord servers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
• Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
• Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

• SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
• NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
• A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
• Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
• Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Major Incidents or Breaches

• Researchers have identified a new Android remote access trojan (RAT) named PlayPraetor, which has infected over 11,000 devices. The campaign primarily targets users in Portugal, Spain, France, and Morocco. Infection vectors include fake Google Play pages and malicious ads distributed via Meta platforms.

Notable Threat Actor Activity

• Telnet and SSH logs have shown renewed activity involving the legacy username “pop3user,” suggesting threat actors are targeting outdated or legacy authentication mechanisms, possibly exploiting systems still using old POP3 configurations.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Telecommunications organizations in Southeast Asia have been targeted by the state-sponsored threat actor CL-STA-0969, which installed covert malware to enable remote control and espionage over a 10-month campaign. The activity is attributed to a persistent and sophisticated espionage operation targeting telecom infrastructure.

Newly Discovered Vulnerabilities

• Security researchers have identified a previously undocumented Linux backdoor named “Plague.” The malware is implemented as a malicious Pluggable Authentication Module (PAM), allowing silent credential theft and persistent access. Plague has evaded detection for approximately one year and poses a significant risk to affected Linux systems.

Notable Threat Actor Activity

Major Incidents or Breaches

• Akira ransomware has been observed exploiting SonicWall SSL VPN devices in a surge of attacks since late July 2025, reportedly targeting fully-patched devices and suggesting exploitation of a likely zero-day vulnerability.
• Pi-hole disclosed a data breach resulting from exploitation of a vulnerability in the GiveWP WordPress donation plugin, exposing donor names and email addresses.
• A malicious npm package, @kodane/patch-manager, generated using AI, was identified and removed after it was used to drain Solana cryptocurrency funds from over 1,500 victims.
• Microsoft is investigating whether the ToolShell exploit was leaked via the Microsoft Active Protections Program (MAPP).
• Russian state-sponsored APT group Secret Blizzard (Nobelium) conducted adversary-in-the-middle (AitM) attacks at the ISP level targeting foreign embassies in Moscow, leading to malware infections on diplomatic devices.
• An Apple ID phishing scam in Ohio led to an in-person theft of $27,000 from a victim.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.
• North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.
• Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.

Newly Discovered Vulnerabilities