Major Incidents or Breaches

• Over 75 company servers have been breached via active, large-scale exploitation of a critical Microsoft SharePoint zero-day vulnerability (CVE-2025-53770, CVSS 9.8). At least 85 organisations are confirmed affected, with exploitation ongoing since at least July 18th.
• Over 3,500 websites have been compromised to host stealth JavaScript-based cryptocurrency miners using advanced obfuscation and WebSocket communication to evade detection.
• Five npm packages were injected with malware following a phishing campaign that resulted in the theft of maintainer tokens, constituting a significant software supply chain attack.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Salt Typhoon, a Chinese state-linked threat actor, maintained unauthorised access to US National Guard systems for nearly a year, according to new reporting.
• A study has found that at least 750 US hospitals experienced disruptions during last year’s CrowdStrike outage, with over 200 hospitals suffering outages that affected patient care.

Newly Discovered Vulnerabilities

• A 20-year-old vulnerability in train braking systems has been publicly disclosed, making these systems susceptible to remote attacks.

Notable Threat Actor Activity

Major Incidents or Breaches

• WineLab, the largest alcohol retailer in Russia, has closed stores following a ransomware attack that disrupted operations and customer purchases.
• Radiology Associates of Richmond disclosed a data breach impacting 1.4 million individuals’ protected health and personal information.
• Anne Arundel Dermatology reported a data breach affecting 1.9 million people, with hackers having access to systems for three months and potentially exfiltrating personal and health information.
• Thousands of spoofed news sites (over 17,000) are being used to push investment fraud scams, per CTM360.
• Arch Linux removed three malicious AUR packages that installed the CHAOS RAT on Linux devices.
• A powerful US law firm was reportedly hacked by Chinese threat actors.
• CitrixBleed 2 vulnerability in NetScaler has led to compromises at 100 organizations, with thousands of instances still vulnerable even after patching.
• Veeam users have been targeted by a phishing campaign using voicemail-themed emails with malicious .wav file attachments.
• Meta executives settled an $8 billion shareholder lawsuit over alleged disregard for privacy regulations.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Cryptocurrency exchange BigONE suffered a security breach resulting in the theft of digital assets valued at $27 million.
• An adoption agency leaked over 1.1 million records, including names and sensitive information of children, birth parents, and adoptive parents.
• Chinese state-sponsored group Salt Typhoon breached a U.S. Army National Guard network for nine months in 2024, exfiltrating network configuration files and credentials.
• Security researchers revealed that poor password practices at Paradox.ai led to the exposure of personal information belonging to millions of job applicants.
• A vulnerability in Meta AI (now fixed) could have allowed unauthorized access to private chatbot conversations.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• UK retailer Co-op confirmed the theft of personal data belonging to 6.5 million members following a major cyberattack in April, which also disrupted operations and caused food shortages.
• Louis Vuitton disclosed that customer data breaches in the UK, South Korea, and Turkey are linked to a single security incident, reportedly associated with the ShinyHunters group.
• United Natural Foods, Inc. (UNFI) projected up to $400 million in sales impact and $50–$60 million in net income loss due to a June cyberattack that disrupted operations, with insurance expected to cover most losses.
• Compumedics, a medical technology company, suffered a ransomware attack by the VanHelsing group, resulting in the theft of files affecting 318,000 individuals.
• An adoption agency left 1.1 million sensitive records of children and parents exposed on the open web due to a data misconfiguration.
• A former US Army colonel leaked national secrets via a foreign dating app after being targeted by a scammer.
• Amazon warned 200 million Prime customers about an ongoing phishing campaign targeting their login credentials.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Century Support Services, a Pennsylvania-based debt settlement firm, disclosed a data breach impacting 160,000 individuals after its systems were compromised in November 2024.
• US department store chain Belk was targeted by the DragonForce ransomware group, which claims to have stolen over 150GB of data during a May 2025 attack.
• Abacus Market, a major Western darknet drug marketplace, has gone offline in a suspected exit scam, shutting down its public infrastructure.
• McDonald’s hiring platform inadvertently exposed data of approximately 64 million job applicants due to the use of default credentials.
• Several companies in Italy’s Lombardy region suffered business disruption after a Romanian ransomware group known as ‘Diskstation’ attacked NAS devices. The group was dismantled by international law enforcement.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Louis Vuitton has notified customers in the UK, South Korea, Turkey, and possibly other countries of a data breach affecting their personal information.
• McDonald’s has suffered a data breach resulting in the exposure of customer data.
• Two versions of the Gravity Forms WordPress plugin, distributed via the official download page, were compromised in a supply chain attack, with malware injected into the plugin.
• A malicious Visual Studio Code extension for the Cursor AI IDE led to the theft of $500,000 in cryptocurrency from a Russian crypto firm, after infecting devices with remote access tools and infostealers.
• India’s Central Bureau of Investigation (CBI) dismantled a transnational cybercrime syndicate responsible for a £390,000 UK tech support scam, arresting key operatives at a Noida call center.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Thirteen Romanian nationals were arrested in coordinated operations involving HMRC and Romanian police for conducting phishing attacks targeting the UK’s tax service (HMRC). The arrests took place in Ilfov, Giurgiu, and Calarasi counties and are linked to a large-scale campaign against UK taxpayers.

Newly Discovered Vulnerabilities

• A critical vulnerability was identified in Kigen’s eUICC (embedded Universal Integrated Circuit Card) eSIM technology, which is widely used in smartphones and IoT devices. The flaw allows attackers to exploit eSIM provisioning processes, potentially exposing billions of IoT devices to remote attacks.
• Google Gemini for Workspace contains a flaw that allows attackers to manipulate AI-generated email summaries, embedding malicious instructions or phishing warnings that can redirect users to phishing websites without the need for malicious attachments or links.

Notable Threat Actor Activity

Major Incidents or Breaches

• Over 600 Laravel applications have been exposed to remote code execution (RCE) due to leaked APP_KEYs found on GitHub, enabling attackers to compromise affected deployments.
• Hackers are actively exploiting a critical RCE vulnerability in Wing FTP Server, following the public release of technical details about the flaw.
• Four individuals have been arrested in connection with the Scattered Spider hacking group, which has been implicated in a series of high-profile attacks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
• The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
• A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities