Major Incidents or Breaches

  • Google confirmed a data breach involving one of its Salesforce CRM instances, exposing information related to potential Google Ads customers.
  • The US federal court records system was compromised in a cyberattack, with details on the scope and impact emerging.
  • Sixty malicious Ruby gems containing credential-stealing code were downloaded over 275,000 times since March 2023, targeting developer accounts.

Newly Discovered Vulnerabilities

  • Vulnerabilities in select Linux-based Lenovo webcam models were disclosed, allowing remote attackers to exploit them as BadUSB devices for injecting keystrokes.
  • Researchers identified security flaws in free Wi-Fi systems on buses, enabling remote hacking that could allow attackers to track, control, or spy on bus systems.

Notable Threat Actor Activity

  • Distribution of malicious Ruby gems targeting developers with credential theft has been ongoing since March 2023, indicating a sustained supply chain attack campaign.

Trends, Tools, or Tactics of Interest

  • A jailbreak technique for OpenAI’s GPT-5 LLM was uncovered, enabling bypass of ethical guardrails and production of illicit instructions. Researchers also demonstrated “zero-click” AI agent attacks targeting cloud and IoT systems.
  • The Uncut Gem project introduced a fully open-source quantum sensor initiative, potentially broadening access to quantum sensing technology.

Regulatory or Policy Developments Affecting the Security Industry

  • Instagram faced public backlash over the privacy implications of its new map feature, raising concerns about user data exposure.