Major Incidents or Breaches

  • Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
  • Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
  • Eurail reported a breach in which hackers stole personal and reservation information of travellers.
  • Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

  • Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
  • A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
  • A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
  • Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
  • A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
  • Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
  • Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
  • Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

  • China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
  • Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
  • Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
  • Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
  • Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

  • The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
  • AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
  • A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
  • The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
  • Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
  • Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
  • The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
  • Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

  • The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
  • Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
  • Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.