Major Incidents or Breaches

  • An unsecured database exposing 149 million usernames and passwords, including Gmail, Facebook, and banking credentials, was discovered by researchers. The data is suspected to have been collected via infostealing malware.
  • Under Armour is investigating a data breach involving the compromise of customer email addresses and other personal information.
  • Dozens of Venezuelan nationals were charged in the US for using malware in ATM jackpotting schemes, stealing hundreds of thousands of dollars from banks. Two individuals have been convicted and are set for deportation.
  • Spammers are abusing Zendesk to flood inboxes with legitimate-looking emails from trusted brands, generating significant inbox noise without direct phishing or malware delivery.

Newly Discovered Vulnerabilities

  • Fortinet confirmed active exploitation of a critical FortiCloud SSO authentication bypass vulnerability, affecting even fully patched FortiGate firewalls. The vulnerability is not yet fully remediated.
  • CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Versa, Zimbra, the Vite frontend tool, and SmarterMail. Exploitation of the SmarterMail authentication bypass began two days after patch release.
  • A critical authentication bypass vulnerability in GNU InetUtils telnetd, present for 11 years, is being actively exploited to gain root access.
  • Cisco UC is affected by a critical zero-day vulnerability (CVE-2026-20045) under mass scanning, which could allow complete system takeover.
  • Two malicious AI-powered extensions on the Microsoft Visual Studio Code (VSCode) Marketplace, installed 1.5 million times, have exfiltrated developer data to servers in China.
  • At Pwn2Own Automotive 2026, researchers disclosed 76 zero-day vulnerabilities in vehicle infotainment systems and EV chargers, earning over $1 million in rewards.

Notable Threat Actor Activity

  • The ShinyHunters extortion group claimed responsibility for a wave of ongoing voice phishing attacks targeting SSO accounts at Okta, Microsoft, and Google, enabling breaches of corporate systems.
  • ESET attributed a late 2025 cyberattack on Poland’s power grid to the Sandworm group, involving the use of data-wiping malware dubbed DynoWiper.
  • A dual-vector phishing campaign has been observed using stolen credentials to deploy legitimate Remote Monitoring and Management (RMM) software (LogMeIn) for persistent remote access.
  • Microsoft reported a multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) campaign targeting energy sector organizations, with attackers abusing SharePoint for payload delivery.
  • Attackers are increasingly leveraging visually stylized (“fancy”) QR codes in quishing (QR-based phishing) campaigns, making malicious links harder to detect.

Trends, Tools, or Tactics of Interest

  • Security researchers demonstrated new attack vectors against automotive infotainment systems and EV chargers at Pwn2Own Automotive 2026, highlighting the expanding attack surface in connected vehicles.
  • AI-generated code was shown to introduce subtle vulnerabilities when over-trusted, as evidenced by an AI-written honeypot that was exploited due to hidden flaws.
  • Forty percent of employees have never received cybersecurity training, rising to nearly sixty percent in small businesses, according to a new report from Yubico.
  • Attackers are abusing trusted platforms, such as Zendesk and SharePoint, to deliver spam or malicious payloads, complicating detection and response.
  • Legitimate RMM tools are being leveraged post-compromise to establish persistent access within enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

  • The US Cybersecurity and Infrastructure Security Agency (CISA) continues to update its KEV catalog, mandating increased attention to actively exploited vulnerabilities by federal and critical infrastructure entities.
  • GDPR enforcement remains significant, with €1.2 billion in fines reported.
  • Cyber regulations and compliance requirements are becoming increasingly complex, impacting business operations and risk management strategies.