Major Incidents or Breaches

  • CERT Polska reported coordinated cyber attacks on over 30 wind and solar farms, as well as a private manufacturing company, in Poland. Related reporting attributes a Russia-linked threat actor (Sandworm/Electrum) as responsible for these intrusions, which resulted in bricked ICS devices at 30 sites affecting communication and control systems in the Polish power grid.
  • ShinyHunters ransomware group claimed breaches of Match Group dating platforms (Match, Hinge, OkCupid) and Panera Bread, allegedly stealing millions of user records.
  • Illegal cryptocurrency flows reached $158 billion in 2025, marking a record high after several years of decline.
  • Researchers identified malicious Google Chrome extensions capable of hijacking affiliate links, stealing data, and collecting OpenAI ChatGPT authentication tokens.
  • Android users were targeted with a remote access trojan (RAT) delivered via malicious applications hosted on Hugging Face repositories.
  • Over 175,000 exposed Ollama AI model hosts were identified, with 23,000 persistently active, posing risks of LLM abuse.

Newly Discovered Vulnerabilities

  • Ivanti released patches for critical-severity, actively exploited zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, which allowed unauthenticated remote code execution.
  • Microsoft fixed a bug in Microsoft 365 Outlook that prevented users from accessing encrypted emails in classic Outlook.
  • The Windows 11 KB5074105 update addressed multiple issues, including boot, sign-in, and activation failures.

Notable Threat Actor Activity

  • China-linked threat actor UAT-8099 was observed targeting IIS servers in Asia with the BadIIS SEO malware campaign between late 2025 and early 2026. The campaign focused on search engine manipulation through server compromise.
  • Sandworm/Electrum, a Russia-linked group, was attributed to the bricking of ICS devices during coordinated attacks on Polish energy infrastructure.

Trends, Tools, or Tactics of Interest

  • Agentic AI and autonomous AI assistants such as OpenClaw (ClawdBot, MoltBot) are increasingly present in business environments, raising concerns about privileged, autonomous control and the expanding attack surface.
  • Security researchers noted increased abuse of Google Presentations for phishing campaigns targeting webmail users.
  • The Tenable One AI Exposure add-on was introduced to discover unsanctioned AI use within organizations and enforce compliance with approved AI tools.
  • Aisy launched an AI-assisted vulnerability management platform after emerging from stealth with $2.3 million in seed funding.

Regulatory or Policy Developments

  • Microsoft announced plans to disable the legacy NTLM authentication protocol by default in future Windows releases, citing security vulnerabilities.
  • The White House revoked two Biden-era memorandums related to software security rules, although some associated resources remain available for government use.
  • TikTok updated its privacy policy to explicitly reference immigration status in user data, drawing public attention and scrutiny.