Major Incidents or Breaches

  • Notepad++ Supply Chain Attack: Kaspersky GReAT identified previously undocumented infection chains in the Notepad++ supply chain attack, with new indicators of compromise (IoCs) and use of DLL sideloading.
  • Panera Bread Data Leak: ShinyHunters leaked 5.1 million Panera Bread account records, claiming theft of 14 million records from the company’s systems.
  • AT&T Breach Data Resurfacing: Previously leaked AT&T customer data has resurfaced, now merged and enriched with other datasets, increasing risks for affected customers.
  • AI Plush Toy Data Exposure: Approximately 50,000 chat transcripts between children and Bondu’s AI dinosaur plush toy were exposed and accessible to anyone with a Google account.

Newly Discovered Vulnerabilities

  • SolarWinds Web Help Desk RCE: CISA added a critical, actively exploited remote code execution vulnerability in SolarWinds Web Help Desk to its Known Exploited Vulnerabilities (KEV) catalog.
  • Docker Ask Gordon AI Flaw: A critical vulnerability in the Ask Gordon AI assistant within Docker Desktop and CLI allowed code execution via image metadata; the flaw has been patched.
  • React Native CLI (Metro4Shell) RCE: A critical flaw in the Metro Development Server used by “@react-native-community/cli” npm package has been exploited in the wild to bypass protections and deliver malware.
  • OpenClaw AI Assistant RCE: OpenClaw (also known as Moltbot or Clawdbot) is vulnerable to one-click remote code execution attacks, allowing attackers to hijack the AI assistant.

Notable Threat Actor Activity

  • APT28 (Russia-linked): APT28 exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) within three days of patch release. The campaign, codenamed “Paperbug,” used specially crafted RTF documents to initiate multistage infection chains, targeting European entities.
  • ShinyHunters: Attributed to the breach and leak of Panera Bread customer data.
  • GlassWorm Malware: The self-replicating GlassWorm malware has re-emerged, infecting Open VSX software components and leading to infostealer infections in developer ecosystems.

Trends, Tools, or Tactics of Interest

  • LinkedIn Phishing Campaigns: Ongoing phishing campaigns are abusing LinkedIn private messages to target executives and IT personnel, attempting to deliver malicious archive files.
  • QR Code Phishing (“Quishing”): Attackers are increasingly using visually stylized QR codes to enhance the effectiveness of phishing campaigns.
  • AI-Accelerated Cloud Attacks: An AI-assisted attack compromised an AWS environment in eight minutes, starting from exposed credentials in public S3 buckets and rapidly escalating to administrative privileges.
  • Supply Chain Security: Notable focus on attacks via developer ecosystems (Open VSX, Notepad++), and increased investment in automation for software supply chain security (RapidFort funding).
  • User Interface Manipulation: Reports highlight the use of dark patterns in websites and apps that undermine user security by manipulating user choices.
  • Cloud Outages: Recent major outages at cloud service providers (AWS, Azure, Cloudflare) have caused significant internet disruptions.
  • Affiliate Scam Tactics: Fake cloud storage payment alerts are being used to redirect victims through deceptive affiliate schemes.

Regulatory or Policy Developments

  • Eclipse Foundation Security Checks: The Eclipse Foundation will require mandatory security checks before publishing Microsoft Visual Studio Code (VS Code) extensions to the Open VSX Registry.
  • Apple iOS Location Privacy: Apple introduced a “Limit Precise Location” setting to reduce the precision of device location tracking by cellular networks, with limited current support.