Major Incidents or Breaches

  • A hacktivist group claims to have breached the Mexican government, allegedly leaking 2.3 terabytes of data affecting 36 million citizens. The government disputes the sensitivity of the leaked data.
  • Notepad++ update infrastructure was compromised by suspected Chinese state-backed hackers, resulting in the distribution of a backdoored version of the application.
  • Ongoing web traffic hijacking campaigns are targeting NGINX servers and management panels such as Baota (BT), redirecting user traffic through attacker-controlled infrastructure.
  • The DEAD#VAX malware campaign is deploying AsyncRAT via IPFS-hosted VHD phishing files, using advanced evasion techniques to bypass traditional security controls.
  • Iranian threat actors continue credential theft operations targeting expatriates, Syrians, and Israelis using spear-phishing and social engineering.
  • Attackers are leveraging Windows .scr screensaver files to deliver malware and remote management tools, exploiting the fact that these executables often evade standard controls.

Newly Discovered Vulnerabilities

  • Multiple critical vulnerabilities (including CVE-2026-25049) have been disclosed in the n8n workflow automation platform, allowing arbitrary system command execution and full host compromise. Public exploits are available.
  • A critical vulnerability in DockerDash, the AI assistant for Docker, allows remote code execution and data theft due to insufficient instruction validation in the MCP Gateway architecture.
  • VMware ESXi is affected by a high-severity sandbox escape vulnerability now exploited in ransomware attacks, as confirmed by CISA.
  • A five-year-old GitLab vulnerability is being actively exploited, prompting CISA to order urgent patching by US government agencies.
  • Google Looker contained vulnerabilities (dubbed LookOut) that allowed cross-tenant remote code execution and data exfiltration, putting multiple GCP environments at risk.
  • A fresh critical vulnerability in SolarWinds Web Help Desk is being exploited in the wild, allowing unauthenticated remote code execution.
  • Malicious NGINX configurations are being used to facilitate large-scale web traffic hijacking and exploitation via React2Shell, with attackers deploying cryptominers and reverse shells.
  • The EnCase forensic software kernel driver, though long-revoked, is being abused by attackers in an EDR killer tool to disable 59 security products.

Notable Threat Actor Activity

  • The Amaranth-Dragon group, linked to Chinese state-sponsored APT41, is exploiting the WinRAR CVE-2025-8088 vulnerability in espionage campaigns targeting government and law enforcement agencies across Southeast Asia.
  • Chinese threat actors hijacked Notepad++’s update infrastructure to distribute backdoored software.
  • Iranian state actors are conducting ongoing credential theft campaigns across the Middle East.
  • Ransomware group DragonForce is promoting a cartel model, increasing coordination among ransomware gangs.
  • Hackers are abusing legitimate but revoked drivers to disable endpoint detection and response (EDR) solutions.

Trends, Tools, or Tactics of Interest

  • AI-driven phishing attacks are increasing in sophistication, with attackers combining technical exploits and identity-based attacks to bypass email security solutions.
  • Leaked non-human identities, such as API keys and tokens, are becoming significant breach drivers in cloud environments, providing attackers with persistent access.
  • Attackers are increasingly abusing less-monitored file types (e.g., .scr screensaver files) and legitimate system features to evade detection.
  • Microsoft has developed a lightweight scanner for detecting backdoors in open-weight large language models (LLMs).
  • Microsoft is rolling out built-in Sysmon security monitoring in Windows 11 Insider builds, enhancing native endpoint visibility.
  • Orchid Security has introduced continuous identity observability for enterprise applications, addressing identity management beyond traditional IAM controls.
  • Prompt injection and data leakage risks have been identified in AI agent networks such as Moltbook.
  • Early incident response failures are often due to decision-making in the first moments after detection, not technical shortcomings.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has made unpublicized updates to its Known Exploited Vulnerabilities (KEV) catalog, highlighting ransomware operators’ focus on network edge device vulnerabilities.
  • CISA has mandated the patching of actively exploited legacy vulnerabilities in products such as GitLab.
  • Mozilla Firefox is introducing an AI feature opt-out, reflecting a trend toward increased user control over AI-driven browser functions.

Industry and Market Developments

  • Blockchain intelligence firm TRM Labs raised $70 million in Series C funding to expand AI-driven disruption of criminal networks.
  • Varonis acquired AllTrue.ai for $150 million to enhance AI trust, risk, and security management capabilities.
  • Orion raised $32 million for data security product development and market expansion.