Major Incidents or Breaches

  • Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
  • An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
  • Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
  • Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

Newly Discovered Vulnerabilities

  • CISA has issued a warning about CVE-2026-24423, an unauthenticated remote code execution vulnerability in SmarterMail, which has been exploited in ransomware attacks.
  • Security researchers have identified multiple insecurities in the OpenClaw AI assistant, including vulnerabilities related to malicious add-ons (“skills”) and problematic configuration settings.
  • ESET product vulnerabilities were noted in a roundup of recent security issues, though specific details were not provided.

Notable Threat Actor Activity

  • A previously undocumented Asian state-backed group, tracked as TGR-STA-1030, has breached at least 70 government and critical infrastructure entities across 37 countries over the past year in a cyber espionage campaign.
  • China-linked threat actors have been operating the DKnife adversary-in-the-middle (AitM) framework since at least 2019, targeting routers and edge devices for traffic hijacking and malware delivery in espionage campaigns.
  • State-sponsored threat actors are suspected in the recent phishing campaign targeting senior figures in Germany via Signal.

Trends, Tools, or Tactics of Interest

  • A new malware-as-a-service kit called “Stanley” is offering guaranteed publication in the Chrome Web Store by bypassing Google’s security verification process.
  • Supply chain attacks continue to pose significant risk, as seen in the compromise of npm and PyPI packages and recent incidents involving self-propagating worms.
  • Modern browser-based attacks are increasingly able to evade detection by traditional EDR, email, and SASE solutions, operating entirely within the browser with minimal forensic evidence.
  • Apple Pay users are being targeted by phishing campaigns involving fake support calls designed to steal payment details.
  • Research highlights that attackers are evolving tradecraft to leverage AI assistants and agents in malicious operations (“living off the AI”).

Regulatory or Policy Developments Affecting the Security Industry

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a binding operational directive requiring federal agencies to identify and remove unsupported or end-of-life network edge devices to reduce federal network risk.
  • Five bills aimed at boosting cybersecurity defenses for the U.S. energy sector have cleared a House panel.
  • The European Commission has announced that TikTok is facing a large fine for addictive platform design elements that may violate regulatory standards.
  • The Electronic Frontier Foundation has launched the “Encrypt It Already” campaign, urging major technology companies to implement end-to-end encryption by default across their services.