Major Incidents or Breaches

  • Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
  • Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
  • A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Newly Discovered Vulnerabilities

  • Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
  • Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
  • Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
  • Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
  • Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
  • CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

Notable Threat Actor Activity

  • The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.
  • Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.
  • Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.
  • New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.
  • Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.
  • AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.

Trends, Tools, or Tactics of Interest

  • AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.
  • AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.
  • Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.
  • Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.
  • Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.
  • A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.
  • Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.
  • Malware campaigns are increasingly using steganography, such as embedding payloads in image files.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.
  • CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.