Major Incidents or Breaches

  • ManoMano, a major European DIY retail chain, has suffered a data breach impacting 38 million customers. The breach was caused by the compromise of a third-party service provider.
  • French football club Olympique de Marseille confirmed an attempted cyberattack following a data leak, with a threat actor claiming responsibility for breaching the club’s systems.
  • Conduent, a US-based business process services company, has revised the impact of its third-party breach to 25 million affected Americans.
  • A new malicious NuGet package, “StripeApi,” was discovered impersonating a legitimate Stripe library to steal API tokens, targeting the financial sector.
  • Google API keys previously considered harmless can now be abused to access private Gemini AI data if exposed in client-side code.
  • Anthropic patched vulnerabilities in its Claude AI code interpreter that could have allowed silent compromise of developer devices through malicious configuration files.

Newly Discovered Vulnerabilities

  • Trend Micro patched two critical remote code execution vulnerabilities in Apex One endpoint security products for Windows, and addressed a total of eight critical and high-severity issues across Windows and macOS versions.
  • A critical vulnerability in Juniper Networks’ PTX Series routers running Junos OS Evolved allows unauthenticated remote code execution with root privileges, enabling full router takeover.
  • Cisco disclosed and patched a maximum-severity zero-day vulnerability (CVE-2026-20127) in its SD-WAN software, which had been exploited for three years by a sophisticated threat actor, allowing authentication bypass and administrative access.
  • Zyxel patched a critical remote code execution vulnerability in the UPnP function affecting multiple device models.
  • Four vulnerabilities were disclosed in Gardyn smart garden products, allowing remote hacking; CISA has issued an advisory on these flaws.

Notable Threat Actor Activity

  • Google’s Threat Intelligence Group reported that nation-state actors are using Gemini and other AI tools to enhance phishing, malware development, and social engineering campaigns.
  • A previously undocumented threat cluster, UAT-10027, has been targeting US education and healthcare sectors since December 2025, deploying the Dohdoor backdoor.
  • The Aeternum C2 botnet loader was revealed to use encrypted command storage on the Polygon blockchain, making its command-and-control infrastructure highly resistant to takedown.
  • Microsoft observed a coordinated campaign targeting developers via malicious Next.js repositories purporting to be legitimate, delivering in-memory malware and establishing persistence.
  • Fake Zoom and Google Meet scams are distributing the legitimate Teramind monitoring tool as malware by exploiting trusted branding.
  • CISA released an updated analysis of the RESURGE malware, highlighting continued stealthy and active operations.
  • The US Treasury sanctioned Russian exploit broker Operation Zero, which acquired eight zero-day exploits from a US defense contractor.

Trends, Tools, or Tactics of Interest

  • Ransomware payment rates have dropped to a record low of 28% despite an increase in the number of attacks, indicating a shift in victim response and negotiation strategies.
  • Threat actors are increasingly leveraging AI-based tools, such as Gemini and Claude, to automate and refine attack techniques.
  • Blockchain technology is being adopted for resilient command-and-control infrastructure, as demonstrated by the Aeternum C2 botnet.
  • There is a rise in attacks targeting developers, including via malicious open-source packages and fake technical assessment repositories.
  • Open source project IronCurtain has been released, aiming to constrain and secure AI assistant agents to prevent unintended actions.

Regulatory or Policy Developments Affecting the Security Industry

  • Apple iPhone and iPad devices have been cleared for handling classified information by NATO, having been added to the NATO Information Assurance Product Catalogue (NIAPC).
  • The US government has imposed sanctions on Russian exploit broker Operation Zero for trafficking zero-day exploits.
  • A lawsuit (Marquis v. SonicWall) is raising questions about liability in third-party breaches, with a FinTech company holding a firewall provider responsible for breach damages.
  • New York Attorney General filed a lawsuit against Valve Corporation, alleging illegal gambling promotion through game loot boxes targeting minors.
  • Industry experts are recommending immediate preparation for post-quantum cryptography (PQC) to counter future risks of encrypted data theft and decryption.