Major Incidents or Breaches

  • AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
  • LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
  • Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
  • The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
  • Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
  • Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
  • Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

  • VMware Aria Operations (CVE-2026-22719): A remote code execution vulnerability is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
  • Android/Qualcomm Zero-Day (CVE-2026-21385): An actively exploited high-severity memory corruption flaw in Qualcomm display components was patched in the latest Android update.
  • MS-Agent AI Framework: A vulnerability in Microsoft’s AI framework allows attackers to achieve full system compromise through improper input sanitization, exploitable via the Shell tool.
  • Chrome Extension Flaw: A now-patched vulnerability allowed Chrome extensions to inherit Gemini’s camera, microphone, and file access permissions.
  • AirSnitch Wi-Fi Attack: Researchers disclosed a Wi-Fi vulnerability (“AirSnitch”) that allows nearby attackers to intercept sensitive data and perform machine-in-the-middle attacks, demonstrating that Wi-Fi client isolation may not provide adequate protection.
  • Honeywell IQ4 Building Controllers: Dispute over the impact of vulnerabilities in internet-exposed building management controllers, with researchers claiming thousands are at risk.
  • CrushFTP: Ongoing brute-force scans reported against CrushFTP instances, which have a history of serious vulnerabilities.

Notable Threat Actor Activity

  • Fake IT Support/Havoc C2: Threat actors are using fake tech support spam to deploy customized Havoc command-and-control (C2) frameworks inside organizations, enabling data exfiltration and persistence.
  • OAuth Redirect Abuse: Microsoft warned of phishing campaigns abusing OAuth URL redirection and error flows to bypass email and browser phishing protections, delivering malware to government targets.
  • Starkiller Phishing Suite: A new phishing toolkit, Starkiller, uses adversary-in-the-middle (AitM) reverse proxy techniques to bypass multi-factor authentication.
  • Compromised Site Management Panels: Sale of compromised cPanel credentials is surging in cybercrime markets, facilitating plug-and-play phishing and scam operations.
  • Pro-Iranian Cyber Activity: Increased hacktivist campaigns and cyberattacks attributed to pro-Iranian actors in response to US-Israeli military actions, with an emphasis on causing economic and physical disruption.
  • Iranian Targeting of IP Cameras: Iranian-linked cyber operations are targeting IP cameras in conjunction with physical warfare in the Middle East.
  • Silver Dragon: A Chinese-aligned threat group, “Silver Dragon,” is targeting organizations in Southeast Asia and Europe, demonstrating operational links to broader campaigns.
  • AI-Driven FortiGate Attacks: Threat actors are leveraging the open-source CyberStrikeAI platform in AI-assisted attacks targeting Fortinet FortiGate appliances across 55 countries.
  • Coruna iPhone Hacking Toolkit: A sophisticated iPhone exploitation toolkit, believed to have originated from a US government contract, is now in the hands of foreign spies and criminals and has likely compromised tens of thousands of devices.

Trends, Tools, or Tactics of Interest

  • RMM Tool Phishing: Fake video meeting invites are being used to trick users into installing remote monitoring and management (RMM) tools, enabling unauthorized access.
  • AI Agent and Identity Risks: The rise of Model Context Protocol (MCP) and AI agents is introducing new, unmanaged workload identities, increasing the complexity of identity management and potential attack surfaces.
  • Quantum Threat to RSA: Recent developments indicate quantum decryption of RSA may be achievable sooner than previously expected, raising concerns over the security of current cryptographic standards.
  • AI in Security Testing: The deployment of open-source, AI-native security testing platforms is being observed in active cyberattacks, particularly against network appliances.
  • cPanel Marketplaces: The commoditization of compromised site management credentials is enabling scalable, automated phishing attacks.
  • Wi-Fi Client Isolation Limitations: AirSnitch research demonstrates that Wi-Fi client isolation may not prevent interception or manipulation of sensitive data.
  • Vehicle Tire Pressure Sensors: Research shows tire pressure sensors can leak data enabling silent tracking of vehicles.
  • Journalistic Operations in Censored Environments: Journalists in Iran are relying on satellite communications and encrypted apps to circumvent internet blackouts.

Regulatory or Policy Developments

  • CISA Action: The addition of VMware Aria Operations CVE-2026-22719 to CISA’s Known Exploited Vulnerabilities catalog mandates urgent mitigation for US federal agencies and highlights the vulnerability’s significance.
  • Pentagon AI Procurement: The US Department of Defense has dropped Anthropic AI from certain projects over security risks, with OpenAI taking over, reflecting ongoing scrutiny of AI model integration in sensitive environments.
  • Google Chrome Release Cycle: Google Chrome will move to a two-week release cycle, enabling faster deployment of security patches and features.