Major Incidents or Breaches

  • Wikipedia experienced a security incident involving a self-propagating JavaScript worm that vandalized pages and modified user scripts across multiple Wikimedia wikis.
  • The FBI arrested a suspect linked to the theft of over $46 million in cryptocurrency from the U.S. Marshals Service. The individual is the son of a U.S. government contractor.
  • LeakBase, a stolen credential marketplace active since 2021 with 142,000 users, was shut down by law enforcement and suspects were arrested.
  • Spanish and Ukrainian law enforcement dismantled an online gambling ring that exploited war-displaced Ukrainian women, laundering nearly €4.75 million.
  • Phobos ransomware administrator Evgenii Ptitsyn, a Russian national, pleaded guilty to wire fraud conspiracy in the US after extradition from South Korea.

Newly Discovered Vulnerabilities

  • Cisco disclosed two actively exploited vulnerabilities in Catalyst SD-WAN Manager (CVE-2026-20128, CVE-2026-20122), urging immediate upgrades of affected devices.
  • Cisco released patches for 48 vulnerabilities in their Firewall ASA, Secure FMC, and Secure FTD products, including two critical vulnerabilities rated CVSS 10.0.
  • A critical vulnerability in the User Registration & Membership plugin for WordPress (installed on over 60,000 sites) is being exploited to create unauthorized admin accounts.
  • Google’s Threat Intelligence Group reported that 90 zero-day vulnerabilities were exploited in 2025, with nearly half targeting enterprise software and appliances.

Notable Threat Actor Activity

  • A suspected Iran-linked group, Dust Specter, targeted Iraqi government officials using new malware strains SPLITDROP and GHOSTFORM, delivered by impersonating the Iraqi Ministry of Foreign Affairs.
  • Russian state-linked APT28 conducted a campaign against Ukrainian entities, deploying two new malware families: BadPaw loader and MeowMeow backdoor.
  • China-linked APT group UAT-9244 targeted telecommunications providers in South America since 2024, compromising Windows, Linux, and network-edge devices with a new malware toolkit.
  • Pakistan’s APT36 has adopted AI-driven “vibe-coding” techniques to produce large volumes of low-quality malware, potentially overwhelming defensive measures.
  • A phishing-as-a-service platform, Tycoon 2FA, known for its ability to bypass MFA, was dismantled following a joint operation by Europol and security vendors.

Trends, Tools, or Tactics of Interest

  • Messaging platforms are increasingly being abused as vectors for phishing and social engineering attacks, as reported by NCC Group’s Fox-IT.
  • Spear phishing attacks are on the rise, with attackers using more sophisticated, human-like emails and synthetically generated text to evade detection.
  • Threat actors are leveraging Bing’s AI-powered search to promote fake GitHub repositories, distributing information-stealing and proxy malware through deceptive OpenClaw installer links.
  • Attackers are preparing for a post-quantum cryptography era, collecting encrypted data now for potential future decryption once quantum capabilities become available.
  • Browser security is emerging as a significant blind spot in enterprises, with browsers now functioning as a de facto operating system for modern work, according to Keep Aware’s 2026 State of Browser Security Report.
  • MFA is not a comprehensive defense against credential abuse in Windows environments, as attackers continue to find ways to bypass or exploit MFA implementations.
  • Latin America is experiencing twice as many cyberattacks as the United States, attributed to lower cybersecurity maturity in the region.
  • The use of AI in malware development is increasing, enabling threat actors to scale operations and automate attack delivery.

Regulatory or Policy Developments Affecting the Security Industry

  • The US Supreme Court is set to decide on the constitutionality of geofence warrants, which allow law enforcement to collect location data from all devices near a crime scene. Google has advocated for these warrants to be struck down.