Major Incidents or Breaches

  • The Trivy vulnerability scanner was compromised in a supply chain attack attributed to the threat group TeamPCP. The attackers distributed credential-stealing malware via official Trivy releases and GitHub Actions, leading to the compromise of at least 47 npm packages with a self-spreading worm dubbed “CanisterWorm.”
  • A cyberattack on a car breathalyzer firm resulted in operational disruption, leaving drivers unable to start their vehicles due to system outages.
  • Iranian hackers conducted cyberattacks that disrupted medical care at hospitals in Maryland.

Newly Discovered Vulnerabilities

  • Oracle released patches addressing CVE-2026-21992, a critical unauthenticated remote code execution vulnerability in Oracle Identity Manager and Web Services Manager.
  • CISA added five vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalogue, mandating patching by April 3, 2026.
  • A critical vulnerability in Quest KACE, tracked as CVE-2025-32975, has been identified and may have been exploited in attacks targeting the education sector.

Notable Threat Actor Activity

  • Russian Intelligence Services-affiliated threat actors are conducting mass phishing campaigns targeting commercial messaging applications such as WhatsApp and Signal to compromise user accounts.
  • TeamPCP, the group behind the Trivy supply chain attack, is suspected of orchestrating follow-on attacks involving the deployment of infostealers and self-propagating malware across npm packages.
  • Iranian threat actors were responsible for cyberattacks that disrupted healthcare services in Maryland.

Trends, Tools, or Tactics of Interest

  • Microsoft Azure Monitor alerts are being abused in callback phishing campaigns, with attackers impersonating Microsoft Security Team notifications about unauthorized account charges to lure recipients.
  • The Trivy supply chain attack leveraged GitHub Actions to distribute infostealer malware, demonstrating continued threat actor interest in exploiting CI/CD pipelines and open-source distribution channels.
  • Google introduced “Advanced Flow” for Android, a new mechanism enabling more secure sideloading of APKs from unverified developers, aimed at enhancing security for power users.

Regulatory or Policy Developments Affecting the Security Industry

  • The U.S. CISA has mandated the patching of vulnerabilities affecting Apple, Craft CMS, and Laravel Livewire by April 3, 2026, following their addition to the KEV catalogue.