Major Incidents or Breaches

  • HackerOne disclosed a data breach impacting hundreds of employees, following a compromise of its US benefits administrator, Navia.
  • Infinite Campus, a widely used K-12 student information system, warned of a data breach and extortion attempt, attributed to the ShinyHunters threat actor.
  • The Dutch Ministry of Finance confirmed a breach affecting internal systems, detected in the previous week.
  • QualDerm, a healthcare provider, suffered a breach impacting 3.1 million individuals, with personal, medical, and insurance data stolen.
  • Extortion group Lapsus$ claimed to have compromised AstraZeneca, including internal code repositories, credentials, and employee data.

Newly Discovered Vulnerabilities

  • PTC Inc. warned of a critical remote code execution vulnerability affecting its Windchill and FlexPLM product lifecycle management solutions.
  • A critical Citrix NetScaler vulnerability was disclosed, allowing unauthenticated remote attackers to read sensitive information from memory.
  • Chrome 146 was released, addressing eight high-severity memory safety vulnerabilities across seven components.
  • Firefox 149 introduced a built-in VPN with a 50GB monthly data limit, enhancing privacy protections.
  • Researchers highlighted ongoing risks and vulnerabilities in IP KVM devices, following recent reports from Eclypsium.

Notable Threat Actor Activity

  • TeamPCP continued its supply chain attacks, compromising the popular LiteLLM Python package on PyPI (versions 1.82.7–1.82.8) via a Trivy CI/CD compromise, embedding credential harvesters and affecting hundreds of thousands of developers. TeamPCP was also linked to attacks on Trivy, Checkmarx KICS, and VS Code plug-ins, as well as recent compromises of GitHub Actions workflows through stolen CI credentials.
  • A large-scale malvertising campaign has been leveraging tax-related search ads since January 2026, distributing rogue installers for ConnectWise ScreenConnect. The campaign uses a Huawei driver to disable endpoint detection and response (EDR) solutions.
  • The Ghost campaign was identified as distributing seven malicious npm packages aimed at stealing cryptocurrency wallets and credentials.
  • Ongoing phishing campaigns are targeting French-speaking enterprises with fake resumes, leading to the deployment of information stealers and cryptocurrency miners.
  • FBI and CISA, along with European agencies, warned of Russian threat actors hijacking Signal and WhatsApp accounts via scalable social engineering campaigns.
  • Scam compounds are hiring individuals to appear as “AI models” in deepfake video calls to facilitate fraud.

Trends, Tools, or Tactics of Interest

  • The number of newly reported vulnerabilities is expected to exceed 100,000 this year, with a noted trend toward faster exploitation of zero-days.
  • Security researchers observed a rise in supply chain attacks targeting open-source software and developer tools, with AI-assisted campaigns distributing trojanized packages (e.g., OpenClaw Deployer on GitHub).
  • Increased use of credential-stealing malware targeting CI/CD pipelines and package repositories.
  • Attackers are using legitimate drivers (e.g., Huawei) to disable EDR in malware campaigns.
  • There is a continued increase in phishing campaigns leveraging social engineering and fake documentation (e.g., resumes) to gain initial access.
  • AI and agentic AI systems are being increasingly targeted, as evidenced by the McKinsey Lilli platform hack and discussions on the need for better governance and identity controls.
  • JPMorgan Chase reported the use of AI digital twins and digital fingerprints for advanced threat hunting and reducing false positives.
  • Endpoint security is being challenged by AI coding tools, which facilitate bypassing traditional defenses.
  • Surveillance systems are being targeted in geopolitical conflicts, as demonstrated by Israel’s exploitation of Iran’s camera network.

Regulatory or Policy Developments

  • The US Federal Communications Commission (FCC) updated its Covered List to ban the sale of all new consumer routers manufactured outside the USA, citing security risks.
  • The US Department of Energy (DoE) published a five-year energy security plan (Project Armor) to harden critical energy infrastructure.
  • Microsoft proposed new identity and governance guardrails for agentic AI systems to address emerging threats from autonomous AI agents.
  • Gartner released its first Market Guide for Guardian Agents, highlighting the emergence of this security technology category.
  • A Russian national received an 81-month prison sentence for acting as an initial access broker for Yanluowang ransomware attacks.