Major Incidents or Breaches

  • The European Commission is investigating a security breach after a threat actor gained access to its Amazon cloud environment.
  • The Dutch National Police disclosed a security breach resulting from a successful phishing attack; the impact is described as limited and did not affect citizens’ data.
  • A pro-Iranian hacking group claimed responsibility for breaching the personal email account of FBI Director Kash Patel, releasing emails and documents.
  • Bearlyfy, a pro-Ukrainian group, has conducted over 70 cyberattacks targeting Russian companies since January 2025, recently deploying custom GenieLocker ransomware.
  • TeamPCP compromised the Telnyx Python package on PyPI, pushing malicious versions that deliver credential-stealing malware hidden in WAV files as part of an ongoing supply chain campaign.
  • Developers on GitHub are being targeted by a large-scale campaign using fake Visual Studio Code (VS Code) security alerts to spread malware.
  • Apple is sending Lock Screen alerts to iPhones and iPads running outdated iOS/iPadOS versions, warning of active web-based exploits and urging immediate updates.
  • The Alliance for Creativity and Entertainment (ACE) announced the shutdown of AnimePlay, an illegal streaming platform with over 5 million users.

Newly Discovered Vulnerabilities

  • CISA added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager (APM), to its Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation.
  • A now-patched bug in Open VSX’s pre-publish scanning pipeline allowed malicious VS Code extensions to bypass security checks.
  • Three vulnerabilities in the widely used AI frameworks LangChain and LangGraph could expose filesystem data, environment secrets, and database contents if exploited.
  • TP-Link patched high-severity router vulnerabilities that could allow attackers to bypass authentication, execute arbitrary commands, and decrypt configuration files.
  • A critical PTC Windchill vulnerability (CVE-2026-4681) prompted German police to physically warn organizations due to the risk.
  • Coruna iOS Exploit Kit, likely an update to Operation Triangulation, contains an updated kernel exploit targeting iOS devices.

Notable Threat Actor Activity

  • TA446, a threat actor linked to Russia, is leveraging the leaked DarkSword iOS exploit kit in targeted spear-phishing campaigns against iOS devices.
  • TeamPCP continues its supply chain attack campaign, recently compromising the telnyx PyPI package and previously targeting Trivy, KICS, and litellm.
  • Chinese APT group Red Menshen has upgraded its BPFdoor backdoor malware, improving its capabilities to evade traditional detection and targeting global telecommunications providers.
  • Threat actors are using adversary-in-the-middle (AitM) phishing techniques with Cloudflare Turnstile evasion to compromise TikTok for Business accounts.
  • Criminals are renting virtual phones to bypass bank security checks, enabling them to circumvent fraud detection systems.
  • A fake Avast website is distributing Venom Stealer malware under the guise of a virus scan, stealing passwords, session data, and cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

  • Researchers at LayerX demonstrated that custom fonts can be used to trick AI web assistants into misclassifying phishing sites as benign, while presenting a deceptive view to human users.
  • Adaptive email security solutions are being highlighted as necessary to counter increasingly sophisticated, AI-driven phishing attacks that mimic executive communications and reference specific projects.
  • Wartime exploitation of compromised IP cameras by multiple nation-states is increasing, providing adversaries with surveillance capabilities inside rival borders.
  • There is a 25% decrease in infrastructure attacks with physical consequences, attributed to a lull in ransomware activity and limited attacker knowledge of operational technology (OT) systems.
  • Large-scale use of fake security alerts on developer platforms (e.g., GitHub) is being used to distribute malware to software development communities.
  • Agentic GRC (Governance, Risk, and Compliance) automation is driving a shift in team roles from operational execution to risk leadership.

Regulatory or Policy Developments

  • Google has set a 2029 deadline for migration to quantum-safe (post-quantum) cryptography across its services.
  • OpenAI launched a bug bounty program, offering rewards for reports of abuse and safety risks, including design and implementation flaws that could cause material harm.