Major Incidents or Breaches

  • The Dutch Ministry of Finance took its treasury banking portal and some systems offline following a detected cyberattack, as investigations into the breach continue.
  • Healthcare IT firm CareCloud disclosed a data breach exposing sensitive patient data and causing an eight-hour network disruption.
  • The European Commission reported a cyber intrusion and data theft, with the ShinyHunters group claiming to have stolen over 350GB of information from Commission cloud systems.
  • The FBI confirmed Iranian hackers compromised the personal email account of Kash Patel, noting the data accessed was outdated.
  • Researchers report that nearly 66 billion stolen identity records are now circulating on criminal forums, a 23% increase from the previous year.
  • Stolen tax documents are being actively sold on the dark web, with prices ranging from $4 to $20 per identity.
  • TeamPCP supply chain campaign continues to expand, with Telnyx targeted and Databricks investigating an alleged compromise. The campaign involves dual ransomware operations and data leaks, including AstraZeneca data.

Newly Discovered Vulnerabilities

  • Citrix NetScaler ADC and Gateway appliances are affected by a critical memory leak vulnerability (CVE-2026-3055) that is being actively exploited to obtain sensitive data, including authenticated administrative session IDs. CISA has ordered U.S. federal agencies to patch the flaw by Thursday.
  • F5 BIG-IP APM vulnerability (CVE-2025-53521), initially classified as a high-severity DoS, has been reclassified as a critical remote code execution (RCE) vulnerability. Active exploitation has been observed, with attackers deploying webshells on unpatched devices.
  • A previously unknown vulnerability in OpenAI ChatGPT allowed exfiltration of sensitive conversation data without user consent. Additionally, a critical vulnerability in OpenAI Codex was discovered that could have enabled compromise of GitHub tokens.
  • A critical, alleged “no-click” vulnerability in Telegram, reportedly triggered by a corrupted sticker and rated 9.8 CVSS, is being disputed by Telegram.
  • A newly identified RoadK1ll WebSocket implant enables lateral movement within breached networks.
  • Axios npm package versions 1.14.1 and 0.30.4 were compromised in a supply chain attack, pushing a malicious dependency.
  • Apple added a security feature in macOS Tahoe 26.4 to block potentially harmful commands in Terminal, specifically targeting ClickFix attack vectors.

Notable Threat Actor Activity

  • Russian-origin CTRL remote access toolkit is being distributed via malicious LNK files masquerading as private key folders. The toolkit hijacks RDP sessions using FRP tunnels.
  • Russian APT Star Blizzard is using the DarkSword iOS exploit kit in campaigns targeting government, higher education, financial, legal, and think tank sectors.
  • Iranian state-affiliated threat group Handala Hack has been linked to recent attacks, and Iran-linked groups are increasingly turning to high-volume, low-impact cyberattacks, often leveraging AI.
  • The ShinyHunters group claimed responsibility for the European Commission data theft.
  • TeamPCP is running dual ransomware operations and leveraging compromised software supply chains to target multiple organisations.

Trends, Tools, or Tactics of Interest

  • Secrets sprawl is accelerating, with GitGuardian reporting a significant increase in exposed secrets across public Git repositories in 2025.
  • The DeepLoad malware loader, distributed via ClickFix social engineering, uses AI-assisted code obfuscation and WMI persistence to evade detection and steal browser credentials.
  • LLMs (Large Language Models) are increasingly used by attackers and defenders; however, improper use can inadvertently weaken access controls due to errors or hallucinations in generated policy code.
  • Application control bypass techniques are being used for data exfiltration, highlighting ongoing risks of data loss even where backup policies are robust.
  • AI-powered SOC agents are being evaluated for their impact on alert fatigue and operational efficiency, with Gartner providing guidance on assessment.
  • Manufacturing and healthcare sectors continue to struggle with access management, often viewing it as a roadblock, while attackers exploit weak password practices.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA issued a directive requiring U.S. federal agencies to patch Citrix NetScaler appliances against an actively exploited vulnerability by Thursday.
  • Apple has implemented mandatory age checks for certain UK users and introduced new macOS security features to counter emerging threats like ClickFix.