Major Incidents or Breaches

  • The European Commission confirmed a data breach resulting from the Trivy supply chain attack, with attackers exfiltrating over 300GB of data from the Commission’s AWS environment, including personal information.
  • Hackers reportedly stole Cisco source code as part of an ongoing supply chain hacking campaign.
  • The FBI disclosed that a recent hack of its wiretap tools poses a national security risk.

Newly Discovered Vulnerabilities

  • Fortinet released out-of-band patches for a critical vulnerability in FortiClient EMS, tracked as CVE-2026-35616. The flaw has a high CVSS score and has been actively exploited in the wild.

Notable Threat Actor Activity

  • Researchers identified 36 malicious npm packages disguised as Strapi CMS plugins. These packages delivered various payloads to exploit Redis and PostgreSQL databases, enabling persistent implants.
  • Axios maintainers detailed a targeted social engineering campaign where a developer was tricked by a fake Microsoft Teams error fix, leading to the hijacking of a maintainer account. The campaign is believed to be linked to a sophisticated threat actor.

Trends, Tools, or Tactics of Interest

  • Device code phishing attacks leveraging the OAuth 2.0 Device Authorization Grant flow have surged 37-fold this year, driven by the proliferation of new phishing kits available online.
  • Malicious actors are distributing the leaked Claude AI code online, bundling it with additional malware.