Major Incidents or Breaches

  • The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
  • Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
  • A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
  • ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
  • A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
  • Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
  • A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
  • The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
  • A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

  • Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
  • A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
  • Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
  • A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
  • Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
  • A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
  • Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
  • A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

  • Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
  • The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
  • U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
  • Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
  • The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
  • A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
  • Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

  • AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
  • Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
  • Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
  • Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
  • A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
  • Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
  • OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
  • Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

  • NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
  • Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
  • The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.