Major Incidents or Breaches

  • Vercel, a cloud development and web infrastructure provider, has disclosed a security breach involving unauthorized access to certain internal systems. The incident is linked to the compromise of Context AI. Threat actors claim to be selling stolen data allegedly obtained from the breach. Vercel has confirmed the incident and is investigating the scope of exposed customer credentials.

Notable Threat Actor Activity

  • Threat actors are abusing Apple account change notifications to deliver phishing emails. The phishing campaigns leverage legitimate emails sent from Apple’s servers to increase credibility, with messages designed to appear as iPhone purchase alerts.

Newly Discovered Vulnerabilities

  • A flaw in discontinued TP-Link routers has been the target of in-the-wild exploitation attempts for approximately a year. However, no successful payload executions have been observed to date.

Regulatory or Policy Developments Affecting the Security Industry

  • The US National Institute of Standards and Technology (NIST) will cease assigning severity scores to lower-priority vulnerabilities due to an increased volume of submissions. This change is intended to address the growing workload associated with the vulnerability disclosure process.