Major Incidents or Breaches

  • Bitwarden CLI npm package was compromised as part of a wider Checkmarx supply chain attack campaign. Attackers uploaded a malicious @bitwarden/cli package to npm, which contained a credential-stealing payload capable of spreading to other projects. The incident is linked to the Shai-Hulud worm and affected developer environments.
  • Checkmarx KICS analysis tool was impacted in the same supply chain campaign, with compromised Docker images, VSCode, and Open VSX extensions used to harvest sensitive data from developer environments.
  • Vercel disclosed additional compromised customer accounts following a breach that enabled unauthorized access to internal systems.
  • Dutch cosmetics company Rituals reported a data breach affecting customers of its “My Rituals” membership programme, with personal information including names and addresses accessed by attackers.
  • A $290 million DeFi hack was reported, details unspecified but significant in scale.
  • Hackers are actively exploiting a critical file upload vulnerability in the Breeze Cache WordPress plugin, allowing unauthenticated arbitrary file uploads to affected servers.

Newly Discovered Vulnerabilities

  • PhantomRPC: A newly discovered Windows RPC privilege escalation technique enables attackers to create fake RPC servers and escalate privileges.
  • LMDeploy CVE-2026-33626: A high-severity flaw in the LMDeploy open-source toolkit for LLMs was publicly disclosed and exploited in the wild within 13 hours.
  • Apple patched CVE-2026-28950, a Notification Services vulnerability in iOS/iPadOS (versions 26.4.2 and 18.7.8), which allowed recovery of deleted notifications, including chat previews.
  • CISA ordered US federal agencies to patch a Microsoft Defender privilege escalation zero-day, dubbed BlueHammer, that has been actively exploited.
  • Cisco ASA, Firepower, and Secure Firewall products are being targeted by FIRESTARTER malware, with CISA issuing an alert regarding ongoing exploitation.

Notable Threat Actor Activity

  • GopherWhisper, a newly identified China-aligned APT group, has targeted at least 12 Mongolian government systems using Go-based backdoors and leveraging legitimate services such as Microsoft Outlook, Slack, Discord, and file.io for command and control communications.
  • UNC6692, a previously undocumented threat cluster, has been observed impersonating IT helpdesk staff via Microsoft Teams and deploying a custom malware suite (SNOW) through social engineering attacks.
  • Trigona ransomware operators are using a custom command-line exfiltration tool to accelerate and improve data theft from compromised environments.
  • Tropic Trooper, a Chinese state-sponsored APT, is expanding its targeting to include home routers and Japanese entities, diversifying its tools and attack vectors.
  • Chinese state-backed groups are increasingly industrializing botnets, using large-scale proxy networks of hijacked consumer devices to mask attack origins and evade detection, as highlighted in coordinated advisories from the UK NCSC, CISA, and international partners.

Trends, Tools, or Tactics of Interest

  • Supply chain attacks continue to escalate, with recent campaigns compromising widely used developer tools and npm packages, demonstrating ongoing risk to software supply chains.
  • Attackers are increasingly exploiting trusted relationships and routine business workflows, moving away from purely technical exploits to weaponize internal trust and social engineering.
  • AI-driven attack automation is advancing rapidly. Proofs of concept such as Zealot demonstrate that AI agents can autonomously conduct penetration testing operations-including reconnaissance, exploitation, and exfiltration-at speeds that challenge human defenders. Anthropic’s Project Glasswing AI model has shown exceptional vulnerability discovery capabilities, prompting withheld public release.
  • Social engineering via IT helpdesk impersonation is being used to bypass security controls, particularly through password reset abuse and collaboration platform phishing.
  • Legitimate cloud and collaboration tools (e.g., Microsoft 365 Outlook, Slack, Discord) are being repurposed by APTs for covert command and control.
  • macOS “Living off the Land” (LotL) abuse and SIM farm-based proxy networks are noted as emerging or ongoing tactics.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA, the UK NCSC, and international partners issued a joint advisory warning of Chinese government-linked covert cyber networks, with emphasis on the use of proxy botnets and evasion techniques.
  • CISA mandated urgent patching of the Microsoft Defender BlueHammer vulnerability across US federal agencies, responding to evidence of active zero-day exploitation.