Major Incidents or Breaches

  • The “Sorry” ransomware group is conducting mass exploitation of a critical cPanel vulnerability (CVE-2026-41940) to breach websites and encrypt data.

Newly Discovered Vulnerabilities

  • CISA has added CVE-2026-31431, a Linux root access vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw impacts multiple Linux distributions and is currently being actively exploited.

Notable Threat Actor Activity

  • A Finnish teenager has been formally charged in connection with the Scattered Spider hacking spree.
  • The “Sorry” ransomware group is actively exploiting the cPanel vulnerability (CVE-2026-41940) in widespread attacks.

Trends, Tools, or Tactics of Interest

  • A new phishing kit called Bluekit, still under development, includes automated domain registration features and an integrated AI assistant to aid attackers.
  • “ConsentFix v3” attacks are targeting Azure environments by automating OAuth abuse at scale, with the technique being circulated on hacker forums.
  • Disneyland has introduced facial recognition technology for visitor identification.
  • The NSA is testing Anthropic’s Mythos Preview tool to identify vulnerabilities.