Major Incidents or Breaches

  • Trellix disclosed a data breach following unauthorised access to a portion of its source code repository. The investigation found no impact on source code release or distribution processes.
  • DigiCert revoked certificates after hackers exploited a customer chat channel to deliver malware, infect an analyst’s system, and access the internal support portal.
  • Over 40,000 servers have been compromised in ongoing exploitation of a critical cPanel vulnerability (CVE-2026-41940), with attacks targeting government, military, managed service providers (MSPs), and hosting providers in Southeast Asia.
  • Medtronic, a global medical device manufacturer, disclosed a security incident, as referenced in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

  • A critical remote code execution vulnerability (CVE-2026-22679) in Weaver (Fanwei) E-cology office automation software has been under active exploitation since March 2026.
  • Progress Software patched two security flaws in MOVEit Automation, including a critical authentication bypass vulnerability. Customers have been urged to apply updates immediately.
  • The “Copy Fail” Linux vulnerability is now being actively exploited in the wild. CISA has added it to its Known Exploited Vulnerabilities (KEV) list, and Microsoft has observed limited exploitation linked to proof-of-concept testing.

Notable Threat Actor Activity

  • The China-based group Silver Fox has been linked to a campaign targeting organisations in India and Russia using tax-themed phishing emails to deliver the new ABCDoor malware, as well as ValleyRAT and Sainbox malware.
  • A previously unknown threat actor has been exploiting the cPanel authentication-bypass vulnerability to target government, military, MSP, and hosting provider networks, with evidence of zero-day activity prior to public disclosure.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly abusing Amazon Simple Email Service (SES) and Google AppSheet to send phishing emails that bypass standard security filters, making detection more challenging.
  • Multiple large-scale phishing campaigns are leveraging legitimate remote monitoring and management (RMM) tools such as SimpleHelp and ScreenConnect to establish persistent remote access, impacting over 80 organisations since April 2025.
  • Microsoft detailed a phishing campaign targeting 35,000 users across 26 countries using code of conduct-themed lures and legitimate email services for credential theft.
  • A malicious version of the PyTorch Lightning package was published on PyPI, delivering a credential-stealing payload targeting browsers, environment files, and cloud services.
  • Deepfake-driven fraud has resulted in $2.19 billion in global losses, with the majority attributed to investment scams.
  • Fraudsters are exploiting legitimate business processes at credit unions using structured loan fraud and stolen identities, rather than direct hacking.
  • The 2026 World Cup is being leveraged in a multi-faceted scam economy involving fake visas, fraudulent tokens, and other schemes.
  • AI-assisted attacks are on the rise, with increased use of artificial intelligence to enhance phishing and other malicious activities.
  • Thousands of Facebook accounts have been compromised through phishing emails sent via Google services, evading standard email security controls.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA added the “Copy Fail” Linux vulnerability to its Known Exploited Vulnerabilities (KEV) list, mandating federal agencies to mitigate the issue.
  • OpenAI introduced Advanced Account Security for ChatGPT accounts, including stronger login methods, improved account recovery, and training data exclusion.
  • Cisco announced the acquisition of Astrix Security to strengthen its capabilities around non-human identity risks, particularly for AI and machine access.