Major Incidents or Breaches

  • DAEMON Tools supply chain attack: Installers downloaded from the official DAEMON Tools website since 8 April were trojanised, delivering a sophisticated backdoor to thousands of systems globally. Government and scientific entities were among those targeted, though the backdoor was selectively deployed on a limited number of systems.
  • Vimeo data breach: The ShinyHunters extortion group accessed and exfiltrated personal information of over 119,000 users following a breach of the Vimeo platform in April.
  • Instructure breach: A hacker claims to have stolen 280 million data records from 8,809 educational institutions by breaching Instructure, exposing student and staff data.
  • Trellix source code breach: Attackers accessed source code for Trellix security products, potentially exposing detection mechanisms and product controls.
  • Taiwan high-speed rail hack: A university student was arrested for exploiting the TETRA communication system to trigger emergency brakes on Taiwan’s high-speed railway.
  • CloudZ RAT exploitation via Windows Phone Link: Researchers disclosed an incident involving the CloudZ remote access tool, leveraging a previously undocumented plugin (“Pheno”) to steal credentials and OTPs.
  • Government targeting by UAT-8302: China-linked APT group UAT-8302 was attributed to ongoing attacks against government entities in South America and South Asia, using malware shared across regions.

Newly Discovered Vulnerabilities

  • Palo Alto Networks PAN-OS (CVE-2026-0300): A critical buffer overflow vulnerability in PAN-OS User-ID Authentication Portal is under active exploitation, enabling remote code execution on PA and VM series firewalls.
  • Apache HTTP/2 (CVE-2026-23918): A severe vulnerability in Apache HTTP Server’s HTTP/2 implementation could allow denial-of-service and potential remote code execution. Security updates have been released.
  • MetInfo CMS (CVE-2026-29014): A critical flaw in the open-source MetInfo CMS is being actively exploited for remote code execution attacks.
  • Android System (CVE-2026-0073): A critical remote code execution vulnerability was patched in Android’s System component, exploitable without user interaction.
  • Ollama “Bleeding Llama”: A critical heap out-of-bounds read issue in Ollama LLM deployments could be exploited remotely and without authentication, potentially affecting up to 300,000 deployments.
  • WhatsApp: Two newly patched vulnerabilities could have allowed attackers to send malicious files to users, potentially leading to malware infection.
  • Microsoft Edge: Proof-of-concept exploits show that passwords are stored in process memory and can be extracted by users with admin privileges, posing an enterprise risk.

Notable Threat Actor Activity

  • ShinyHunters: Responsible for the Vimeo data breach, exfiltrating user personal information.
  • UAT-8302 (China-linked APT): Conducting cross-regional campaigns targeting government agencies using shared APT malware.
  • Karakurt ransomware group: A Latvian national, Deniss Zolotarjovs, was sentenced in the US for his role as a negotiator in extortion operations.
  • Quasar Linux (QLNX) malware: A new, previously undocumented Linux implant is targeting software developers with rootkit, backdoor, and credential-stealing features.

Trends, Tools, or Tactics of Interest

  • Supply chain attacks: DAEMON Tools and Trellix incidents highlight the ongoing risk of supply chain compromise, with attackers leveraging trusted software distribution channels.
  • OAuth token persistence: Many AI tools and productivity apps connected to Google or Microsoft environments leave persistent OAuth tokens without expiration or automated revocation, increasing lateral movement and persistence risks.
  • AI service exposure: Scans of one million exposed AI services reveal significant security gaps as businesses rapidly adopt AI technologies, with insecure deployments and insufficient access controls.
  • Social engineering and AI: Evolution in phishing and social engineering tactics, now leveraging AI to create more convincing lures and automate attacks, as noted in new KnowBe4 SAT platform updates and recent phishing campaigns.
  • Binary Transparency for Android: Google has expanded public verification of Android app binaries to prevent supply chain attacks.
  • Microsoft phishing campaign: Ongoing sophisticated phishing attacks against US organisations, using adversary-in-the-middle (AitM) techniques to harvest credentials.
  • Jailbreaking and data poisoning AI models: Security researchers are actively probing AI guardrails for weaknesses, using jailbreaking and data poisoning to demonstrate attack vectors.

Regulatory or Policy Developments

  • FTC action against Kochava: The US Federal Trade Commission will ban data broker Kochava and its subsidiary from selling Americans’ location data without explicit consent, as part of a legal settlement.
  • Oracle patch cadence: Oracle will now release monthly critical security patch updates, aiming to address high-priority vulnerabilities more rapidly.
  • SSL.com root certificate rotation: SSL.com rotated its root certificate as part of standard lifecycle management.
  • CISA critical infrastructure initiative: The US Cybersecurity and Infrastructure Security Agency (CISA) announced a new initiative to strengthen the security of critical infrastructure.