Major Incidents or Breaches

  • The ShinyHunters extortion group breached Instructure’s Canvas platform, exploiting a new vulnerability to deface login portals across hundreds of colleges and universities, disrupting classes and coursework nationwide. The campaign involved mass ransomware extortion and data theft.
  • RansomHouse ransomware group claimed responsibility for a breach of cybersecurity vendor Trellix, publishing screenshots of access to internal services.
  • Daemon Tools confirmed a supply chain attack affecting its distribution infrastructure; the vendor reports the attack has been contained, compromised files removed, and installation packages validated.
  • A massive AI investment scam operation was uncovered, spanning 15,500 domains and using the Keitaro ad-tracking platform for targeted victim exposure.
  • Thousands of web applications built using AI-driven platforms were found to be leaking sensitive corporate and personal data due to misconfiguration and insecure defaults.

Newly Discovered Vulnerabilities

  • CVE-2025-68670: A pre-authentication remote code execution (RCE) vulnerability was discovered in the xrdp server component, affecting Kaspersky USB Redirector. The issue has been patched.
  • Dirty Frag: A new, unpatched local privilege escalation (LPE) vulnerability in the Linux kernel allows attackers to gain root access on all major Linux distributions. It is a successor to the recently disclosed Copy Fail vulnerability.
  • CVE-2026-6973: Ivanti Endpoint Manager Mobile (EPMM) is affected by a high-severity RCE vulnerability, which has been exploited in limited zero-day attacks. Ivanti has released a patch.
  • PAN-OS Firewall Zero-Day: Palo Alto Networks disclosed that a critical RCE vulnerability in PAN-OS firewalls has been exploited in the wild since at least April 9, 2026. The campaign exhibits hallmarks of Chinese state-sponsored activity.
  • Vulnerabilities in Claude AI and associated tools (Claude Chrome extension, Claude Code, Cursor CLI, Gemini CLI, CoPilot CLI) allow code execution and OAuth token theft via malicious repositories or hijacking, due to lax permissions and insufficient warning dialogs.
  • Chrome 148 was released, addressing 127 security vulnerabilities, including critical-severity integer overflow and use-after-free bugs.

Notable Threat Actor Activity

  • PCPJack: A new credential-stealing malware framework, PCPJack, is actively targeting exposed cloud infrastructure. It spreads worm-like by exploiting five CVEs, steals credentials, and removes competing TeamPCP malware from infected environments. PCPJack uses parquet files for stealthy, pre-validated target discovery.
  • ShinyHunters: Conducted a mass extortion and ransomware campaign against the Canvas education platform, impacting thousands of educational institutions.
  • TCLBanker: A new banking trojan is self-spreading via WhatsApp and Outlook, targeting 59 banking, fintech, and cryptocurrency platforms. Initial infection is delivered through a trojanized MSI installer.
  • Ongoing campaigns using ClickFix social engineering are distributing Vidar Stealer malware, as warned by the Australian Cyber Security Center.
  • Fake Claude AI website is distributing a new Windows backdoor, “Beagle,” through malicious downloads.

Trends, Tools, or Tactics of Interest

  • Credential theft and session hijacking remain prevalent, with attackers using phishing, malicious packages (e.g., PyPI packages delivering ZiChatBot), and browser-based techniques to bypass traditional security controls.
  • APT groups are increasingly leveraging C2 frameworks for attacks, as detailed in a Q1 2026 vulnerabilities and exploits report.
  • Attackers are exploiting browser activity (copy/paste, AI prompts) to bypass data loss prevention (DLP) controls, highlighting gaps in current endpoint protection strategies.
  • AI-integrated attacks are becoming more sophisticated, targeting both vision-language models and SaaS platforms, though some recent attempts failed to breach OT/ICS environments.
  • Cloud infrastructure is a primary target for worm-like malware and credential stealers, with new frameworks focusing on lateral movement and removal of competing threats.
  • There is a continued trend of attackers abusing software supply chains and public repositories (e.g., PyPI) to distribute malware.

Regulatory or Policy Developments Affecting the Security Industry

  • A UK report on the Online Safety Act indicates some progress in online age checks, but highlights ongoing issues with workarounds, persistent harm, and unresolved privacy concerns.