Major Incidents or Breaches

  • NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, with user information exposed.
  • Trellix source code repository breach was claimed by the RansomHouse threat group, who leaked images as proof of intrusion.
  • Zara suffered a data breach exposing personal information of 197,000 customers, as reported by Have I Been Pwned.
  • Instructure, the edtech company behind the Canvas learning platform, experienced a second attack claimed by ShinyHunters; PII of hundreds of millions potentially at risk.
  • The Canvas system used by thousands of schools and universities was taken offline by a cyberattack, disrupting operations during final exams.
  • ShinyHunters escalated their attacks on Canvas by defacing school login portals with ransom messages.
  • AI firm Braintrust suffered a breach in which hackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
  • The Polish Security Agency reported ICS breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supply.

Newly Discovered Vulnerabilities

  • cPanel released patches for three vulnerabilities in cPanel and Web Host Manager (WHM) that could allow privilege escalation, code execution, and denial-of-service.
  • A new local privilege escalation (LPE) vulnerability in the Linux kernel, dubbed “Dirty Frag,” was disclosed, following the recent “Copy Fail” (CVE-2026-31431) vulnerability.
  • Quasar Linux RAT (QLNX), a previously undocumented Linux remote access trojan, was identified targeting developer systems, enabling credential theft and post-compromise activity.
  • Microsoft Edge was found to load saved passwords into system memory in plaintext on startup, making them susceptible to theft if the device is already compromised; Microsoft states this is “by design.”
  • Ivanti Endpoint Manager Mobile (EPMM) was subject to a high-severity zero-day vulnerability exploited in the wild, prompting urgent patching directives.

Notable Threat Actor Activity

  • RansomHouse claimed responsibility for the Trellix source code breach and published proof of access.
  • ShinyHunters continued their campaign against Instructure/Canvas, including login portal defacement and ransom demands.
  • TCLBANKER, a newly identified Brazilian banking trojan, was observed targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
  • Fraudulent Android apps on Google Play, purporting to provide call history access, were discovered stealing user payments after 7.3 million downloads.
  • Malware leveraging Windows Phone Link to steal one-time passwords (OTPs) was reported in active use.
  • PamDOORa, a new Linux backdoor, was identified in the wild.
  • A train hacker was arrested in connection with cyberattacks on critical infrastructure.

Trends, Tools, or Tactics of Interest

  • The time between phishing email delivery and full organizational compromise has reportedly shrunk to seconds, highlighting increasing attack speed.
  • Analysis of 25 million SOC alerts revealed that low-severity threats are frequently missed, with at least one missed threat per week in large enterprises.
  • Overwhelmed SOC teams are unable to keep pace with attacker speed; AI is being promoted as a tool to accelerate alert triage and investigation.
  • Cybersecurity is increasingly intersecting with geopolitical and cognitive warfare, particularly noted in the African context.
  • Attackers are increasingly targeting software supply chains by compromising developer credentials and systems.
  • Attackers are exploiting social engineering and fraudulent apps at scale via official app stores.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA mandated U.S. federal agencies to patch the Ivanti EPMM zero-day vulnerability within four days.
  • The US government is targeting 72-hour patch cycles for critical vulnerabilities.
  • A new frontrunner for the CISA Director position was reported.