Major Incidents or Breaches

  • The JDownloader website was compromised to distribute malicious installers for both Windows and Linux users. The Windows installer deployed a Python-based RAT (Remote Access Trojan).
  • NVIDIA confirmed a data breach affecting GeForce NOW users in Armenia, exposing user information.
  • Trellix experienced a source code repository breach, with the RansomHouse threat group claiming responsibility and leaking proof-of-intrusion images.
  • Zara suffered a data breach exposing personal information of over 197,000 customers.
  • Instructure, the company behind the Canvas educational platform, was hit by a second attack claimed by ShinyHunters, with PII of hundreds of millions at risk. The attack also resulted in defacement of school login portals and ransom demands.
  • The Canvas system, used by thousands of educational institutions, went offline due to a cyberattack, disrupting students during finals.
  • AI firm Braintrust reported a breach in which attackers accessed an AWS account and compromised AI provider secrets, prompting API key rotation.
  • Polish Security Agency reported ICS (Industrial Control Systems) breaches at five water treatment plants, where attackers gained the ability to modify operational parameters, posing a direct risk to public water supplies.

Newly Discovered Vulnerabilities

  • cPanel released updates for three newly discovered vulnerabilities in cPanel and Web Host Manager (WHM), which could allow privilege escalation, code execution, and denial-of-service attacks.
  • A new Linux local privilege escalation vulnerability, “Dirty Frag,” was disclosed, following closely after the “Copy Fail” vulnerability (CVE-2026-31431).
  • CISA issued an emergency directive for U.S. federal agencies to patch a high-severity Ivanti Endpoint Manager Mobile (EPMM) vulnerability exploited as a zero-day within four days.

Notable Threat Actor Activity

  • A previously undocumented Brazilian banking trojan, TCLBANKER, was identified targeting 59 banking, fintech, and cryptocurrency platforms via WhatsApp and Outlook-based worms.
  • Quasar Linux RAT (QLNX), a new Linux remote access trojan, is targeting developer systems to steal credentials and facilitate software supply chain compromise.
  • ShinyHunters escalated attacks against the Canvas platform, moving from data theft to ransom-driven defacement of school login portals.
  • RansomHouse claimed responsibility for the Trellix source code repository breach.
  • A malicious repository on Hugging Face impersonated an OpenAI project to deliver information-stealing malware to Windows users.

Trends, Tools, or Tactics of Interest

  • Reports indicate the time between initial phishing email delivery and full organizational compromise has reduced to seconds, highlighting increased attack speed and automation.
  • Fraudulent Android apps masquerading as call history tools were discovered on Google Play Store, tricking users into unauthorized payments and amassing 7.3 million downloads.
  • Research into SOC operations revealed a trend of missed low-severity threats, with data from 25 million alerts showing that at least one significant threat per week is overlooked due to alert fatigue and volume.
  • Attacker use of Windows Phone Link to steal one-time passwords (OTPs) was highlighted in recent malware campaigns.
  • A report noted that Microsoft Edge loads saved passwords into memory in plaintext at startup, which could be exploited by attackers with local access.
  • A hackable robot lawn mower was identified as a potential new vector for physical and digital attacks due to security weaknesses.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has mandated a four-day patch window for federal agencies to address critical vulnerabilities, reflecting an ongoing shift toward shorter patch cycles.
  • The US government is reportedly moving toward a 72-hour patch cycle for critical vulnerabilities affecting federal systems.