Major Incidents or Breaches

  • The Canvas online learning system experienced a cyberattack that disrupted access for tens of thousands of students globally, particularly impacting those studying for final exams. Service has since been restored.
  • Over 500 organizations across sectors including aviation, critical infrastructure, energy, logistics, public administration, and technology have been targeted in a years-long phishing campaign.
  • German authorities have shut down the rebooted Crimenetwork criminal marketplace, which had over 22,000 users and more than 100 sellers, and arrested its administrator.

Newly Discovered Vulnerabilities

  • A critical out-of-bounds read vulnerability has been disclosed in Ollama, allowing remote, unauthenticated attackers to leak the application’s entire process memory.
  • A new Linux vulnerability, referred to as “Dirty Frag” (also known as Copy Fail 2, CVE-2026-43284 and CVE-2026-43500), was disclosed prior to a patch being available and may already be under exploitation in the wild.

Notable Threat Actor Activity

  • A malicious repository impersonating OpenAI’s Privacy Filter model reached the top spot on Hugging Face, delivering a Rust-based information stealer to Windows users and amassing 244,000 downloads.
  • The TrickMo Android banking malware, in campaigns targeting users across Europe, has adopted The Open Network (TON) blockchain for covert command-and-control communications and introduced new functionality.
  • Attackers are leveraging Google Ads and shared Claude.ai chat links in an active malvertising campaign to distribute Mac malware to users searching for “Claude mac download.”
  • The Checkmarx Jenkins AST Plugin was compromised in a supply chain attack, with a malicious version published to the Jenkins Marketplace.

Trends, Tools, or Tactics of Interest

  • Ransomware activity in Q1 2026 shows continued consolidation, with over 2,100 new victims listed across more than 70 active data leak sites.
  • YARA-X version 1.16.0 has been released, providing four improvements and four bug fixes to the malware identification tool.
  • Threat actors are increasingly abusing trusted platforms (e.g., Hugging Face, Google Ads, Claude.ai, Jenkins Marketplace) for malware delivery and supply chain attacks.

Regulatory or Policy Developments Affecting the Security Industry

  • German law enforcement action against the Crimenetwork marketplace demonstrates ongoing international efforts to disrupt cybercriminal infrastructure and prosecute operators.