Major Incidents or Breaches

  • Instructure (Canvas): Instructure, the parent company of Canvas, confirmed a significant breach involving the theft of 3.65TB of data by the ShinyHunters extortion group. The breach exploited a vulnerability in Canvas, which allowed attackers to deface login portals and leave extortion messages. Instructure reached a ransom agreement with the attackers to prevent further data leaks, and claims the stolen data was “returned.”
  • TanStack, Mistral AI, Guardrails AI, UiPath, OpenSearch: Multiple popular npm and PyPI packages were compromised in a supply chain attack orchestrated by the threat actor TeamPCP. The attack also included a rogue version of the Checkmarx Jenkins AST plugin, which contained an infostealer.
  • Skoda: Hackers exploited a portal vulnerability to access customer data from Skoda’s online shop, including names, addresses, email addresses, and phone numbers.
  • SailPoint: SailPoint disclosed a GitHub repository breach on 20 April. No customer data in production or staging environments was affected.
  • cPanel: A threat actor known as Mr_Rot13 is actively exploiting CVE-2026-41940, a critical cPanel vulnerability, to deploy the Filemanager backdoor on compromised systems.

Newly Discovered Vulnerabilities

  • cPanel CVE-2026-41940: This critical flaw is under active exploitation to install persistent backdoors.
  • Canvas LMS: A vulnerability in Instructure’s Canvas platform allowed attackers to modify login portals and deliver extortion messages.
  • Yarbo Garden Robots: Multiple vulnerabilities in Yarbo garden robots could allow attackers to expose Wi-Fi credentials, hijack cameras, and physically control the devices.
  • “Dirty Frag” Linux Privilege Escalation: A new privilege escalation vulnerability, similar to Copy Fail and Dirty Pipe, is affecting enterprise Linux distributions and may already be under limited exploitation.

Notable Threat Actor Activity

  • TeamPCP: Conducted a series of supply chain attacks compromising npm and PyPI packages associated with TanStack, UiPath, Mistral AI, OpenSearch, Guardrails AI, and the Checkmarx Jenkins AST plugin.
  • ShinyHunters: Responsible for the Instructure (Canvas) breach, extorting the company and negotiating a ransom to prevent data leaks.
  • Mr_Rot13: Attributed to the exploitation of the cPanel CVE-2026-41940 vulnerability.
  • Unnamed Cyber Espionage Group: Targeted aviation and drone firms to exfiltrate GIS files, terrain models, and GPS data.

Trends, Tools, or Tactics of Interest

  • Ransomware Evolution: Kaspersky reports a shift in ransomware tactics for 2026, including increased use of EDR killers and a move from data encryption to data leak extortion.
  • AI in Exploit Development: Google and other sources confirm the first known use of AI to develop a zero-day exploit capable of mass 2FA bypass and targeting a popular open-source web admin tool. Attack automation and exploit orchestration via large language models are increasing.
  • Supply Chain Attacks: Continued targeting of software supply chains, including poisoning trusted packages and plugins.
  • GhostLock Tool: A new proof-of-concept tool demonstrates how Windows file APIs can be abused to block access to local or network files.
  • Application Build Firewalls: New security solutions are emerging to monitor runtime behaviour within build pipelines to prevent supply chain attacks.
  • Insider Threats: Research indicates that 1 in 8 employees have sold or know someone who has sold company logins.
  • Purple Teaming: Observations highlight ongoing operational challenges in integrating red and blue team functions in practice.

Regulatory or Policy Developments Affecting the Security Industry

  • GM California Settlement: General Motors agreed to a $12.75 million settlement with California authorities for alleged violations of the California Consumer Privacy Act related to the sale of drivers’ data.
  • FCC Router Ban: The US Federal Communications Commission has eased some restrictions and extended deadlines for foreign-made routers, though the ban remains in effect.
  • iOS 26.5 Release: Apple released iOS 26.5, introducing default end-to-end encrypted RCS messaging between iPhone and Android devices in beta, as part of a cross-industry initiative to replace SMS/MMS.