Major Incidents or Breaches

  • South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
  • Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
  • BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
  • Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
  • A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
  • RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
  • The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
  • TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

  • Microsoft’s May 2026 Patch Tuesday addressed 137 vulnerabilities (including 120 flaws noted in other reports), with nine rated critical. No zero-days were disclosed. Updates cover Azure, Windows, Dynamics 365, and SSO Plugins for Jira & Confluence.
  • Fortinet patched critical remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator, which could allow attackers to execute arbitrary commands or code.
  • Ivanti released patches for critical vulnerabilities that could lead to arbitrary code execution and information disclosure.
  • Exim released security updates to address a severe vulnerability in certain GnuTLS builds that could enable memory corruption and potential code execution.
  • SAP issued updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA.
  • Intel and AMD published advisories for a combined total of 70 security vulnerabilities across their products.
  • Adobe patched 52 vulnerabilities in 10 products, several of which could result in arbitrary code execution, though none are known to be exploited in the wild.

Notable Threat Actor Activity

  • TeamPCP has been identified as responsible for the Mini Shai-Hulud worm campaign, which has infected hundreds of open-source packages, focusing on credential theft and supply chain compromise.
  • The GemStuffer campaign abused over 150 RubyGems to exfiltrate scraped data from UK council portals, using the RubyGems registry as a data exfiltration channel.
  • The TrickMo Android banking trojan has been updated to use The Open Network (TON) for command-and-control and SOCKS5 proxies to create Android network pivots, enhancing its evasion and persistence capabilities.
  • The ShinyHunters extortion group targeted Instructure’s Canvas platform in two separate attacks.

Trends, Tools, or Tactics of Interest

  • Social engineering remains a prevalent attack vector, with criminals increasingly posing as help desks in phishing and fraud campaigns.
  • Signal has introduced new in-app confirmations and warning messages to counter phishing and social engineering attacks.
  • Android announced an opt-in Intrusion Logging feature for forensic analysis of sophisticated spyware, and Android 17 will introduce expanded protections against banking scam calls and device theft.
  • Hugging Face AI models are susceptible to manipulation via tokenizer library file tweaks, allowing model hijacking and data exfiltration.
  • A cross-platform malware campaign dubbed CRPx0 is using “Free OnlyFans” lures to target macOS and Windows, with Linux support in development.
  • Fake search results for Claude setup guides are being used to distribute ClickFix malware to Mac users.
  • The volume and complexity of supply chain attacks targeting open-source package repositories (npm, PyPI, RubyGems) continues to increase, with attackers leveraging worms and mass package uploads.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK Information Commissioner’s Office imposed a significant fine on South Staffordshire Water Plc for failing to protect customer data during a cyberattack.
  • The US House Committee on Homeland Security has requested testimony from Instructure executives regarding the recent cyberattacks on its Canvas platform.
  • RubyGems’ suspension of new account sign-ups in response to a major malicious package attack reflects ongoing efforts to secure software supply chains.