Major Incidents or Breaches

  • Foxconn, the world’s largest electronics manufacturer, confirmed a cyberattack on its North American factories. The Nitrogen ransomware group claimed responsibility, stating it stole 8TB of data, including confidential documents.
  • West Pharmaceutical Services disclosed a cyberattack resulting in data exfiltration and system encryption.
  • OpenLoop Health, a telehealth platform, suffered a data breach in January impacting 716,000 users whose personal information was exfiltrated.
  • UK government-related RubyGems packages were targeted by attackers using data dead drops, though the ultimate objective remains unclear.
  • Deepfake sextortion incidents at UK schools have led to the removal of student photos from websites after AI-generated images were used for extortion.
  • An unnamed Azerbaijani oil and gas company was repeatedly targeted by a China-linked threat actor (FamousSparrow APT) exploiting Microsoft Exchange vulnerabilities from December 2025 to February 2026.
  • Iranian threat group MuddyWater conducted a cyber-espionage campaign against at least nine high-profile organizations, including a major South Korean electronics manufacturer.

Newly Discovered Vulnerabilities

  • A new Linux kernel vulnerability, Fragnesia (CVE-2026-46300), allows local privilege escalation via page cache corruption, granting root access. Patches are being rolled out.
  • An 18-year-old critical vulnerability in the NGINX rewrite module was disclosed, enabling unauthenticated remote code execution in NGINX Plus and NGINX Open.
  • A critical vulnerability in the Exim mail transfer agent allows unauthenticated remote code execution in certain configurations.
  • Two unpatched Windows vulnerabilities, YellowKey and GreenPlasma, were publicly disclosed. YellowKey enables BitLocker bypass with physical access; GreenPlasma allows privilege escalation to SYSTEM.
  • A high-severity vulnerability in VMware Fusion was patched.
  • Microsoft’s May Patch Tuesday addressed 138 vulnerabilities, including critical DNS and Netlogon RCE flaws and a zero-click Outlook vulnerability (CVE-2026-40361) similar to the historic BadWinmail bug.
  • Microsoft fixed a BitLocker recovery issue for Windows 11 users and addressed a Windows Autopatch bug that installed restricted drivers on some EU devices.
  • Proof-of-concept exploits for the BitLocker (YellowKey) and privilege escalation (GreenPlasma) Windows zero-days have been released.
  • A vulnerability in PraisonAI was exploited within hours of public disclosure.

Notable Threat Actor Activity

  • The Nitrogen ransomware gang claimed responsibility for the Foxconn breach, exfiltrating a large volume of sensitive data.
  • The Gentlemen ransomware-as-a-service (RaaS) group suffered a data leak due to an OPSEC failure, revealing details about its affiliate model and TTPs.
  • Chinese APT group FamousSparrow expanded targeting to the Azerbaijani energy sector, using repeated Microsoft Exchange exploitation.
  • Iranian group MuddyWater conducted a cyber-espionage campaign across multiple sectors and countries, including targeting a major South Korean electronics firm.
  • Attackers weaponized RubyGems to publish packages containing scrapers aimed at public-facing UK government servers.
  • LatAm threat actors in Mexico and Brazil used AI agents to generate custom hacking tools during recent attack campaigns.
  • Exploitation of the PraisonAI vulnerability began less than four hours after public disclosure.

Trends, Tools, or Tactics of Interest

  • 43% of UK businesses experienced a breach in the past year, with phishing responsible for 85% of incidents, according to a UK government survey.
  • Attackers are increasingly able to compromise systems in minutes, while patching and remediation often take hours or days, highlighting the growing importance of autonomous validation for defense.
  • Security teams often fail to confirm the effectiveness of remediation actions, according to Mandiant’s M-Trends 2026 report.
  • Microsoft’s MDASH AI system and Palo Alto’s Mythos are being used to discover vulnerabilities in their own codebases, with MDASH credited for finding 16 vulnerabilities fixed in the latest Patch Tuesday.
  • Sweet Security launched an agentic AI red teaming platform (“Sweet Attack”) focused on continuous, runtime intelligence-led attack chain discovery.
  • Attackers are leveraging AI to generate custom hacking tools and automate attack chains, as seen in recent campaigns in Latin America.
  • Deepfake technology is being used for sextortion, prompting renewed calls for schools to remove student images from public websites.
  • Checkbox-based risk assessments are increasingly viewed as inadequate for real risk measurement, with new companies emerging to address risk management gaps in audit tools.

Regulatory or Policy Developments Affecting the Security Industry

  • The US Committee on Homeland Security is seeking a briefing from Instructure regarding the recent Canvas LMS disruption and data breach, indicating increased government scrutiny on educational technology incidents.