Major Incidents or Breaches

  • OpenAI disclosed that two employee devices were compromised via the Mini Shai-Hulud supply chain attack on TanStack, resulting in the theft of credential material from code repositories. OpenAI stated that no user data or production systems were affected. The incident is linked to the public release of the Shai-Hulud worm source code by TeamPCP, which is encouraging its use in further supply chain attacks and offering monetary rewards to attackers [8][22][23].
  • The JDownloader website was compromised, and installer download links were replaced with malware for several days, exposing users who downloaded the installer during this period to potential compromise [24].
  • American Lending Center reported a ransomware attack affecting 123,000 individuals. The breach was discovered nearly a year ago, but the investigation has only recently concluded [21].
  • Researchers observed active exploitation of a critical vulnerability in the Funnel Builder WordPress plugin, allowing attackers to inject malicious JavaScript into WooCommerce checkout pages and steal credit card data [9].
  • Two vulnerabilities in the Avada Builder WordPress plugin, which has around one million active installations, allow attackers to read arbitrary files and extract sensitive information, including site credentials [12].

Newly Discovered Vulnerabilities

  • Four vulnerabilities in the OpenClaw platform can be chained to achieve data theft, privilege escalation, and persistence. These flaws have been collectively rated as high severity [6].
  • During the second day of Pwn2Own Berlin 2026, researchers demonstrated 15 unique zero-day vulnerabilities in products including Windows 11, Microsoft Exchange, and Red Hat Enterprise Linux [10].
  • Microsoft warned of a high-severity, actively exploited Exchange Server zero-day vulnerability (CVE-2026-42897) that allows remote code execution via cross-site scripting. Temporary mitigations have been released pending a permanent patch [16][20].

Notable Threat Actor Activity

  • The Russian state-sponsored Turla group has evolved its Kazuar backdoor into a modular peer-to-peer (P2P) botnet, enhancing its stealth and persistence capabilities [5].
  • The hacking group TeamPCP released the source code for the Shai-Hulud worm, incentivising its use in supply chain attacks and promising monetary rewards to participants [23].
  • Attackers compromised the node-ipc npm package by injecting credential-stealing malware into newly published versions, targeting developers in a supply chain attack [11].
  • Researchers are tracking 40 separate traffic-themed SMS phishing (smishing) campaigns impersonating transport authorities, toll operators, and parking services globally [3].

Trends, Tools, or Tactics of Interest

  • Phishing attacks are becoming more sophisticated, leveraging AI to mimic legitimate conversations, use trusted domains, and scale attacks, making detection increasingly difficult [1].
  • Stolen browser sessions and authentication tokens are becoming more valuable than passwords, as seen in the evolution of the REMUS infostealer, which now focuses on session theft and is offered as malware-as-a-service (MaaS) [14].
  • AI agents capable of discovering and exploiting obscure vulnerabilities are emerging, alongside an increase in potentially flawed AI-generated code, creating new challenges for defenders [17].
  • Supply chain attacks remain prevalent, with notable incidents affecting npm packages (node-ipc), open-source projects (TanStack), and widely used software installers (JDownloader) [8][11][22][24].
  • Security researchers highlight that trusted internal tools and activities can represent significant risk, as malicious behaviour increasingly blends in with legitimate operations [7].
  • Geopolitical turmoil is being exploited by fraudsters to conduct scams and social engineering attacks [4].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft is updating the Edge browser to prevent saved passwords from being loaded into process memory in clear text at startup, reversing its previous stance that this behaviour was “by design” [13].
  • Microsoft is introducing a capability to remotely roll back faulty Windows drivers delivered through Windows Update, aiming to reduce the risk from problematic driver deployments [15].
  • Big Tech companies are opposing a Canadian encryption bill, which has implications for privacy and secure communications [19].
  • Meta has introduced disappearing AI chats in WhatsApp, claiming they cannot be read by Meta, while simultaneously removing protections on Instagram that previously prevented Meta from accessing user messages, creating confusion about chat privacy [25].

Sources#

  1. TanStack Supply Chain Attack Hits Two OpenAI Employee Devices, Forces macOS Updates - thehackernews.com
  2. OpenAI Hit by TanStack Supply Chain Attack - securityweek.com
  3. TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code - securityweek.com
  4. Attackers replaced JDownloader installer downloads with malware - malwarebytes.com
  5. American Lending Center Data Breach Affects 123,000 Individuals - securityweek.com
  6. Funnel Builder WordPress plugin bug exploited to steal credit cards - bleepingcomputer.com
  7. Avada Builder WordPress plugin flaws allow site credential theft - bleepingcomputer.com
  8. Four OpenClaw Flaws Enable Data Theft, Privilege Escalation, and Persistence - thehackernews.com
  9. Microsoft Exchange, Windows 11 hacked on second day of Pwn2Own - bleepingcomputer.com
  10. Microsoft warns of Exchange zero-day flaw exploited in attacks - bleepingcomputer.com
  11. Microsoft Warns of Exchange Server Zero-Day Exploited in the Wild - securityweek.com
  12. Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access - thehackernews.com
  13. Popular node-ipc npm package compromised to steal credentials - bleepingcomputer.com
  14. Traffic-Themed SMS Phishing Targets Users Around the World - blog.knowbe4.com
  15. Why Integrate Threat Intelligence Feeds into Email Security? - blog.knowbe4.com
  16. Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution - bleepingcomputer.com
  17. The Boring Stuff is Dangerous Now - darkreading.com
  18. What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface - thehackernews.com
  19. Why geopolitical turmoil is a gift for scammers, and how to stay safe - welivesecurity.com
  20. Microsoft backpedals: Edge to stop loading passwords into memory - bleepingcomputer.com
  21. Microsoft to automatically roll back faulty Windows drivers - bleepingcomputer.com
  22. In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws - securityweek.com
  23. Meta’s confusing new approach to chat privacy - malwarebytes.com