Major Incidents or Breaches

  • GitHub disclosed that attackers accessed internal repositories after compromising an employee device via a malicious Visual Studio Code extension. The breach was reportedly limited in scope but highlights successful social engineering against developer tooling [1].
  • Grafana confirmed that hackers accessed its GitHub repositories and stole codebase and other data by exploiting a token compromised during the TanStack supply chain attack, which had not been rotated [34].
  • A glitch in Robinhood’s account creation process was exploited to send phishing emails from the platform’s own systems to customers [3].
  • Canadian authorities arrested an individual alleged to be the botmaster behind Kimwolf, an IoT botnet that enslaved millions of devices for DDoS and credential stuffing attacks [28].
  • Law enforcement seized the ‘First VPN’ service, which was used to facilitate ransomware and data theft operations [16].

Newly Discovered Vulnerabilities

  • Cisco addressed a maximum-severity vulnerability (CVE-2026-20223) in Secure Workload’s REST API that allowed unauthenticated, remote attackers to access sensitive data and gain Site Admin privileges [6][15][35].
  • Microsoft disclosed and patched two actively exploited vulnerabilities in Defender, one allowing privilege escalation (CVE-2026-41091) and another enabling denial-of-service, both observed in the wild [9][40][42].
  • Trend Micro Apex One on-premise was found to have a directory traversal flaw (CVE-2026-34926) actively exploited in the wild [5][33].
  • Drupal patched a highly critical vulnerability (CVE-2026-9082) that could be exploited without authentication for information disclosure, privilege escalation, and remote code execution [38].
  • Google accidentally exposed details of an unfixed Chromium flaw that allows JavaScript to run in the background after the browser is closed, enabling potential remote code execution [11].
  • Google API keys were found to remain active for 23 minutes after deletion, contrary to the expected immediate invalidation [20].

Notable Threat Actor Activity

  • Chinese cyber-espionage groups have been targeting telecommunications providers in the Middle East and Central Asia with new Linux (Showboat) and Windows (JFMBackdoor) malware families [7][14][22].
  • TeamPCP, a threat group, has been conducting an unprecedented scale of software supply chain attacks, recently impacting GitHub and hundreds of organizations [27].
  • China-linked APT Webworm utilized Discord, Microsoft Graph, and SOCKS proxies such as SoftEther VPN for attacks targeting EU governments [18].

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly targeting developer tools and software supply chains, as evidenced by incidents involving GitHub, TanStack, and TeamPCP [1][27][34].
  • The Underminr domain-fronting attack method enables threat actors to exploit content delivery mechanisms for website brand hijacking by modifying web requests and cloaking malicious activity [23].
  • Crypto drainer platforms like Lucifer DaaS are scaling wallet theft through sophisticated phishing and automation rather than direct wallet hacking [13].
  • A new cross-platform Node.js stealer was observed, designed to exfiltrate credentials and other data, with heavy obfuscation to evade detection [29].
  • AI-driven vulnerability discovery is contributing to a surge in Chrome vulnerability reports, with over 200 vulnerabilities patched in recent releases [41].
  • AI agent identity management is emerging as a significant area of concern, with new research highlighting budgetary shifts and the need for governance as AI agent projects proliferate in enterprises [21].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA updated its Known Exploited Vulnerabilities (KEV) catalog to include new vulnerabilities and introduced a nomination form to facilitate broader reporting and tracking of exploited flaws [5][32].
  • The US Federal Trade Commission (FTC) fined three firms nearly $1 million for selling a purported “Active Listening” technology for targeted advertising, which was found to be fraudulent [26].

Sources#

  1. [Heads Up] GitHub Breach Shows Developer Tools Are Social Engineering Targets - blog.knowbe4.com
  2. Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack - securityweek.com
  3. Robinhood Glitch Allowed Attackers to Send Phishing Emails to Customers - blog.knowbe4.com
  4. Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada - krebsonsecurity.com
  5. Police seize “First VPN” service used in ransomware, data theft attacks - bleepingcomputer.com
  6. Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access - thehackernews.com
  7. Max severity Cisco Secure Workload flaw gives Site Admin privileges - bleepingcomputer.com
  8. Cisco Patches Critical Vulnerability in Secure Workload - securityweek.com
  9. Microsoft Warns of Two Actively Exploited Defender Vulnerabilities - thehackernews.com
  10. Microsoft Patches Exploited UnDefend and RedSun Defender Zero-Days - securityweek.com
  11. Microsoft Defender vulnerabilities are being exploited in the wild - malwarebytes.com
  12. CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV - thehackernews.com
  13. TrendAI Patches Apex One Zero-Day Exploited in the Wild - securityweek.com
  14. Drupal Patches Highly Critical Vulnerability Exposing Websites to Hacking - securityweek.com
  15. Google accidentally exposed details of unfixed Chromium flaw - bleepingcomputer.com
  16. Google API Keys Remain Active After Deletion - darkreading.com
  17. Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor - thehackernews.com
  18. Chinese hackers target telcos with new Linux, Windows malware - bleepingcomputer.com
  19. Chinese APTs Share Linux Backdoor in Central Asia Telco Attacks - darkreading.com
  20. A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale - wired.com
  21. China's Webworm Uses Discord, Microsoft Graphs to Hack EU Govts. - darkreading.com
  22. Content Delivery Exploit Opens Websites to Brand Hijacking - darkreading.com
  23. Inside a Crypto Drainer: How to Spot it Before it Empties Your Wallet - bleepingcomputer.com
  24. Cross-Platform NPM Stealer, (Fri, May 22nd) - isc.sans.edu
  25. Google’s Surge in Chrome Vulnerability Discoveries Likely Driven by AI - securityweek.com
  26. AI Agents Are Shifting Identity Security Budget Dynamics - darkreading.com
  27. CISA Enhances Known Exploited Vulnerabilities Catalog to Include New Nomination Form - cisa.gov
  28. ‘Creepy’ Listening Tool for Targeted Ads Didn’t Actually Work, FTC Says - wired.com