Major Incidents or Breaches

  • Charter Communications suffered a data breach affecting 4.9 million accounts, with the ShinyHunters extortion group responsible for stealing and leaking personal information from the US telecom giant in early April [16][25].
  • Dutch authorities disrupted a malware botnet comprising 17 million infected devices and seized over 200 servers supporting the operation [12].
  • 23andMe, now Chrome Holding Co., is facing a lawsuit from the California Attorney General over a 2023 breach that exposed sensitive customer genetic and personal information [10][28].
  • Trump Mobile reportedly exposed customer data in a recent breach [24].

Newly Discovered Vulnerabilities

  • Palo Alto Networks reported that CVE-2026-0257, a medium-severity authentication bypass vulnerability in PAN-OS and Prisma Access, is under active exploitation [3].
  • Researchers disclosed a vulnerability in OpenAI ChatGPT that exploits trust in Markdown links and images, potentially enabling phishing attacks via web summaries [4].
  • A critical argument injection flaw in Gogs, a Git server, allows authenticated attackers to achieve remote code execution via malicious pull requests. The vulnerability has a CVSS score of 9.4 and is considered a zero-day [27].
  • Google Chrome version 148 update addresses 151 vulnerabilities, including critical-severity issues that could lead to remote code execution [29].
  • An exploit chain in a popular cloud automation service combined over-permissioned roles, secrets discovery, and non-human identities, exposing the risk of major compromise in complex cloud integrations [19].

Notable Threat Actor Activity

  • The ShinyHunters extortion gang was responsible for the Charter Communications breach, leaking over 42 million records [16][25].
  • A previously undocumented Russia-linked threat actor, GREYVIBE, has been carrying out persistent AI-powered cyberattacks against Ukraine and related entities since at least August 2025 [6].
  • Threat actors are abusing ChatGPT’s content-sharing feature to host fake outage pages, tricking users into downloading malware disguised as a desktop application [9].
  • An unknown threat actor used a large language model (LLM) agent for post-compromise actions after exploiting the Marimo CVE-2026-39987 vulnerability [5].
  • Cybercriminals are impersonating Signal Support in phishing campaigns to steal backup recovery keys, enabling access to victims’ entire message archives [30].
  • Malicious NuGet packages masquerading as a Sicoob SDK were discovered stealing banking credentials, while npm packages targeted cloud secrets [8].
  • Phishing campaigns are targeting the 2026 FIFA World Cup, leveraging event interest for malicious activity [24].
  • The criminal gang known as “The Com” is conducting cyberattacks to financially support violence and sexual exploitation [20].

Trends, Tools, or Tactics of Interest

  • DDoS attacks are increasingly being offered as subscription-based services, featuring pricing tiers, support, and reseller programs, reflecting the professionalization of the DDoS-as-a-Service market [11].
  • The rise of “shadow AI” is evidenced by employees developing and deploying full AI-powered applications into production systems without adequate oversight, resulting in increased exposure and risk [7].
  • There is a trend toward attackers leveraging LLM agents for post-exploitation activities, as seen in the Marimo CVE-2026-39987 incident [5].
  • Attackers are exploiting cloud integration misconfigurations, particularly through over-permissioned roles and secrets exposure, to compromise automation services [19].
  • MokN raised $15 million for a “phish-back” platform that uses decoy access points to lure attackers and capture compromised credentials [26].

Regulatory or Policy Developments Affecting the Security Industry

  • The California Attorney General has initiated legal action against 23andMe (now Chrome Holding Co.) for failing to protect customer data in the wake of its 2023 breach [10][28].
  • Google Chrome has rolled out Device Bound Session Credentials (DBSC) to all users, providing enhanced protection against session cookie theft and account takeover [13].
  • Asia’s cyber insurance market is showing signs of increased activity and growth after historically slow uptake [18].
  • The US Cybersecurity and Infrastructure Security Agency (CISA) has responded to recent supply chain attacks, highlighting ongoing government engagement in addressing such threats [24].

[3]: PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
[4]: ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
[5]: Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
[6]: New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks
[7]: What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks
[8]: Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
[9]: ChatGPT share links abused to host fake outage pages to deliver malware
[10]: California AG sues 23andMe over 2023 breach exposing health data
[11]: From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market
[12]: Dutch govt disrupts malware botnet with 17 million infected devices
[13]: Google Chrome adds session cookie theft protection for all users
[16]: Charter Communications data breach affects 4.9 million accounts
[18]: Asia’s Cyber Insurance Market Shows Signs of Life
[19]: With Complex Cloud Integrations, Small Errors Lead to Major Compromises
[20]: ‘The Com’ Cyberattacks Support Violence & Sexploitation
[24]: In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks
[25]: Charter Communications Data Breach Could Impact Nearly 5 Million
[26]: MokN Raises $15 Million for Phish-Back Platform
[27]: Gogs Zero-Day Exposes Servers to Remote Code Execution
[28]: California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach
[29]: Chrome 148 Update Patches 151 Vulnerabilities
[30]: Signal users targeted in backup-stealing phishing attacks

Sources#

  1. Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
  2. Charter Communications Data Breach Could Impact Nearly 5 Million - securityweek.com
  3. Dutch govt disrupts malware botnet with 17 million infected devices - bleepingcomputer.com
  4. California AG sues 23andMe over 2023 breach exposing health data - bleepingcomputer.com
  5. California Sues 23andMe, Alleging It Failed to Protect User Data in 2023 Breach - securityweek.com
  6. In Other News: Trump Mobile Data Breach, FIFA World Cup Phishing, CISA Responds to Supply Chain Attacks - securityweek.com
  7. PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation - thehackernews.com
  8. ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface - thehackernews.com
  9. Gogs Zero-Day Exposes Servers to Remote Code Execution - securityweek.com
  10. Chrome 148 Update Patches 151 Vulnerabilities - securityweek.com
  11. With Complex Cloud Integrations, Small Errors Lead to Major Compromises - darkreading.com
  12. New Russia-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks - thehackernews.com
  13. ChatGPT share links abused to host fake outage pages to deliver malware - bleepingcomputer.com
  14. Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit - thehackernews.com
  15. Signal users targeted in backup-stealing phishing attacks - malwarebytes.com
  16. Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets - thehackernews.com
  17. 'The Com' Cyberattacks Support Violence & Sexploitation - darkreading.com
  18. From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market - bleepingcomputer.com
  19. What 2,000 Exposed Vibe-Coded Apps Reveal About the Limits of Most Security Stacks - thehackernews.com
  20. MokN Raises $15 Million for Phish-Back Platform - securityweek.com
  21. Google Chrome adds session cookie theft protection for all users - bleepingcomputer.com
  22. Asia's Cyber Insurance Market Shows Signs of Life - darkreading.com