Major Incidents or Breaches

  • The ShinyHunters extortion group leaked approximately 234 GB of data allegedly stolen from DentaQuest, impacting 2.6 million individuals [26].
  • The Miasma worm campaign compromised 73 Microsoft GitHub repositories across four organizations in a major supply chain attack [7].
  • Multiple supply chain attacks hit the npm ecosystem, with threat actors using both malicious and trojanized versions of over 50 legitimate packages to distribute Rust-based information stealers, including IronWorm and a new Miasma variant [9].
  • Tech giant Toshiba and retailer Muji reported suspicious Polyfill login screens appearing on their websites, potentially harvesting user credentials [14].
  • Over 900 US automatic tank gauge systems used to monitor fuel and chemical storage tanks were found exposed online and are now under active attack by threat actors [18][20].

Newly Discovered Vulnerabilities

  • A high-severity vulnerability in Cisco Catalyst SD-WAN Manager (CVE-2026-20245) is under active exploitation, with no patch currently available [8].
  • Hackers are actively exploiting a critical flaw in the Everest Forms Pro WordPress plugin, which allows arbitrary code execution and complete site takeover [13].
  • CISA reported that hackers are exploiting a recently patched high-severity SolarWinds Serv-U flaw to crash servers [15].
  • A security startup identified 21 previously unknown zero-day vulnerabilities in FFmpeg, a widely used media library [6].
  • Chrome 149 patched 429 vulnerabilities, with over 100 classified as critical or high-severity, primarily related to use-after-free and insufficient input validation [6][27].

Notable Threat Actor Activity

  • The FBI warned about the Kali365 phishing-as-a-service platform targeting Microsoft 365 accounts by harvesting OAuth tokens for direct access [1].
  • A Chinese espionage group tracked as UNC5221 accessed Microsoft 365 environments using the Brickstorm backdoor and newly discovered malware named Plenet and AgentPSD [16].
  • A previously unreported threat cluster, OP-512, was observed targeting Microsoft IIS servers with a custom web shell framework [11].
  • Five Eyes intelligence agencies reported that Chinese intelligence officers are targeting government and military staff with fake job opportunities to gain access to classified or privileged information [29].

Trends, Tools, or Tactics of Interest

  • Phishing campaigns increasingly leverage calendar invites to deceive targets and bypass traditional email security controls [5].
  • The 2026 Verizon DBIR highlights that phishing, shadow AI, malicious browser extensions, and credential theft are increasingly occurring at the browser layer [19].
  • Adaptive, agentic AI worms capable of autonomously seeking out vulnerabilities and adapting to new environments are anticipated to become a significant enterprise threat within a year [21].
  • AI-powered tools are being used both offensively and defensively, with public concern about AI’s dual role as threat and tool rising [2][3][12][21][30].
  • OWASP released CVE Lite CLI, a free open-source tool to help developers quickly identify and remediate vulnerable dependencies in their projects [24].

Regulatory or Policy Developments Affecting the Security Industry

  • The White House issued an executive order establishing a voluntary framework for early government access to frontier AI models and increased federal security investment [22].
  • Industry experts commented on the executive order’s voluntary nature, its approach to balancing innovation and security, and possible implementation challenges [28].

Sources#

  1. Hackers Leak DentaQuest Information Impacting 2.6 Million - securityweek.com
  2. Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack - thehackernews.com
  3. IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks - thehackernews.com
  4. Suspicious Polyfill login prompts pop up on Toshiba, Muji websites - bleepingcomputer.com
  5. Over 900 US gas station tank gauge systems exposed to attacks - bleepingcomputer.com
  6. Exposed Fuel Tank Gauges Under Attack in the US - darkreading.com
  7. Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available - thehackernews.com
  8. Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites - thehackernews.com
  9. CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers - bleepingcomputer.com
  10. AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs - thehackernews.com
  11. Chrome 149 Patches 429 Vulnerabilities - securityweek.com
  12. FBI: Kali365 Phishing Kit is Targeting Microsoft 365 Accounts - blog.knowbe4.com
  13. Chinese APT deploys new malware to keep access to hacked networks - bleepingcomputer.com
  14. New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework - thehackernews.com
  15. Five Eyes: Chinese Spies Target Government, Military Staff With Fake Job Opportunities - securityweek.com
  16. The Silent Invitation: A Deep Dive into Calendar Invite Phishing - blog.knowbe4.com
  17. What 2026 DBIR Confirms: Attacks Are Living in the Browser - bleepingcomputer.com
  18. Adaptive, Agentic AI Worms Loom as Next Enterprise Threat - darkreading.com
  19. KB4-CON - AI Is Everything - blog.knowbe4.com
  20. How to Secure AI Adoption In Your Organization - blog.knowbe4.com
  21. Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver - thehackernews.com
  22. AI: Threat, tool, or both? - malwarebytes.com
  23. OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds - securityweek.com
  24. Trump AI Order Seeks Voluntary Frontier Model Testing - darkreading.com
  25. Industry Reactions to New Trump AI Cybersecurity Executive Order: Feedback Friday - securityweek.com