Major Incidents or Breaches

  • Threat actors are exploiting a recently patched vulnerability in the Gravity SMTP WordPress plugin, which has approximately 100,000 installations. The flaw, tracked as CVE-2026-4020, allows attackers to expose API keys used for email delivery services, potentially leading to further compromise of affected sites [1].
  • Hackers claim to have leaked stolen data from Madison Square Garden, indicating a potential data breach affecting the venue’s systems [4].

Newly Discovered Vulnerabilities

  • A security flaw in the Gravity SMTP WordPress plugin, identified as CVE-2026-4020, has been actively exploited. The vulnerability enables attackers to access sensitive API keys from plugin configurations [1].

Notable Threat Actor Activity

  • Microsoft has attributed the recent Mastra AI supply chain attack, which compromised over 140 npm packages, to the North Korean hacking group Sapphire Sleet (BlueNoroff) [3].

Trends, Tools, or Tactics of Interest

  • The newly identified Prinz Eugen ransomware operation is notable for prioritizing the encryption of recently modified files and for not leaving a ransom note on infected systems, which may hinder victim response and detection [2].

Regulatory or Policy Developments Affecting the Security Industry

  • The French President has called for cooperation among wealthy democracies to regulate advanced AI systems, urging the United States to share cutting-edge AI technologies and align on regulatory approaches [5].

Sources#

  1. Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys - thehackernews.com
  2. Hackers Claim to Leak Stolen Madison Square Garden Data - wired.com
  3. Microsoft links Mastra AI supply chain attack to North Korean hackers - bleepingcomputer.com
  4. New Prinz Eugen ransomware prioritizes recent files for encryption - bleepingcomputer.com
  5. French President Urges US to Share Cutting-Edge AI and Democracies to Cooperate on Regulation - securityweek.com