Major Incidents or Breaches

  • Polymarket customers lost approximately $3 million after hackers injected a malicious script into the platform’s frontend via a third-party vendor compromise. Polymarket has stated it will fully reimburse affected customers [16][31].
  • The Klue-Salesforce breach has impacted roughly two dozen companies, with affected organizations notifying their customers of the incident [27].
  • Exposed records from the Dialog group included personal information of a senior White House intelligence official and an active-duty special operations officer, prompting a Pentagon review [25].

Newly Discovered Vulnerabilities

  • A high-severity vulnerability in Amazon Q Developer allowed malicious repositories to execute code and steal developers’ cloud credentials. AWS has patched the flaw and issued an advisory [7][26].
  • CVE-2026-46331, also known as “pedit COW,” is an out-of-bounds write flaw in the Linux kernel’s traffic-control subsystem that enables local privilege escalation to root [6].
  • DirtyClone is a newly disclosed Linux kernel privilege escalation vulnerability in the DirtyFrag family. Researchers have published a working exploit for the flaw [9].
  • The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical remote code execution vulnerability affecting PTC Windchill PDMlink and PTC FlexPLM to its Known Exploited Vulnerabilities (KEV) catalog, as web shell attacks exploiting this flaw continue [8].
  • CISA has set an urgent deadline for federal agencies to patch an actively exploited vulnerability in Cisco Unified Communications Manager Server [15].

Notable Threat Actor Activity

  • Russian intelligence-linked hackers have evolved their phishing campaign targeting Signal users. The latest tactics involve tricking victims into providing Signal Backup Recovery Keys, granting attackers access to message histories [3][14].
  • The Turla group, a Russian APT, has deployed the StockStay backdoor in espionage operations against Ukrainian government and military targets [32].
  • A Chinese-speaking APT has been linked to the deployment of a new custom backdoor, TinyRCT, in attacks against government entities and critical infrastructure in Southeast Asia [5].
  • A newly observed campaign is delivering SharkLoader malware, which acts as a loader for deploying Cobalt Strike Beacon on compromised systems [4].
  • Cybersecurity researchers have detected a supply chain attack involving the Miasma malware family, which targeted npm packages and GitHub Actions [11].
  • Microsoft reported a phishing campaign targeting hotels and hospitality organizations in Europe and Asia, using photo-themed ZIP files to deliver a Node.js implant [12].
  • Threat actors are impersonating legitimate companies by creating fraudulent OpenAI tenants and inviting cybersecurity firm employees, aiming to collect sensitive corporate information [17].
  • Malware campaigns are installing malicious Chrome extensions via phishing to steal Chrome session cookies and hijack user accounts on Windows devices [33].
  • Russian authorities used Cellebrite forensic tools to extract data from an opposition activist’s iPhone, despite Cellebrite’s earlier claims of halting sales to Russia [13][28].

Trends, Tools, or Tactics of Interest

  • There is a continued rise in supply chain attacks, as evidenced by recent incidents involving npm packages, GitHub Actions, and third-party vendor compromises [11][16][31].
  • Attackers are increasingly targeting backup and recovery mechanisms within secure messaging platforms, as seen in the Signal phishing campaigns [3][14].
  • The use of Cobalt Strike Beacon remains prevalent in new malware loader campaigns, such as those involving SharkLoader [4].
  • AI agents are being integrated into enterprise identity governance, inheriting permissions and traversing systems with minimal oversight [10].
  • Confidence in autonomous penetration testing tools powered by AI is declining, with organizations experimenting but relying less on these technologies [19].
  • The Open Source Sustainability Initiative has launched to help enterprises manage and secure aging open source projects and maintain regulatory compliance [21].
  • The Linux Foundation has announced Akrites, a new open source security project to support vulnerability reporting, patching, and disclosure in open source software [30].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA continues to mandate urgent patching of actively exploited vulnerabilities in widely used enterprise products, including Cisco Unified Communications Manager Server and PTC Windchill [8][15].
  • The Open Source Sustainability Initiative aims to address regulatory compliance challenges related to end-of-life open source software [21].

Sources#

  1. Polymarket customers lose $3 million in supply-chain attack - bleepingcomputer.com
  2. $3 Million Reportedly Stolen in Polymarket Hack - securityweek.com
  3. More Klue Breach Victims Identified as Hackers Get Hacked - securityweek.com
  4. The Pentagon Is Looking Into the Dialog Data Exposure for Unmasking National Security Officials - wired.com
  5. Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs - thehackernews.com
  6. Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories - securityweek.com
  7. New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries - thehackernews.com
  8. New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets - thehackernews.com
  9. CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue - thehackernews.com
  10. CISA sets urgent deadline to fix Cisco flaw exploited in attacks - bleepingcomputer.com
  11. FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys - thehackernews.com
  12. FBI: Russian hackers now target Signal backup recovery keys - bleepingcomputer.com
  13. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets - securityweek.com
  14. Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign - thehackernews.com
  15. New SharkLoader Malware Deploys Cobalt Strike in StrikeShark Cyberattacks - thehackernews.com
  16. Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack - thehackernews.com
  17. Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant - thehackernews.com
  18. Cybersecurity firms targeted by fraudulent OpenAI organization invites - bleepingcomputer.com
  19. Malware steals Chrome session cookies to take over your accounts - malwarebytes.com
  20. Russia Used Cellebrite on Jailed Activist's iPhone Months After Sales Cutoff - thehackernews.com
  21. In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs - securityweek.com
  22. Guardian Agents: The Next Layer of Identity Governance - thehackernews.com
  23. AI Decline? Confidence in Autonomous Penetration Testing Falls - darkreading.com
  24. New Initiative Tackles Security for End-of-Life Open Source Software - darkreading.com
  25. Linux Foundation Unveils New Open Source Security Project Akrites - securityweek.com