Major Incidents or Breaches

  • Nissan disclosed a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability. This incident is linked to broader attacks involving the ShinyHunters group and the exploitation of a critical Oracle zero-day (CVE-2026-46817) [13][14][20][37].
  • The National Association of Insurance Commissioners (NAIC) confirmed a breach resulting from the same Oracle PeopleSoft vulnerability, with the ShinyHunters group claiming to have stolen 3.1 TB of data. NAIC stated that only publicly available data, outdated logs, and configuration files were taken [14][37].
  • Hackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a new cross-platform infostealer targeting Windows, macOS, and Linux systems. The malware focuses on stealing credentials, including those related to cloud and AI environments [19][23].
  • Over 236,000 websites built with the DCloud Uni-App framework are being abused for crypto scams, phishing, and wallet-draining attacks, leveraging legitimate development tools to host malicious content [10].
  • Microsoft has removed more than 100 malicious Edge browser extensions that were delivering malware via images, after being advertised as useful tools [43].

Newly Discovered Vulnerabilities

  • Apple released patches for over 30 vulnerabilities across iOS, macOS, and Safari, including four WebKit flaws discovered using artificial intelligence techniques [4].
  • A critical vulnerability (CVE-2026-46817, CVSS 9.8) in Oracle E-Business Suite is under active exploitation, enabling attackers to compromise affected systems [5][20].
  • Researchers disclosed a critical vulnerability in SimpleHelp (CVE-2026-48558) that allows authentication bypass and is being used to deploy malware in the wild [19][23].
  • The “DirtyClone” Linux kernel vulnerability, a variant of DirtyFrag, was revealed to allow unprivileged local users to manipulate the page cache and gain root privileges [38].
  • Multiple vulnerabilities were reported in Daktronics controllers, exposing highway signs and billboards to remote hacking. CISA has issued an advisory regarding these flaws [33].
  • A flaw in the Amazon Q VS Extension could allow attackers to execute arbitrary code and steal cloud credentials by planting malicious repositories [27].

Notable Threat Actor Activity

  • The Gentlemen ransomware-as-a-service group has been observed deploying new ransomware variants and evolving its tactics, including the use of custom backdoors [1].
  • Mustang Panda, a China-aligned espionage group, is running two campaigns targeting Indian government and hydropower entities, using Zoho WorkDrive as a command-and-control channel and deploying new malware [8].
  • The Russian APT group Gamaredon continues to expand its attacks against Ukraine, updating its malware arsenal and abusing cloud services [12].
  • The ShinyHunters extortion group is linked to recent Oracle PeopleSoft breaches affecting organizations such as Nissan and NAIC [13][14][37].
  • Nation-state actors from Iran, Russia, and China have been targeting water systems for sabotage by exploiting weak passwords, exposed PLCs, and poor network segmentation [26].
  • The US Department of State has offered a $10 million reward for information on Russian-linked UNC5792 and UNC4221 hacker groups, which have targeted WhatsApp and Signal users, as well as US government and allied personnel [17][40].

Trends, Tools, or Tactics of Interest

  • Threat actors are increasingly abusing legitimate cloud services (such as Zoho WorkDrive) and open-source frameworks (such as DCloud Uni-App) for command and control or hosting malicious content [8][10].
  • Infostealer malware, such as Djinn Stealer, is being deployed via exploitation of newly disclosed vulnerabilities and is targeting credentials across cloud and AI services [19][23].
  • Malicious browser extensions remain a significant threat vector, with both Chrome and Edge extensions being used to log user activity or deliver malware [6][43].
  • Researchers demonstrated that indirect prompts embedded in code repositories can trigger AI coding assistants like Claude Code to execute malicious actions, such as spawning a reverse shell on a developer’s machine [35].
  • Business email compromise attacks are increasingly relying on convincing impersonation rather than malware, making detection by traditional security tools more difficult [21].
  • AI agents and agentic AI systems present new identity and access management challenges, as attackers seek to compromise their privileged identities to access enterprise resources [18][36].

Regulatory or Policy Developments Affecting the Security Industry

  • WhatsApp has begun rolling out a username feature globally, allowing users to hide their phone numbers and add an optional username key as a secondary credential for increased privacy [7][15][34].
  • Microsoft has extended Windows Server 2022 hotpatching support until October 2027, one year past its mainstream end date [16].
  • OpenAI and Anthropic are restricting access to new AI models to select customers during a cybersecurity review at the request of US authorities [39].
  • Google has warned that proposed EU pro-competition regulations could create privacy and security risks by requiring the opening of search and Android systems [29].
  • The US Justice Department seized nearly 400 domains used for illegal streaming of FIFA World Cup matches, disrupting illicit content distribution networks [22].
  • The US Department of State has issued a $10 million bounty for information on Russian state hackers targeting messaging app users and government personnel [17][40].

Sources#

  1. Nissan discloses employee data breach linked to Oracle zero-day attacks - bleepingcomputer.com
  2. NAIC says public data stolen in ShinyHunters' PeopleSoft breach - bleepingcomputer.com
  3. Hackers now exploit critical Oracle E-Business flaw in attacks - bleepingcomputer.com
  4. Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack - securityweek.com
  5. Critical SimpleHelp flaw exploited to deploy new stealer malware - bleepingcomputer.com
  6. 'Djinn' Stealer Targets Cloud, AI Credentials - darkreading.com
  7. 236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers - thehackernews.com
  8. 119 Edge extensions promised useful tools, instead downloaded malware - malwarebytes.com
  9. Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs - thehackernews.com
  10. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild - thehackernews.com
  11. ‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access - securityweek.com
  12. New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking - securityweek.com
  13. Amazon Q VS Extension Flaw Leads to Cloud Credential Theft - darkreading.com
  14. The Gentlemen are knocking: сustom backdoors and evolving tactics - securelist.com
  15. Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks - thehackernews.com
  16. Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse - thehackernews.com
  17. Iran, Russia, China Target Water Systems for Sabotage - darkreading.com
  18. U.S. offers $10 million for hackers targeting WhatsApp, Signal users - bleepingcomputer.com
  19. US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve - securityweek.com
  20. Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input - thehackernews.com
  21. Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines - securityweek.com
  22. Webinar: Why business email compromise attacks keep succeeding - bleepingcomputer.com
  23. Agentic AI Has an Identity Problem and Attackers Know It - bleepingcomputer.com
  24. Straiker Raises $64 Million for AI Security Platform - securityweek.com
  25. WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private - thehackernews.com
  26. WhatsApp rolls out usernames to help users hide their phone number - bleepingcomputer.com
  27. WhatsApp Rolling Out Username Feature to Bolster Phone Number Privacy - securityweek.com
  28. Microsoft extends Windows Server 2022 hotpatching until October 2027 - bleepingcomputer.com
  29. OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review - securityweek.com
  30. Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change - wired.com
  31. US seizes hundreds of FIFA World Cup illegal streaming domains - bleepingcomputer.com