Major Incidents or Breaches

  • Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group [19].
  • Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year [21].
  • The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies [23].
  • Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw [27].

Newly Discovered Vulnerabilities

  • Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution [13][37].
  • Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug [38].
  • Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components [40].
  • Google released a Chrome update fixing 382 security bugs, with 15 rated as critical [46].
  • Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component [8].
  • Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation [7].
  • Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts [15].

Notable Threat Actor Activity

  • Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware [1][10].
  • The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks [20].
  • A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges [9].
  • The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems [12].
  • A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering [11].
  • Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers [6][22].

Trends, Tools, or Tactics of Interest

  • Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates [30].
  • ClickFix, a social engineering technique, is reported as a dominant method for malware delivery [31].
  • AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities [16][43].
  • A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal [44].
  • Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks [32].
  • Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine [14].
  • Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected [4].
  • Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period [25].

Regulatory or Policy Developments Affecting the Security Industry

  • Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing [18].
  • The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations [29].
  • Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants [36].

Sources#

  1. Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
  2. Kubota says hackers had month-long access to network systems - bleepingcomputer.com
  3. DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
  4. Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
  5. Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
  6. Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
  7. Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
  8. Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
  9. Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
  10. Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
  11. SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
  12. Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
  13. The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
  14. SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
  15. FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
  16. 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
  17. Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
  18. VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
  19. New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
  20. New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
  21. Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
  22. And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
  23. AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
  24. Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
  25. Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
  26. 'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
  27. Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
  28. Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
  29. Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
  30. Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
  31. Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
  32. Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com