Major Incidents or Breaches

  • Japanese telecommunications company KDDI suffered a data breach affecting 12 million individuals after hackers exploited a zero-day vulnerability in a third-party system to gain access to a KDDI email platform used by ISPs [36].
  • AssuranceAmerica reported a breach in which attackers accessed the driver’s license numbers and other personal information of approximately 6.9 million customers [42].
  • Mount Royal University confirmed that data was stolen in a ransomware attack, with hackers accessing the internal network and deleting two drives containing employee, student, and university data [39].
  • The OpenMandriva Linux project disclosed an attempted internal sabotage by a contributor following a dispute among project members [13].

Newly Discovered Vulnerabilities

  • Microsoft released patches for the Defender vulnerability known as RoguePlanet (CVE-2026-50656), which could allow attackers to gain SYSTEM privileges. Details and proof-of-concept exploits had already been made public prior to the patch [11][22][38][43].
  • Palo Alto Networks patched 13 vulnerabilities in PAN-OS software, including buffer overflow, denial of service, command injection, server-side request forgery, and authentication bypass issues [35].
  • A Linux kernel vulnerability dubbed ‘GhostLock’, present in every major distribution since 2011, was disclosed. The flaw allows attackers to gain root access [37].
  • The Injective Labs SDK project’s GitHub repository was compromised, resulting in a malicious npm package that stole cryptocurrency wallet private keys and mnemonic phrases [14].

Notable Threat Actor Activity

  • A new ransomware family called GodDamn uses the PoisonX kernel driver, signed by Microsoft, to disable endpoint security software as part of its defense evasion tactics [10][26].
  • A new data-extortion group named Helix is conducting attacks against SharePoint environments using voice phishing (vishing), device code phishing, and multi-factor authentication abuse to steal data [15].
  • Researchers identified a network of 200 GitHub repositories being used to distribute Windows malware by loading PowerShell code that fetches commands from public dead drops [32].
  • Invoice phishing attacks are being conducted via the legitimate Shop app, developed by Shopify, to trick users into fraudulent transactions [1].
  • A phishing campaign is impersonating Interpol’s cybercrime investigation unit to deliver ransomware, targeting small businesses across multiple global regions [2].
  • A phishing-as-a-service platform called Forg365 uses AI-assisted lure generation, adversary-in-the-middle, and device code methods to target Microsoft 365 accounts [17].

Trends, Tools, or Tactics of Interest

  • Attackers are abusing dormant GitHub accounts to enumerate corporate organizations, repositories, and user accounts via the GitHub API, making detection more difficult [4].
  • The GigaWiper Windows backdoor combines three older destructive programs into a single toolkit, offering disk wiping, fake ransomware, and spyware capabilities [5].
  • AI-driven attacks are accelerating, with adversaries using models to rapidly craft tailored phishing lures and pivot between targets in minutes [8].
  • Security researchers demonstrated ‘HalluSquatting’, where adversarial manipulation of AI assistant hallucinations can enable remote code execution and botnet delivery [31].
  • AI coding assistants can be tricked into executing malicious code on developer machines using legacy attack techniques, as detailed in the newly disclosed GhostApproval method [40].
  • Prompt injection and agentic risk are rising concerns as AI systems become more autonomous and susceptible to adversarial manipulation [3].
  • Cloud bucket hijacking, Windows local privilege escalation chains, and other misconfigurations continue to be prevalent attack vectors [7].
  • AI gateways are emerging as a new risk surface, with incidents showing that compromise can expose access to AI models, cloud infrastructure, and IAM data [25].
  • npm version 12 now disables install scripts by default to reduce supply chain risk, and granular access tokens that bypass two-factor authentication are being deprecated [6].
  • AI agents are being recognized as a new identity type, requiring approaches distinct from traditional service accounts or API tokens [23].

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government announced an Agentic AI Defense Plan and an associated industry pledge to improve national cybersecurity posture, with a focus on addressing risks from autonomous AI systems [34].
  • European lawmakers voted against permitting large technology firms to scan private messages, but the “Chat Control” bill will still allow companies to scan citizens’ texts, emails, and social media messages for child abuse material [27].
  • Microsoft indicated that Windows users should expect more frequent security updates as the company increases reliance on artificial intelligence for vulnerability discovery in its codebase [16].
  • Microsoft announced it will retire the Outlook Web Access (OWA) Light client in a future Exchange Server update [19].

Sources#

  1. 12 Million Impacted by Data Breach at Japanese Telco KDDI - securityweek.com
  2. 6.9 million driver’s license numbers stolen from AssuranceAmerica - malwarebytes.com
  3. Mount Royal University Confirms Data Stolen in Ransomware Attack - securityweek.com
  4. OpenMandriva Linux says contributor tried to sabotage the project - bleepingcomputer.com
  5. Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges - thehackernews.com
  6. Microsoft Reins in RoguePlanet Zero-Day Threat - darkreading.com
  7. Microsoft Patches Defender ‘RoguePlanet’ Vulnerability - securityweek.com
  8. Microsoft fixes RoguePlanet zero-day in Defender - malwarebytes.com
  9. Palo Alto Networks Patches 13 Vulnerabilities - securityweek.com
  10. 15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google - securityweek.com
  11. Injective SDK on npm infected with cryptocurrency wallet stealer - bleepingcomputer.com
  12. GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses - thehackernews.com
  13. 'GodDamn' Ransomware Uses BYOVD to Smite US Companies - darkreading.com
  14. New Helix vishing group emerges in SharePoint data theft attacks - bleepingcomputer.com
  15. Network of 200 GitHub Repositories Used for Malware Infection - securityweek.com
  16. Invoice Phishing Attacks Are Abusing the Shop App - blog.knowbe4.com
  17. Phishing Campaign Impersonates Interpol to Deliver Ransomware - blog.knowbe4.com
  18. New Forg365 phishing platform uses AI to target Microsoft 365 accounts - bleepingcomputer.com
  19. Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs - thehackernews.com
  20. New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware - thehackernews.com
  21. AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up - thehackernews.com
  22. ‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism - securityweek.com
  23. AI Coding Tools Tricked Into Hacking Developer Machine via Decades-Old Technique - securityweek.com
  24. Prompt Injection and the Rise of Agentic Risk - blog.knowbe4.com
  25. ThreatsDay: Cloud Bucket Hijacking, Windows LPE Chain, Global Fraud Bust + 17 More Stories - thehackernews.com
  26. AI Gateways Offer Attackers the Keys to the Kingdom - darkreading.com
  27. npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk - thehackernews.com
  28. AI Agents Are a New Kind of Identity & Most Organizations Aren't Ready - darkreading.com
  29. UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge - securityweek.com
  30. A Majority of European Lawmakers Voted Against Letting Big Tech Read Our Messages. They’re Going to Anyway - wired.com
  31. Microsoft expects more Windows security updates from AI-discovered flaws - bleepingcomputer.com
  32. Microsoft to retire the OWA Light client in Exchange Server - bleepingcomputer.com