Major Incidents or Breaches

  • Coca-Cola disclosed a ransomware attack on its Fairlife dairy subsidiary, resulting in the suspension of US dairy production operations. The incident has not affected product quality or Canadian production[19][33].
  • More than 20 Brazilian government websites were hijacked and used as malware delivery channels in an ongoing campaign attributed to PhantomEnigma[10].
  • Genetic testing company 23andMe agreed to pay $18 million to settle claims from 43 attorneys general regarding its failure to protect customers’ genetic data in a major breach[23].
  • Two members of the Scattered Spider cybercrime group were sentenced in the UK to five and a half years in prison each for their roles in the 2024 Transport for London hack, which compromised 148 systems and resulted in £29 million in losses[5][24][35].

Newly Discovered Vulnerabilities

  • CISA added a newly patched Microsoft SharePoint Server remote code execution vulnerability (CVE-2026-58644) to its Known Exploited Vulnerabilities catalog following reports of active exploitation[4][32].
  • CISA ordered federal agencies to urgently patch two actively exploited vulnerabilities in the Fortinet FortiSandbox platform and a critical Oracle E-Business Suite financial application flaw due to ongoing attacks[17][26].
  • A token exchange flaw in n8n’s workflow automation platform allowed attackers to log in as users from other trusted identity providers when multiple external token issuers were configured[7].
  • A flaw in the Anthropic Claude Chrome extension could allow malicious browser extensions to simulate user clicks and trigger AI actions, potentially leading to abuse of Claude’s access[20].
  • Splunk and Zoom released patches for critical vulnerabilities that could allow attackers to access credentials, take over accounts, and escalate privileges[39].
  • F5 issued patches for multiple vulnerabilities in NGINX and BIG-IP products, which could be exploited to modify configurations, restart processes, cross security boundaries, leak memory, and execute arbitrary code[40].
  • Security updates were released for Adobe, Chrome, Firefox, VMware, and Zoom to address various vulnerabilities[43].
  • An unpatched flaw in Shark RV2320EDUS robot vacuums allows attackers to extract certificates from the device and remotely execute root commands on other vacuums within the same AWS region[14].

Notable Threat Actor Activity

  • The HelloNet campaign targeted large Russian organizations by delivering new malicious modules via the ViPNet update system, a tool for secure network creation[1].
  • The GoSerpent threat group conducted two-phase attacks against Southeast Asian government entities, using the GoSerpent backdoor, Stowaway RAT, ThumbcacheService, and other tools for data theft[2].
  • Russian threat actor UAT-11795 is distributing trojanized versions of WebEx and Zoom to deploy the Starland RAT, targeting credentials and cryptocurrency theft[27].
  • The PhantomEnigma campaign leveraged compromised Brazilian government websites for malware delivery[10].
  • The Spirals ransomware group completed a network intrusion, data theft, and encryption in under 24 hours, demonstrating rapid attack capability[28].
  • A new modular malware named TELEPUZ is spreading via ClickFix-infected websites to steal data and execute remote commands[8].
  • The OkoBot framework is delivering over 20 payloads in attacks targeting theft of cryptocurrency wallet seed phrases, credentials, and sensitive data[21].
  • ClickLock Stealer, a new macOS infostealer, forces victims to reveal their login password by terminating all visible processes every 210 milliseconds until the password is entered. It has targeted at least 100 users for password and cryptocurrency theft[9][18][37].
  • Advanced malware Daxin, attributed to a China-linked actor, resurfaced in a Taiwan manufacturing firm, accompanied by a new pre-login SYSTEM backdoor called Stupig[12].

Trends, Tools, or Tactics of Interest

  • Multiple incidents highlight the increasing speed of ransomware operations, with Spirals ransomware actors completing attacks in less than 24 hours[28].
  • Over 1 million phishing emails have used hidden text to evade AI-powered security filters, exploiting the limitations of large language models in email security[30].
  • Attackers are leveraging hijacked legitimate government websites as malware delivery platforms, as seen in the PhantomEnigma campaign[10].
  • There is a growing trend of threat actors using social engineering techniques combined with technical methods, such as ClickLock Stealer’s approach of process killing to coerce password entry on macOS[9][18][37].
  • The emergence of agentic AI and AI-powered tools is prompting a re-evaluation of traditional security workflows, with calls for new approaches to identity and automation security[22][29][36].
  • New research describes agent data injection attacks, where malicious data can cause AI agents to misclick or execute attacker-controlled commands[11].
  • OpenAI disclosed GPT-Red, an automated red-teaming model designed to scale prompt injection vulnerability discovery and remediation before public deployment of new models[15].
  • AI-assisted tools are increasingly used for bug discovery, but human expertise remains essential for verification[13].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA issued multiple urgent directives for federal agencies to patch actively exploited vulnerabilities in Microsoft SharePoint, Fortinet FortiSandbox, and Oracle E-Business Suite[4][17][26][32].
  • 23andMe’s $18 million settlement with 43 US states over a genetics data breach underscores increased regulatory attention on consumer data protection in the genetics and health sectors[23].
  • Chinese cybersecurity firms are facing growing military procurement bans imposed by the country’s military, unrelated to product or technical failures[41].
  • Microsoft announced that Windows 10 Enterprise LTSB 2016 and Windows 11 24H2 Home and Pro editions will reach end of support in 90 days, impacting update availability and security support for these versions[25].

Sources#

  1. Coca-Cola says Fairlife ransomware attack halts US dairy production - bleepingcomputer.com
  2. Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack - securityweek.com
  3. 20+ Hijacked Government Websites Became
an Attack Channel - thehackernews.com
  4. 23andMe to pay $18 million in new genetics data breach settlement - bleepingcomputer.com
  5. Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack - thehackernews.com
  6. Scattered Spider members behind TfL hack get five years in prison - bleepingcomputer.com
  7. Two Scattered Spider Hackers Sentenced to Jail in UK - securityweek.com
  8. CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV - thehackernews.com
  9. Fresh SharePoint Vulnerability Exploited Soon After Disclosure - securityweek.com
  10. CISA urges immediate action on actively exploited Fortinet flaws - bleepingcomputer.com
  11. CISA orders feds to patch actively exploited Oracle flaw by Saturday - bleepingcomputer.com
  12. n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer - thehackernews.com
  13. Claude Chrome extension flaw lets malicious extensions trigger AI actions - bleepingcomputer.com
  14. Splunk, Zoom Patch Critical Vulnerabilities - securityweek.com
  15. F5 Patches Multiple NGINX, BIG-IP Vulnerabilities - securityweek.com
  16. Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom - malwarebytes.com
  17. Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide - thehackernews.com
  18. HelloNet campaign — new malicious modules launched through the ViPNet update system - securelist.com
  19. GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - securelist.com
  20. Russian hackers trojanize WebEx, Zoom apps to push Starland malware - bleepingcomputer.com
  21. New Spirals ransomware encrypts victim network in under 24 hours - bleepingcomputer.com
  22. New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands - thehackernews.com
  23. New OkoBot framework deploys 20 payloads to steal data, crypto - bleepingcomputer.com
  24. New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password - thehackernews.com
  25. New ClickLock macOS malware traps users into revealing login password - bleepingcomputer.com
  26. ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing - securityweek.com
  27. Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor - thehackernews.com
  28. 1M+ Emails Use Hidden Text to Dupe AI Security Filters - darkreading.com
  29. AI Agents Broke the Security Playbook. Here's What Replaces It. - bleepingcomputer.com
  30. Agentic AI Is Untamable: Ask the Right Security Questions - darkreading.com
  31. AI Data Centers Are Being Built Faster Than They Can Be Secured - securityweek.com
  32. New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands - thehackernews.com
  33. OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol - thehackernews.com
  34. AI Can Find Bugs, But Human Knowledge Still Proves Them - thehackernews.com
  35. China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans - securityweek.com
  36. Windows 11 24H2 Home and Pro reach end of support in 90 days - bleepingcomputer.com