Major Incidents or Breaches

  • Abbott Laboratories is investigating two separate cybersecurity incidents, confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, amid extortion claims. The company is also probing a second, unrelated cyber event [12].
  • Ernst & Young disclosed a data breach after IT personnel’s use of a compromised third-party support ticket system resulted in customer data exposure [14].
  • The Japanese frozen food company Nichirei experienced a cyberattack that forced system disconnection on July 13, disrupting operations. Restoration efforts are underway [29].
  • DigiCert’s April 2026 security incident has been attributed to a threat activity cluster known as CylindricalCanine, specifically a subgroup called GoldenEyeDog, which stole code-signing certificates [5].

Newly Discovered Vulnerabilities

  • Two critical vulnerabilities in WordPress Core, now assigned CVE IDs, allow unauthenticated attackers to execute arbitrary code. A working proof-of-concept has been published, and a persistent-object-cache condition has been identified [1].
  • The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial-of-service by sending an 11-byte TLS request, causing the server to allocate up to 131 KB of memory per request until the process restarts. This affects glibc-based systems [2][13].
  • A zero-day exploit named LegacyHive has been released, enabling privilege escalation to administrator level on fully updated Windows systems [16].
  • A security flaw in Shark robot vacuums exposes device cameras, home mapping data, and Wi-Fi passwords, potentially allowing remote access to multiple vacuums if one is compromised [31].
  • Two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances have been exploited by threat actors to gain root-level access [19].

Notable Threat Actor Activity

  • Seven malicious npm packages targeting the Vite frontend ecosystem have been discovered using blockchain-based command and control to deliver a remote access trojan, forming part of a software supply chain attack [3].
  • The NadMesh botnet, written in Go, is actively scanning for exposed AI services to harvest cloud credentials and Kubernetes tokens, with operators claiming to have collected thousands of AWS keys [4].
  • North Korean threat actors associated with the Contagious Interview campaign are using steganography in SVG files to deliver malware via fake coding tests, aligning with OtterCookie activity [6].
  • The ACR Stealer infostealer is leveraging ClickFix-themed lures to exfiltrate browser credentials, session tokens, PDFs, Microsoft 365 documents, and OneDrive files from enterprise networks [10].
  • The newly identified GoSerpent malware has been deployed in espionage operations against Southeast Asian governments and diplomats since late 2025 [11].
  • Inc Ransomware operators have exploited SonicWall SMA zero-days in recent attacks [19].

Trends, Tools, or Tactics of Interest

  • Cybercriminals are increasingly seeking “clean” residential proxies and pairing them with advanced browser fingerprinting techniques to evade detection in carding operations [15].
  • Steganography in SVG images is being used by North Korean threat actors to conceal malware in recruitment-themed phishing campaigns [6].
  • Agentic defense strategies, including automated threat detection and remediation, are being incorporated into cloud security platforms to counter AI-driven attacks [22][26].
  • The use of blockchain-based command and control infrastructure is emerging in supply chain attacks, as seen in the malicious Vite npm package campaign [3].

Regulatory or Policy Developments Affecting the Security Industry

  • The European Commission has ordered Google to provide rival AI assistants with access to Android’s camera, microphone, on-screen content, and wake word capabilities, matching those available to Gemini [7].
  • Microsoft announced that Windows Server 2022 will reach the end of mainstream support in October 2026, transitioning to extended support with continued security updates for five years [17].
  • The Pentagon’s suspension of CMMC Phase 2 pauses third-party audits but does not remove the legal requirement for defense contractors to protect Controlled Unclassified Information (CUI) [28].
  • San Francisco’s City Attorney has issued cease-and-desist letters to Apple and Google demanding the removal of 13 AI-powered “nudify” face-swap apps from their app stores, citing concerns about misuse targeting women and girls [23].

Sources#

  1. Abbott probes two cyber incidents amid extortion claims - bleepingcomputer.com
  2. Ernst & Young discloses data breach after support system hack - bleepingcomputer.com
  3. Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei - securityweek.com
  4. GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - thehackernews.com
  5. New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - thehackernews.com
  6. OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests - thehackernews.com
  7. HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload - bleepingcomputer.com
  8. New Windows LegacyHive zero-day gives hackers admin privileges - bleepingcomputer.com
  9. Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords - malwarebytes.com
  10. Inc Ransomware Exploits SonicWall SMA Zero-Days - darkreading.com
  11. Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - thehackernews.com
  12. New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - thehackernews.com
  13. Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images - thehackernews.com
  14. ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files - thehackernews.com
  15. New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage - thehackernews.com
  16. Inside the Search for "Clean" Residential Proxies for Carding - bleepingcomputer.com
  17. Google Bets 'Agentic Defense' Strategy Can Outpace Attackers - darkreading.com
  18. Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive - securityweek.com
  19. E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants - thehackernews.com
  20. Windows Server 2022 reach end of mainstream support in 90 days - bleepingcomputer.com
  21. Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday - securityweek.com
  22. San Francisco Demands Apple and Google Delete AI ‘Nudify’ Apps From App Stores - wired.com