Major Incidents or Breaches

  • Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure[7][15][41].
  • LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor[22].
  • Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data[23].
  • Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees[43].

Newly Discovered Vulnerabilities

  • A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems[24][42].
  • Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups[19].
  • A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE[27][40].
  • High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions[37].
  • New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography[13].

Notable Threat Actor Activity

  • Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector[10][18].
  • The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services[12].
  • The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors[14].
  • A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites[8][16].
  • Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities[26][39].

Trends, Tools, or Tactics of Interest

  • Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth[1].
  • Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection[2].
  • AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations[3][20].
  • “Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions[25][38].
  • Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups[29].
  • A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns[45].
  • A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft[4].
  • Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets[8][16][27][40].
  • Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms[13][20].
  • Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure[33].

Regulatory or Policy Developments Affecting the Security Industry

  • Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research[30].
  • Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections[46].
  • Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation[34].

Sources#

  1. Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
  2. Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
  3. Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
  4. LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
  5. Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
  6. Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
  7. Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
  8. CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
  9. CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
  10. Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
  11. Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
  12. Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
  13. New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
  14. China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
  15. New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
  16. Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
  17. TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
  18. BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
  19. BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
  20. Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
  21. New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
  22. IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
  23. IT threat evolution in Q2 2026. Mobile statistics - securelist.com
  24. Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
  25. When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
  26. 'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
  27. ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
  28. Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
  29. New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
  30. The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
  31. Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
  32. Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
  33. Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
  34. Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com