Major Incidents or Breaches

  • Nutex Health, a healthcare and services provider, confirmed a data breach involving unauthorized access and data exfiltration from company servers, with sensitive information exposed[18][31].
  • The Los Angeles County Museum of Art (LACMA) disclosed that a breach last year exposed customer and employee social security and medical data[14].
  • Over 270 Zimbra Collaboration Suite servers have been compromised in ongoing attacks exploiting a high-severity remote code execution vulnerability[22].
  • Norway’s shared government digital infrastructure suffered significant disruption due to a large-scale distributed denial-of-service (DDoS) attack, impacting public sector services[17].

Newly Discovered Vulnerabilities

  • A critical remote code execution vulnerability in Gitea (CVE-2026-60004) is being actively exploited in the wild. The vulnerability was patched in Gitea version 1.27.1, but attackers are deploying miner-like payloads on unpatched instances[3][32].
  • Two severe unauthenticated authentication bypass vulnerabilities (CVE-2026-61979 and CVE-2026-15981) in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress are under active exploitation, allowing attackers to gain admin access[13][35].
  • A high-severity flaw in Marimo notebook software was patched after it was found to allow attacker-supplied Model Context Protocol (MCP) command execution in specially crafted notebooks[8].
  • Researchers disclosed a weakness in NVIDIA NemoClaw and its integration with the Ollama API that enables unauthenticated attackers to take control of local AI agent instances and plant persistent malicious instructions[6][26].

Notable Threat Actor Activity

  • A commercial phishing-as-a-service toolkit, Mirage2FA, has targeted over 4,500 organisations in the US and EU since 2024, abusing Microsoft 365 login flows to bypass two-factor authentication[9].
  • Threat actors are abusing npm and its mirrors to host clusters of malicious packages that redirect users to fake Cloudflare CAPTCHA phishing pages[10][15].
  • A new campaign uses FTP banners as dead drop resolvers to deliver two novel remote access trojans (E4del and PINHOLE RAT), leveraging FTP banner text as a covert command and control channel[11].
  • Iranian cyber actors have been sanctioned by the US government for their role in critical infrastructure breaches[5].
  • A newly identified phishing-as-a-service platform, AnonyMousKIT, employs AI voice agents to call Apple device theft victims, attempting to phish for passcodes and two-factor authentication codes to bypass Apple’s Activation Lock[4][16].

Trends, Tools, or Tactics of Interest

  • Phishing remains the leading initial access vector, responsible for more than half of observed cyberattacks in Q2 2026. Microsoft reported observing 7.6 billion phishing emails during this period[1][2].
  • Attackers are increasingly targeting identity verification and account recovery processes, rather than just login credentials, to compromise accounts[19].
  • Prompt injection attacks are being used to manipulate AI-powered email summarizers and assistants by embedding malicious or hidden instructions in otherwise benign-looking content, including encrypted text[25][41].
  • AI model poisoning is an emerging concern, with vulnerabilities in local AI agent serving platforms allowing attackers to persistently corrupt models via malicious web content[6][26].
  • WhatsApp has introduced support for multiple passkeys and stronger two-step verification to enhance account security across iOS and Android[7][21][36].
  • Law enforcement agencies from 22 countries arrested 58 individuals and identified 263 suspects in a global crackdown on cybercrime networks coordinated by African crime groups[23].

Regulatory or Policy Developments Affecting the Security Industry

  • The US Department of the Treasury announced new sanctions targeting Iranian cyber actors involved in attacks on critical infrastructure[5].
  • Nigeria launched new financing, procurement, and infrastructure policies to support sovereign cloud initiatives aimed at strengthening national cybersecurity and technical capabilities[24].
  • The Linux Foundation will govern TRACE, an open standard for AI runtime attestation, with contributions from AMD, Intel, Microsoft, OPAQUE, and TII[33].
  • Taiwan charged nine individuals, including staff from Nvidia and Super Micro, for illegal exports of AI servers to China, highlighting ongoing regulatory scrutiny in the AI infrastructure supply chain[40].

Sources#

  1. Hospital operator Nutex Health says data stolen in cyberattack - bleepingcomputer.com
  2. Sensitive Information Exposed in Nutex Health Data Breach - securityweek.com
  3. LACMA data breach last year exposed social security and medical data - bleepingcomputer.com
  4. Hackers breached over 270 Zimbra servers in ongoing attacks - bleepingcomputer.com
  5. Massive DDoS attack disrupts Norway’s government digital services - bleepingcomputer.com
  6. Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload - thehackernews.com
  7. CISA Warns of Exploited Gitea Vulnerability - securityweek.com
  8. Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access - thehackernews.com
  9. WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities - securityweek.com
  10. Marimo Notebook Flaw Could Run MCP Commands Before Cells Execute in Edit Mode - thehackernews.com
  11. A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw - thehackernews.com
  12. Finding Nemo(Claw): Networking Issue Allows for LLM Poisoning in OpenClaw - darkreading.com
  13. Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows - thehackernews.com
  14. 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages - thehackernews.com
  15. Hackers abuse npm mirrors to host phishing redirect pages - bleepingcomputer.com
  16. E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands - thehackernews.com
  17. U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches - thehackernews.com
  18. Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes - thehackernews.com
  19. AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes - bleepingcomputer.com
  20. Report: Phishing Remains the Primary Initial Access Vector - blog.knowbe4.com
  21. CyberheistNews Vol 16 #34 Microsoft Observed 7.6 Billion Phishing Emails in Q2 2026 - blog.knowbe4.com
  22. From Fake Workers to Account Recovery: The Growing Identity Verification Risk - bleepingcomputer.com
  23. Hidden Prompts Trick AI Into False Email Summaries - darkreading.com
  24. Grok fooled into stealing user chat, location data, and more - malwarebytes.com
  25. WhatsApp Adds Multiple Passkeys for Phishing-Resistant Sign-Ins Across iOS and Android - thehackernews.com
  26. WhatsApp adds stronger two-step verification, multiple passkeys - bleepingcomputer.com
  27. WhatsApp Adds Multiple Passkeys and Stronger 2SV in Account Security Update - securityweek.com
  28. Police arrests dozens of suspects in global cybercrime crackdown - bleepingcomputer.com
  29. Nigeria Looks to Sovereign Cloud for Cyber, National Security - darkreading.com
  30. Linux Foundation to Govern TRACE, an Open Standard for AI Runtime Attestation - securityweek.com
  31. Taiwan Charges 9 Over Illegal AI Server Exports to China, Including Nvidia and Super Micro Staff - securityweek.com