Major Incidents or Breaches

  • A BGP hijack was used to divert Softaculous traffic, enabling attackers to deliver a malicious Virtualizor update to some customers, resulting in persistent root access on affected systems [12].
  • Dropbox reported that attackers exploited a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs and access Dropbox accounts [20].
  • Cybercriminals are selling 153 million digital scans of US and Canadian driver’s licenses on the dark web, likely sourced from a breach at IDScan.net [32].
  • Brazilian government and educational institution web servers were compromised by the Gambling Goblin group, who installed malicious Apache modules to hijack traffic and redirect it to betting pages [11].

Newly Discovered Vulnerabilities

  • A privilege escalation zero-day vulnerability dubbed FalconFlank has been disclosed in CrowdStrike Falcon [6].
  • Seven new security flaws have been added to CISA’s Known Exploited Vulnerabilities catalog, including vulnerabilities being used to deploy reverse shells and crypto miners [7].
  • An unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox is being actively exploited for remote code execution [16].
  • A critical authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory is under active exploitation, enabling attackers to forge admin tokens [18].
  • The All-in-One WP Migration and Backup plugin for WordPress contains an SQL injection flaw (CVE-2026-19949) that could allow unauthenticated remote code execution, affecting over 3 million sites [17][33].
  • Multiple vulnerabilities in Plex desktop clients and media servers prompted an urgent patch advisory from Plex [14].
  • SonicWall SMA 1000 devices are affected by zero-day vulnerabilities enabling unauthenticated remote code execution [23].
  • Cisco has issued patches for critical vulnerabilities in IOS XR and Nexus switches that could allow remote code execution and authentication bypass, and has warned of unpatched S/MIME flaws in its secure email products [34].
  • Rockwell Automation released patches for over a dozen vulnerabilities across several products, including RSLinx Classic and FactoryTalk [37].
  • An exploit has been published for a new Cleo Harmony vulnerability that allows remote authentication bypass via argument bearer manipulation [38].
  • Eight security flaws were disclosed across seven command-line AI coding agents, where malicious .git configurations could cause agents like Claude and Codex to execute attacker-controlled code [10].

Notable Threat Actor Activity

  • Threat actors are leveraging the Node.js runtime as a malware delivery tool in targeted attacks, abusing its trusted status to deploy malicious payloads [3].
  • The Shai-Hulud infostealer worm variant has expanded its credential theft capabilities, now scanning 469 locations across developer and CI/CD environments [4].
  • The “Spring Ring” threat group is targeting Microsoft Teams users with vishing attacks aimed at session hijacking, malware distribution, and infrastructure compromise [25].
  • The Gambling Goblin group, a Chinese-speaking cybercrime cluster, is responsible for malicious Apache module deployment on Brazilian government web servers [11].
  • The “Breeze Comet” threat group is conducting high-impact attacks on Brazilian and global financial systems [21].
  • A new Android banking trojan, StreamRat, was distributed to Spanish-speaking users through fake streaming campaigns on Meta ads, enabling near-complete device control [13].
  • NSO Group’s Pegasus spyware was used in a zero-click exploit to infect the iPhone of a Serbian student protest movement member [5].

Trends, Tools, or Tactics of Interest

  • Recruitment-themed phishing campaigns are using Browser-in-the-Browser (BitB) attacks to steal enterprise credentials [1].
  • The Balonx phishing kit uses generative AI to fully automate vishing attacks, including voice calls [2].
  • Active malware campaigns are distributing fake software installers that disable Windows Update and weaken Microsoft Defender, targeting users seeking popular software downloads [9].
  • Meta ads are being used as a distribution channel for Android malware, such as the StreamRat banking trojan [13].
  • Tech support scams are evolving, with scammers using new methods and targeting platforms more intelligently [40][41].
  • AI is being leveraged by cybercriminals to accelerate the speed and scale of attacks, providing significant time advantages [24].
  • Security tools for AI agents are emerging, such as OpenLeash, which adds human-in-the-loop checks for risky agent actions, and AIR Security’s firewall for AI skills and plugins [31][35].
  • Google, Anthropic, and OpenAI have released new cybersecurity-focused AI models, safeguards, and access programs to support defenders [8].

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government has introduced late amendments to the Cyber Security and Resilience Bill, granting ministers new powers to block high-risk technology suppliers from critical infrastructure in response to supply chain attack concerns [36].
  • California and Colorado will require operating systems to collect users’ ages for compliance, with open-source software like Linux likely exempt [39].

[1]: Recruitment-Themed Phishing Campaign Targets Enterprise Users
[2]: New Phishing Kit Uses AI to Fully Automate Vishing Attacks
[3]: Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
[4]: Shai-Hulud’s Reach Just Grew to 469 Credential Locations. Here’s What That Means
[5]: Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member’s iPhone
[6]: Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
[7]: CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
[8]: Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs
[9]: Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
[10]: Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
[11]: Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages
[12]: BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
[13]: Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control
[14]: Plex warns users to patch security vulnerabilities immediately
[16]: Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
[17]: WordPress backup plugin flaw exposes millions of sites to takeover attacks
[18]: Hackers exploit critical JFrog Artifactory flaw to forge admin tokens
[20]: Dropbox accounts breached through Lenovo email verification flaw
[21]: ‘Breeze Comet’ Tears Into Brazilian & Global Financial Systems
[23]: SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
[24]: AI Gives Cybercriminals a Dangerous Time Advantage
[25]: Threat Gang ‘Springs’ Vishing Attacks on Microsoft Teams Users
[31]: AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million
[32]: 153 Million Driver License Images Offered on Dark Web
[33]: Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
[34]: Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities
[35]: OpenLeash Adds a Human Check to Risky AI Agent Actions
[36]: UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure
[37]: Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products
[38]: Exploit Published for Fresh Cleo Harmony Vulnerability
[39]: Your phone or computer may soon ask how old you are
[40]: Tech support scams look different now. Here’s what to watch for
[41]: Scammers are getting smarter about where they target you

Sources#

  1. BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access - thehackernews.com
  2. Dropbox accounts breached through Lenovo email verification flaw - bleepingcomputer.com
  3. 153 Million Driver License Images Offered on Dark Web - securityweek.com
  4. Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages - thehackernews.com
  5. Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon - thehackernews.com
  6. CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners - thehackernews.com
  7. Hackers exploit Sangoma Switchvox flaw to deploy reverse shells - bleepingcomputer.com
  8. Hackers exploit critical JFrog Artifactory flaw to forge admin tokens - bleepingcomputer.com
  9. WordPress backup plugin flaw exposes millions of sites to takeover attacks - bleepingcomputer.com
  10. Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability - securityweek.com
  11. Plex warns users to patch security vulnerabilities immediately - bleepingcomputer.com
  12. SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE - darkreading.com
  13. Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities - securityweek.com
  14. Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products - securityweek.com
  15. Exploit Published for Fresh Cleo Harmony Vulnerability - securityweek.com
  16. Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code - thehackernews.com
  17. Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks - thehackernews.com
  18. Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means - thehackernews.com
  19. Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users - darkreading.com
  20. 'Breeze Comet' Tears Into Brazilian & Global Financial Systems - darkreading.com
  21. Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control - thehackernews.com
  22. Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone - thehackernews.com
  23. Recruitment-Themed Phishing Campaign Targets Enterprise Users - blog.knowbe4.com
  24. New Phishing Kit Uses AI to Fully Automate Vishing Attacks - blog.knowbe4.com
  25. Fake Software Installers Disable Windows Update and Weaken Microsoft Defender - thehackernews.com
  26. Tech support scams look different now. Here’s what to watch for - malwarebytes.com
  27. Scammers are getting smarter about where they target you - malwarebytes.com
  28. AI Gives Cybercriminals a Dangerous Time Advantage - darkreading.com
  29. AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million - securityweek.com
  30. OpenLeash Adds a Human Check to Risky AI Agent Actions - securityweek.com
  31. Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs - thehackernews.com
  32. UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure - securityweek.com
  33. Your phone or computer may soon ask how old you are - malwarebytes.com