Major Incidents or Breaches

  • Data on approximately 8.8 million individuals was leaked following a ransomware incident involving Manchester Airports Group. The threat actor claims to have exfiltrated 550GB of data after the company reportedly refused to pay the ransom, with access gained via exposed admin keys [33].
  • Thomson Reuters disclosed that its C-Track court case management platform was breached in March 2026, potentially exposing Social Security numbers and sealed court data [9].
  • Coder’s Cloudflare infrastructure was compromised, enabling attackers to add unauthorized registry servers that distributed malicious Terraform modules containing credential-stealing code [12].
  • A French hospital, Hôpital privé de la Loire, was fined €500,000 by CNIL after a breach exposed data belonging to 727,000 patients and their relatives [11].
  • Over 440,000 exploit attempts have targeted critical remote code execution vulnerabilities in the WordPress plugins Super Forms and Elementor Pro, with attackers exploiting these flaws to deploy webshells and execute arbitrary commands on affected sites [2][17].
  • Researchers identified that free streaming boxes, specifically SuperBox devices, may be used to route criminal proxy traffic through users’ home networks via pre-installed apps [36].
  • StreamRat Android malware has infected an estimated 570,000 users through social media adverts on Meta and TikTok, enabling attackers to take control of compromised devices [37].
  • BraZetsu, a Python-based Windows malware framework, is being used to create an underground marketplace by turning compromised hosts into inventory for criminal access sales [8].

Newly Discovered Vulnerabilities

  • Google released updates to patch 12 vulnerabilities in Chrome, including a high-severity V8 zero-day (CVE-2026-85046) that has been actively exploited in the wild [4][10][32].
  • Cisco patched a critical flaw in Nexus 9000 switches running Silicon One, which could allow unauthenticated remote code execution as root [7].
  • HPE issued fixes for a critical remote code execution vulnerability in the ArubaOS-CX network operating system [13].
  • VMware Workstation and Fusion updates addressed critical vulnerabilities that could allow attackers with admin access to a VM to execute code on the host [31].
  • Plex released urgent updates to patch multiple undisclosed security flaws in Plex Media Server [3].
  • A 12-year-old PostgreSQL vulnerability (CVE-2026-6471, “PostGREShell”) was disclosed, allowing attackers with low-level replication access to achieve code execution, superuser privileges, and establish persistent backdoors [29].

Notable Threat Actor Activity

  • The Toy Ghouls group was found using new backdoors, one leveraging HiveMQ MQTT broker and another using the Matrix protocol for command and control [1].
  • The “Phantom Deal” campaign targets large enterprises with fake merger and acquisition scams, involving detailed reconnaissance to trick midlevel employees into authorizing large financial transfers [20].
  • ShinyHunters’ recent activities and claims of breaches remain under review, with ongoing discussion about their impact and legitimacy [21].

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly exploiting OAuth and social engineering traps, such as phishing kits impersonating CEOs and IT staff, to compromise business accounts and bypass MFA [6][18].
  • AI-driven attack automation is accelerating breach timelines, with recent research showing that machine-speed agents can compress a two-week attack into ten hours [22].
  • Malicious actors are leveraging residential proxy networks via compromised consumer devices, expanding the footprint and persistence of criminal infrastructure [36].
  • Social media advertising is being used to distribute Android banking trojans at scale, as seen with StreamRat campaigns on Meta and TikTok [37].

Regulatory or Policy Developments Affecting the Security Industry

  • The French data protection regulator CNIL imposed a €500,000 fine on a hospital for inadequate data protection measures following a breach [11].

Sources#

  1. Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal - securityweek.com
  2. Thomson Reuters Court Software Breach May Have Exposed SSNs and Sealed Data - thehackernews.com
  3. Coder's registry infrastructure compromised to push malicious modules - bleepingcomputer.com
  4. French hospital fined €500,000 after breach exposes data of 727,000 - bleepingcomputer.com
  5. Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws - thehackernews.com
  6. Critical Elementor Pro flaw exploited to take over WordPress sites - bleepingcomputer.com
  7. Free streaming boxes may be routing criminal traffic through your home - malwarebytes.com
  8. StreamRat Android malware spreads through Meta and TikTok ads - malwarebytes.com
  9. BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory - thehackernews.com
  10. Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day - thehackernews.com
  11. Google warns of new Chrome zero-day flaw exploited in attacks - bleepingcomputer.com
  12. Google Patches 6th Chrome Zero-Day of 2026 - securityweek.com
  13. Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root - thehackernews.com
  14. HPE patches critical ArubaOS-CX remote code execution flaw - bleepingcomputer.com
  15. VMware Workstation and Fusion Updates Patch Critical Vulnerability - securityweek.com
  16. Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws - thehackernews.com
  17. 12-Year-Old PostgreSQL Vulnerability Enables Database, Server Takeover - securityweek.com
  18. Angry Birds: Toy Ghouls’ new toys - securelist.com
  19. Large Enterprises Targeted in Fake Merger & Acquisition Scams - darkreading.com
  20. What We Missed: Did ShinyHunters 'Breach' ReliaQuest? - darkreading.com
  21. ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories - thehackernews.com
  22. Your Employee’s Password Appeared in an Infostealer Log. Now What? - bleepingcomputer.com
  23. AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours - darkreading.com