Major Incidents or Breaches

  • The ShinyHunters cyber extortion group claims to have breached the US Federal Bureau of Investigation, stealing data on current and former employees and job applicants. The group states it exploited a zero-day vulnerability in Oracle PeopleSoft to access internal services and exfiltrate sensitive data. ShinyHunters is demanding the FBI retract a report describing its tactics and threatens to leak the stolen information if demands are not met [10][24][50][52].
  • Threat actors stole 170 private repositories from cybersecurity firm CrowdSec by leveraging an OAuth token obtained through the TanStack npm supply chain attack on a former employee’s computer [35].
  • Sweden’s data privacy regulator fined IT provider Miljödata $183,000 for insufficient security measures that led to a breach in August 2025, affecting 2.2 million individuals [22].

Newly Discovered Vulnerabilities

  • F5 disclosed and patched a critical zero-day vulnerability (CVE-2026-94127) in BIG-IP Access Policy Manager (APM) that allows unauthenticated attackers to execute remote code on affected systems. The flaw was actively exploited in attacks targeting OAuth servers [7][20][49].
  • Check Point released emergency fixes for a zero-day vulnerability (CVE-2026-93616) in its Security Management Server, which allowed attackers in targeted attacks to upload and execute arbitrary scripts [11][27][51].
  • Arista Networks patched a zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments, which was being actively exploited to allow remote attackers access to privileged internal functionality [17][48].
  • A new cPanel flaw in the CalDAV and CardDAV services enables any hosting account holder to execute code as root, granting full server control [3].
  • A critical vulnerability in Bifrost, an open-source AI gateway, allows unauthenticated attackers to execute arbitrary commands on the server without credentials [15].
  • A use-after-free vulnerability in the Linux kernel’s AF_UNIX socket subsystem enables container escape and host root access. An exploit has been released and the flaw remains unpatched in Ubuntu [6].
  • WordPress patched a critical flaw in its core software that allowed unauthenticated attackers to load arbitrary PHP files from outside theme folders, potentially leading to remote code execution on some servers [12].
  • Next.js disclosed a critical ImageResponse vulnerability that can lead to server code execution via crafted SVG input [9].
  • Adobe released patches for nine critical vulnerabilities in Connect and AEM Forms that could be exploited for arbitrary code execution and privilege escalation [43].
  • Google Chrome 154 patched 108 vulnerabilities, including several rated critical for memory safety and memory corruption [45].

Notable Threat Actor Activity

  • A Chinese state-linked threat actor (UTA0565) exploited a zero-day exploit chain in Google Chrome and Microsoft Windows via fake websites to deploy CLEANGULP malware, targeting victims with advanced techniques [8].
  • Chinese-speaking threat actors have been exploiting vulnerabilities in Zyxel GS1900 Smart Managed Switches and WordPress to steal sensitive government data from nearly 1,000 devices and over 18,500 records [23].
  • The EvilTokens phishing-as-a-service platform, which compromised more than 12,000 Microsoft accounts at over 10,000 organizations using AI-driven attack chains, was disrupted in a coordinated takedown by Microsoft, which seized 50 websites and disabled over 150 domains [14][28][33][44].
  • A malicious npm package (“tw-pkgprobe-7731”) posed as a Twilio bug-bounty probe to target developers, enabling credential exfiltration [13].
  • A new Windows malware, ClosedQuorum, uses multiple AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously determine post-compromise actions [25].
  • The Ryuk ransomware group member was sentenced to 24 months in prison for attacks on US companies [19].
  • Threat actors exploited a stolen OAuth token from a former employee to access CrowdSec’s private GitHub repositories [35].

Trends, Tools, or Tactics of Interest

  • An AI-assisted phishing campaign sent over one million personalized emails attempting payment diversion scams, demonstrating the growing use of AI in large-scale phishing operations [1].
  • AI is increasingly being leveraged in both attack (e.g., phishing, malware decision-making) and defense (e.g., autonomous security agents), with new tools emerging to benchmark and control AI agent performance [4][5][25][36][44][47].
  • Attackers with privileged access can register rogue external MFA providers to steal user passwords during legitimate login attempts [21].
  • More than 80,000 AI relay servers are being used to mask Chinese access to frontier AI models in the US, likely to facilitate model cloning [31].
  • A proof-of-concept zero-day tool, BigDiskBuster, was released that can block Microsoft Defender updates by filling available disk space [16].
  • The Cybersecurity and Infrastructure Security Agency (CISA) published guidance on deception techniques to help organizations set traps for cybercriminals [34].
  • Shadow IT remains a challenge, with tools like Wazuh recommended to improve visibility of unmanaged endpoints and unauthorized assets [26].
  • Honeywell research indicates that while 88% of OT security leaders consider their programs mature, only 21% have a complete OT asset inventory, and full autonomy in OT security remains rare [42].

Regulatory or Policy Developments Affecting the Security Industry

  • Sweden’s IMY imposed a significant fine on Miljödata for inadequate data protection, reinforcing regulatory expectations for IT service providers handling large volumes of personal data [22].

Sources#

  1. ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants - thehackernews.com
  2. ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach - bleepingcomputer.com
  3. ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report - securityweek.com
  4. ShinyHunters claims FBI breach was revenge for “false” report - malwarebytes.com
  5. Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data - darkreading.com
  6. Sweden fines Miljödata $183,000 over breach affecting 2.2 million - bleepingcomputer.com
  7. F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers - thehackernews.com
  8. F5 patches BIG-IP APM zero-day flaw exploited in RCE attacks - bleepingcomputer.com
  9. Critical F5 BIG-IP Vulnerability Exploited as Zero-Day - securityweek.com
  10. Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - thehackernews.com
  11. Check Point warns of Management Server zero-day exploited in attacks - bleepingcomputer.com
  12. Check Point Patches Exploited Management Server Zero-Day - securityweek.com
  13. Arista patches actively exploited VeloCloud Orchestrator zero-day - bleepingcomputer.com
  14. Arista Urges Immediate Patching of Exploited VCO Zero-Day - securityweek.com
  15. New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control - thehackernews.com
  16. Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials - thehackernews.com
  17. Exploit Released for Unpatched Ubuntu Linux Flaw Enabling Host-Root Container Escape - thehackernews.com
  18. WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers - thehackernews.com
  19. Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input - thehackernews.com
  20. Adobe Patches Critical Flaws in Connect, AEM Forms - securityweek.com
  21. Chrome 154 Patches 108 Vulnerabilities - securityweek.com
  22. Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware - thehackernews.com
  23. Chinese hackers exploit WordPress, Zyxel flaws to steal govt data - bleepingcomputer.com
  24. Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises - thehackernews.com
  25. EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts - bleepingcomputer.com
  26. Microsoft Disrupts EvilTokens Device Code Phishing Service - darkreading.com
  27. AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft - securityweek.com
  28. Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials - thehackernews.com
  29. New ClosedQuorum Windows malware uses AI for attack decisions - bleepingcomputer.com
  30. Ryuk ransomware member sentenced to 24 months in prison - bleepingcomputer.com
  31. AI-Assisted Phishing Campaign Sent Over A Million Personalized Emails - blog.knowbe4.com
  32. 545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent - thehackernews.com
  33. Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests - thehackernews.com
  34. Amid Ongoing Rogue Incidents, Debate Over AI Safety Gets Real - darkreading.com
  35. Outerlimit Raises $16 Million to Stop Rogue AI Agents From Causing Harm - securityweek.com
  36. Rogue external MFA providers can steal passwords during logins - bleepingcomputer.com
  37. Relays Are Masking Chinese Access to Frontier AI Models in the US - darkreading.com
  38. Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates - thehackernews.com
  39. Deception by Design: CISA's Guide to Tricking Cybercriminals - darkreading.com
  40. Reducing shadow IT visibility gaps with Wazuh - bleepingcomputer.com
  41. Honeywell: OT Security Teams Embrace AI, but Autonomy Still Rare - securityweek.com