Major Incidents or Breaches

  • The UK Legal Aid Agency confirmed that attackers who breached its IT systems in April 2025 stole records dating back to 1978, affecting sensitive data managed by the country’s Public Defender Service [18].
  • CenterPoint Energy disclosed a data breach impacting 1 million Texans, with compromised personal information including names, addresses, Social Security numbers, and driver’s license numbers [39].
  • GhostAction, a credential-theft campaign, compromised about 1,900 GitHub accounts and targeted over 30,000 repositories across 3,000 users and organizations, with a spike in activity observed on October 9 [9].
  • Ledger requested resellers across multiple Asian markets to halt sales and remove products from shelves following a supply-chain attack [21].
  • U.S. authorities disrupted North Korean IT worker fraud by shutting down over 40 “laptop farms,” charging 14 individuals, and seizing 187 computers and KVM devices. The operation targeted the Famous Chollima threat group [15][20].
  • Law enforcement in 17 countries arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material [16].

Newly Discovered Vulnerabilities

  • Drupal patched a critical remote code execution flaw in its Field UI module, fixed in versions 11.4.10, 11.3.19, and 10.6.19 [4].
  • Palo Alto Networks released security updates for a high-severity PAN-OS authenticated remote code execution vulnerability (CVE-2026-0322) under active exploitation [6][19][41].
  • Cisco patched a critical zero-day in Secure Email Gateway that allows unauthenticated attackers to write files and execute commands with root privileges, with evidence of active exploitation [12][22][42].
  • Langflow, an open-source AI development platform, is being actively exploited via a critical authenticated RCE flaw, with 1,423 honeypot exploit attempts observed [10].
  • AhsayCBS backup software received new security fixes after previously incomplete patches for two flaws that were exploited to deploy web shells and XMRig cryptocurrency miners [11].
  • Ivanti Connect Secure (ICS) is impacted by a high-severity authentication bypass and RCE vulnerability (CVE-2026-104935), exploited as a zero-day. CISA issued a warning for immediate patching, and reports note that the vulnerability was only partially discovered and patched in July [26][28].
  • A bug in Anthropic’s Claude Code Desktop ‘SneakPeek’ feature allows silent zero-click credential theft from developers, including SSH private keys and AWS credentials [30].

Notable Threat Actor Activity

  • Multiple phishing campaigns are leveraging AI-themed lures and business-related themes to deliver malware, including the abuse of legitimate RMM tools such as MSP360 [2][3][5].
  • Attackers exploited a flaw in Nextcloud’s optional Collabora Online - Built-in CODE Server app to backdoor servers with web shells, as reported by administrators [13].
  • The CikaBika Bot RAT, delivered via phishing, uses Discord for command and control, offering reconnaissance, remote execution, and data exfiltration capabilities [37].
  • The novel Android RAT ‘Hirudo’ replaces legitimate banking apps with trojanized versions, combining banking trojan and RAT functionalities [38].
  • Russian actors conducted an AI-enabled influence operation targeting Latin America, using spoofed emails, fake government documents, and the creation of local organizations to target schools [31].
  • Microsoft, in collaboration with global partners, disrupted three phishing kits responsible for over 1 billion scam messages targeting more than 75,000 organizations in 150 countries [14][25][29].

Trends, Tools, or Tactics of Interest

  • Threat actors are increasingly impersonating popular AI products in malware campaigns to steal browser sessions and compromise business accounts, with over 1,200 public sandbox analyses linked to such activity [5].
  • Citizen Lab published technical evidence of sophisticated mercenary spyware infecting mobile phones via targeted online advertising, demonstrating a zero-click infection vector [32].
  • Researchers warn that small AI models could soon spread autonomously across vulnerable smart devices, highlighting the risk of AI worms [49].
  • AI-powered penetration testing is noted to have blind spots due to safety restrictions and network limitations, leaving some assets and vulnerabilities untested [24].
  • Booz Allen research found that AI agents can rapidly navigate unfamiliar OT systems and reach industrial control networks from a perimeter compromise in just over 16 minutes [43].
  • Picus Security and other sources note the growing use of AI and agentic tools in digital forensics, incident response, and pentesting, though concerns remain about the reliability and validation of AI-generated outputs [7][24].
  • The CikaBika Bot RAT’s use of Discord for command and control reflects a continued trend of leveraging legitimate cloud-based services for malicious communications [37].
  • The ‘Hirudo’ Android RAT demonstrates a tactic of replacing installed banking apps with malicious versions to maintain persistence and facilitate credential theft [38].

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government imposed sanctions against Cryptomus, a cryptocurrency platform alleged to facilitate Russian money laundering and ransomware payments [33].
  • The NIS2 Directive holds tens of thousands of European organizations legally accountable for the security of third-party suppliers within their supply chains, regardless of direct control [1].
  • India mandated telecom providers to display registered caller names for all incoming calls on 4G and newer networks starting November 1, 2026 [8].

[1]: NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short
[2]: Warning: Phishing Attacks Are Using AI-Themed Ad Lures
[3]: Business-Themed Phishing Lures Deliver RMM Tools
[4]: Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
[5]: Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early
[6]: Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
[7]: Why AI Confidence Is Not Validation
[8]: India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1
[9]: GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
[10]: Langflow’s Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts
[11]: AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
[12]: Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
[13]: Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
[14]: Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
[15]: U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
[16]: Police arrests 95 suspects in international CSAM crackdown action
[18]: UK Legal Aid Agency: Hackers stole records dating back to 1978
[19]: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
[20]: FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
[21]: Ledger asks sellers across Asia to halt sales after supply-chain attack
[22]: Cisco patches new Secure Email Gateway zero-day exploited in attacks
[24]: The Blind Spots of Agentic Pentesting and How to Close Them
[25]: Global takedown hits network behind 1 billion phishing messages
[26]: CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
[28]: Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles
[29]: Yam Store: The Phishing Network Behind a Billion Messages
[30]: Anthropic ‘SneakPeek’ Flaw Is a Silent Zero-Click Threat
[31]: Russian Influence Operation Widely Targeting Latin America
[32]: ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads
[33]: U.K. Sanctions Cryptomus for RU Money Laundering
[37]: CikaBika Bot RAT Uses Discord for C&C
[38]: Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
[39]: CenterPoint Energy Data Breach Impacts 1 Million Texans
[41]: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
[42]: Cisco Warns of Exploited Secure Email Gateway Vulnerability
[43]: AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
[49]: AI worms could spread across your smart devices, Anthropic warns

Sources#

  1. UK Legal Aid Agency: Hackers stole records dating back to 1978 - bleepingcomputer.com
  2. CenterPoint Energy Data Breach Impacts 1 Million Texans - securityweek.com
  3. GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories - thehackernews.com
  4. Ledger asks sellers across Asia to halt sales after supply-chain attack - bleepingcomputer.com
  5. U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud - thehackernews.com
  6. FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested - bleepingcomputer.com
  7. Police arrests 95 suspects in international CSAM crackdown action - bleepingcomputer.com
  8. Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules - thehackernews.com
  9. Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation - thehackernews.com
  10. Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks - bleepingcomputer.com
  11. Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution - securityweek.com
  12. Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability - thehackernews.com
  13. Cisco patches new Secure Email Gateway zero-day exploited in attacks - bleepingcomputer.com
  14. Cisco Warns of Exploited Secure Email Gateway Vulnerability - securityweek.com
  15. Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts - thehackernews.com
  16. AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches - thehackernews.com
  17. CISA warns admins to immediately fix Ivanti flaw exploited as zero-day - bleepingcomputer.com
  18. Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles - darkreading.com
  19. Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat - darkreading.com
  20. Warning: Phishing Attacks Are Using AI-Themed Ad Lures - blog.knowbe4.com
  21. Business-Themed Phishing Lures Deliver RMM Tools - blog.knowbe4.com
  22. Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early - thehackernews.com
  23. Hackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App - thehackernews.com
  24. CikaBika Bot RAT Uses Discord for C&C - securityweek.com
  25. Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies - securityweek.com
  26. Russian Influence Operation Widely Targeting Latin America - darkreading.com
  27. Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages - thehackernews.com
  28. Global takedown hits network behind 1 billion phishing messages - bleepingcomputer.com
  29. Yam Store: The Phishing Network Behind a Billion Messages - darkreading.com
  30. ‘Nightmare Scenario’: Zero-Click Spyware Is Infecting Phones via Targeted Ads - wired.com
  31. AI worms could spread across your smart devices, Anthropic warns - malwarebytes.com
  32. The Blind Spots of Agentic Pentesting and How to Close Them - bleepingcomputer.com
  33. AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds - securityweek.com
  34. Why AI Confidence Is Not Validation - thehackernews.com
  35. U.K. Sanctions Cryptomus for RU Money Laundering - krebsonsecurity.com
  36. NIS2 Part One: Why Your NIS2 Supply Chain Strategy Is Already Falling Short - blog.knowbe4.com
  37. India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1 - thehackernews.com