-
October 16Exploited August 29, disclosed October 16, 2026
China-linked group exploited a BeyondTrust Remote Support zero-day
BeyondTrust disclosed CVE-2026-102764 (severity 9.3), a flaw in how an internal messaging component of Remote Support checks where messages come from, which lets a remote attacker perform file operations on the appliance. By BeyondTrust's timeline, a China-nexus espionage group tracked as Armory Castle (also UNC5221 or Warp Panda) used it as a zero-day on a single self-hosted appliance on August 29. SaaS customers were patched by October 9. CISA listed the flaw on October 16 with a federal deadline of October 19.
Why it matters, what to do and sources
Why it matters
Remote-support tools have privileged reach into many endpoints, which makes them valuable to espionage groups.
What defenders can take from it
- Self-hosted customers should patch immediately and follow CISA's advisory, including checking for earlier compromise.
- Limit internet exposure of remote-support appliances.
Sources
-
October 162026
Al Jazeera devices infected with spyware delivered through targeted ads
Al Jazeera reported that dozens of its journalists' devices were infected with spyware designed to collect sensitive data, and called it an assault on press freedom. As relayed by Democracy Now, Citizen Lab corroborated the findings: an Israeli advertising-technology company, Discover-Tech, used personalized ads to deliver spyware from Candiru, a firm the US government blacklisted in 2021. The infections are described as zero-click, meaning the target did not need to tap anything.
Why it matters, what to do and sources
Why it matters
Advertising networks can be used as a delivery route to specific people, which is hard for the target to notice or block.
What defenders can take from it
- High-risk users such as journalists and activists should keep devices fully updated and turn on lockdown-style protections where available.
- Organizations that protect at-risk staff should have a route to specialist help.
Sources
-
October 142026
Palo Alto Networks patches an exploited PAN-OS zero-day
Palo Alto Networks released fixes on October 14 for CVE-2026-0322 (severity 8.6) and said it had seen very limited exploitation. The flaw is in the management interface and lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. CISA set a federal deadline of October 17. The same week brought a fix for an exploited Ivanti Connect Secure zero-day and a Cisco warning about an exploited Secure Email Gateway flaw.
Why it matters, what to do and sources
Why it matters
A firewall is meant to protect the network, so root access on one gives an attacker a strong position. It is also the second exploited PAN-OS flaw in about five months.
What defenders can take from it
- Allow management interfaces only from trusted internal networks.
- Upgrade to a fixed version now, and review who has management accounts.
Sources
-
October 132026
Microsoft's October Patch Tuesday sets a record at about 1,400 fixes
Microsoft fixed roughly 1,400 vulnerabilities on October 13. Published counts range from 1,407 to 1,413 depending on method, against about 970 in September. One zero-day, a Windows Shell bypass of the Mark of the Web protection (CVE-2026-96951), was already being exploited, and two others were publicly disclosed. Microsoft ties the rising volume to AI-assisted vulnerability discovery. One analysis puts monthly industry-wide CVE disclosures up 145% in two years, from 3,173 in June 2024 to 7,765 in June 2026.
Why it matters, what to do and sources
Why it matters
Patch volume now exceeds what many teams can test and deploy, so prioritization decides outcomes.
What defenders can take from it
- Patch exploited and publicly disclosed flaws first, then the rest by exposure.
- Confirm that systems reached the target build, not just that an update was installed.
Sources
-
October 122026
Ahold Delhaize USA takes systems offline after a cybersecurity incident
The parent company of Food Lion, Stop & Shop and Hannaford said it was dealing with a cybersecurity issue and took some systems offline as a precaution. Websites and apps for several chains were unavailable, and unfulfilled online orders were refunded. The company began a controlled relaunch of certain systems. Public reporting so far does not name a cause or an attacker.
Why it matters, what to do and sources
Why it matters
Retail groups depend on shared back-end systems, so a precautionary shutdown can disrupt many brands at once.
What defenders can take from it
- Practice running the business with e-commerce and shared systems offline, and decide in advance who can order a shutdown.
Sources
-
October 12October 11 to 12, 2026
Hackers force defrost cycles in refrigeration systems at hundreds of French supermarkets
Overnight on October 11 to 12, attackers remotely pushed refrigeration systems into defrost mode. Temperatures reached 50 degrees Celsius in some cold rooms, food was spoiled and some fires started. Affected chains include Intermarché, Carrefour (80 stores), Coopérative U, Monoprix and Netto, and reporting cites upward of 350 stores. Paris prosecutors opened a criminal investigation. France's CERT-FR said numerous remote controllers were compromised and on October 13 widened its alert from Danfoss AK-SM and AK-SC equipment to Copeland and Dixell XWEB devices. Danfoss said many affected units were end-of-life models it no longer patches, and others ran old firmware. No group has claimed the attack, and other countries may be affected.
Why it matters, what to do and sources
Why it matters
This is everyday commercial equipment, not a power plant, and the weaknesses were known: Claroty's Team82 had published research on the Danfoss AK-SM 800A controller on August 9, and a Danfoss bulletin already described earlier attacks.
What defenders can take from it
- Remove building and refrigeration management systems from direct internet exposure.
- Replace controllers that no longer receive updates, and hold service providers to strict remote-access rules.
- Check CERT-FR's alert for the affected product lines.
Sources
-
October 82026
Canonical's websites hit by a second DDoS attack this year
Canonical's web properties, including ubuntu.com and developer pages, had intermittent outages from a distributed denial-of-service attack on October 8. No group has claimed it. An April attack that disrupted updates was claimed by a group calling itself the Islamic Cyber Resistance in Iraq 313 Team. This item is based on a weekly news review, so treat details as preliminary.
Why it matters, what to do and sources
Why it matters
Software distribution sites are shared infrastructure. When they are unreachable, updates are delayed for many users.
What defenders can take from it
- Mirror critical packages internally so updates do not depend on one public site.
Sources
-
October 1Reported October 2026
Chainalysis: North Korea-linked actors have stolen more than $1 billion in crypto this year
Chainalysis, which published its tracing findings on October 1, attributes more than $1 billion of 2026 crypto theft to North Korea-linked actors, and Elliptic separately counts more than 51 suspected North Korean incidents that also push the total past $1 billion. The total includes Drift (about $285 million), KelpDAO (about $292 million) and, on the firms' assessment, Bitget (about $387 million). One report puts North Korea-linked theft in the first half at about $643 million, roughly 55% of all thefts in that period.
Why it matters, what to do and sources
Why it matters
Attributions come from private analytics firms and company statements, based on on-chain patterns and timing, and are not formal government findings. The two firms count differently, so the total is an estimate.
What defenders can take from it
- Assume that staff at crypto firms are targets of long, patient social-engineering approaches.
- Verify job offers, investor meetings and support contacts through a second channel.
Sources
-
September 242026
Bitget loses about $388 million from hot wallets, and its CEO cites third-party security software
Bitget detected unauthorized transfers on September 24 and suspended withdrawals. The first estimate was $351.6 million, later revised to about $387.5 million to $388 million, taken from hot and warm wallets. Bitget says cold storage was not affected, that its protection fund covers all customer losses, and that the attacker used a vulnerability in third-party security software to obtain internal credentials and insert fraudulent withdrawal instructions. No CVE or vendor has been named, so that claim is unverified. Bitget engaged Mandiant and SlowMist, resumed bitcoin withdrawals around September 27 and 28, and said North Korea is very likely responsible. Chainalysis later traced stolen XRP into bitcoin. No law-enforcement agency has confirmed attribution.
Why it matters, what to do and sources
Why it matters
The attackers did not need to steal private keys. They went through a security product the exchange itself relied on, and one forensic report puts the earliest suspicious activity about 25 days before the theft.
What defenders can take from it
- Treat the security tools you run as part of your attack surface and keep their management interfaces off the internet.
- Add independent approval for withdrawals so that one set of stolen credentials is not enough.
Sources
-
SeptemberAugust and September 2026
Ransomware stays near record levels, led by Qilin and The Gentlemen
NCC Group counted 1,073 ransomware victims in August, a 2026 high. Breachsense counted 964 for August and 789 for September across 79 active groups, so totals differ by method. Qilin (164 incidents) and The Gentlemen (116) led in August. Healthcare was the most targeted sector in September for the fourth month in a row, and the United States accounted for 41% of victims.
Why it matters, what to do and sources
Why it matters
These counts only include victims listed on leak sites. Many victims pay before being listed, so real numbers are higher.
What defenders can take from it
- Keep offline, tested backups and require multi-factor authentication on all remote access.
- Rehearse your incident response plan, including who decides about payment.
Sources
-
SeptemberAugust to October 2026
Network edge devices and AI tooling keep appearing on CISA's exploited list
CISA's known-exploited-vulnerability additions between August and October included SonicWall SMA1000 appliances (two flaws on September 2), MikroTik RouterOS (three flaws across September 10 and 25), JFrog Artifactory, BerriAI LiteLLM and Kestra (all September 2), and repeated Microsoft SharePoint entries. Under its directive BOD 26-04, US federal agencies must prioritize listed flaws on internet-exposed assets that give full control, and check for prior compromise before patching.
Why it matters, what to do and sources
Why it matters
The list shows what attackers actually use: remote-access gear, routers, and developer and AI tooling that is often exposed to the internet.
What defenders can take from it
- Use the CISA list to decide what to patch first. It is free and updated continuously.
- Inventory internet-facing appliances, and check for signs of compromise before applying fixes.
Sources
-
SeptemberThird quarter 2026
Crypto theft reaches $1.18 billion in the third quarter, mostly through suppliers and infrastructure
Hacken counts $1.18 billion stolen across 107 incidents in the third quarter, the highest since early 2025. About 77% came from compromised suppliers, developer tools or infrastructure rather than flaws in smart contracts, and the four largest incidents made up about 80% of the value. PeckShield counted 50 incidents worth $136 million in August and 55 worth about $766 million in September, while CertiK counted 97 incidents and about $768 million for September. TRM Labs counted about $972 million across 207 incidents in the first half. Totals differ by tracker and method.
Why it matters, what to do and sources
Why it matters
The money is concentrated in a few large thefts, and most of them started with people or third-party systems, not clever code exploits.
What defenders can take from it
- Spend security effort on key management, vendor access and staff verification as well as on code audits.
- Treat any single loss figure as an estimate and check which tracker produced it.
Sources
-
September 6September 6 to 7, 2026
Liquid Network drained of about $319 million in bitcoin, and 85% is returned
On September 6, attackers drained about 4,000 BTC, roughly $319 million, from the reserve wallet of the Liquid Network, a Bitcoin sidechain built and run by Blockstream. TRM Labs' reconstruction points to a flaw in how the Elements software caches the results of range-proof checks, which may have let an invalid output pass as already verified. The attackers minted unbacked L-BTC and requested a withdrawal, and the signers approved it because the software treated the chain as valid. Blockstream said none of its signing keys were compromised and has patched the bug. On September 7 the attackers returned about 3,400 BTC (about 85%) and kept about 598 BTC, calling it a bounty and describing themselves as white-hat hackers, which is unverified. As of September 8 the network was paused and redemptions halted.
Why it matters, what to do and sources
Why it matters
It was the biggest theft of 2026 at that point, and the money came back only because the attackers chose to return it. The signers followed their rules and still approved a bad transaction.
What defenders can take from it
- Treat shortcuts in verification code, such as caches, as security-critical and test them against invalid input.
- Add withdrawal limits and delays so a bug cannot empty a reserve in minutes.
Sources
-
August 302026
Tectonic exploit forces the Cronos chain to halt and roll back
On August 30, an attacker inflated the price of Tectonic's thinly traded TONIC token about 100-fold within 20 minutes, according to on-chain researcher Weilin Li, and used it as collateral to borrow other assets from the largest lending protocol on Cronos. Early estimates put the loss near $75 million. About 36 minutes after the attack began, validators halted the chain, then agreed to roll it back by about one hour and 54 minutes. Cronos later said the attacker had borrowed about $120 million, that the rollback reversed about $111 million of it, and that about $9.2 million had already left through bridges and remains unrecovered. Crypto.com said its app and exchange were not affected.
Why it matters, what to do and sources
Why it matters
The rollback saved most of the money but erased legitimate transactions from that window, a trade-off only some networks can make. The attack follows the price-manipulation pattern seen in the 2022 Mango Markets case.
What defenders can take from it
- Do not accept thinly traded tokens as collateral without strict limits.
- Decide ahead of time who may halt or roll back a chain, and how that decision gets made.
Sources
-
AugustLate August 2026, disclosed September 17
Foreign actors alter settings at two small Colorado water utilities
Colorado officials said that in late August, foreign actors changed equipment settings, disabled remote access and alarms, and altered pumping cycles at two small private water providers, each serving fewer than 200 people. Operators regained control, and officials said treatment and water quality were not affected. The utilities and the attackers have not been named. Officials said they know of Iranian activity against water systems but there is no confirmation that these incidents belong to the same campaign. The EPA says more than 100 water and wastewater systems in 12 states have been targeted this year.
Why it matters, what to do and sources
Why it matters
Disabling alarms and remote access is what an attacker does to blind operators. Small operators often have no security staff.
What defenders can take from it
- Keep an independent way to see abnormal pump or pressure behavior that does not rely on the same remote access.
- The EPA reports helping fix about 700 vulnerabilities at more than 500 utilities since fiscal 2025. Small operators can ask it for help.
Sources
-
August 7August to October 2026
Two Texas-bound oil tankers hit by cyberattacks, propulsion-related system reportedly accessed
US Coast Guard and FBI teams boarded the tanker VL Prosperity on August 21 and a second tanker on August 24 after indications that both vessels' networks were compromised. Iranian state media reported the VL Prosperity lost communications for more than 30 hours around August 7 near the Strait of Gibraltar. Bloomberg later reported investigators found that hackers accessed a digital system connected to the ship's propulsion, and investigators have not said whether they tried to manipulate it. Crew claims relayed by Iranian media about engine speed and cooling are unverified. The Coast Guard has not attributed the attacks and reported no operational disruption, danger to crew or environmental harm. By September, US agencies were tracking cyber threats against nearly 20 vessels. North Carolina Ports separately reported a cyberattack on August 6 that forced manual operations.
Why it matters, what to do and sources
Why it matters
A ship is a floating industrial network. Even partial access to systems linked to propulsion is unusual enough to draw federal boarding teams.
What defenders can take from it
- Maritime operators can request anonymized cyber assistance from the Coast Guard.
- Treat shipboard control networks as OT, with segmentation and strict remote-access rules.
Sources
-
July 31July 31 to mid-August 2026
Coldcard hardware-wallet flaw lets attackers guess seed phrases, with losses above $115 million
Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.
Why it matters, what to do and sources
Why it matters
A flaw in seed generation puts every affected wallet at risk no matter how carefully its owner stored the recovery phrase. The loss estimate comes from Galaxy Research and was still rising.
What defenders can take from it
- If you use a Coldcard Mk3, follow the maker's instructions and move funds to a wallet created with updated firmware.
- Hardware vendors should test that random-number generation really uses the hardware source on every release.
Sources
-
July 30July 30 and late August 2026
CISA says more than 100 internet-exposed water systems were targeted in July
On July 30, CISA warned water and wastewater operators that threat actors target utilities of all sizes, and that even mature programs should check external connections, including cellular modems installed by operators, vendors or integrators that may not be documented. In an update reported in late August, CISA said it saw malicious activity against more than 100 internet-exposed systems in the sector in July, most commonly controllers connected directly to a cellular modem. It reported no significant disruption to water service. The FBI has urged utilities to disconnect systems from the internet where possible and be ready to revert to manual controls.
Why it matters, what to do and sources
Why it matters
The assumption that a very small utility is too small to target no longer holds, and nothing in the advisory describes a new technique.
What defenders can take from it
- Scan your own address space for exposed controllers and modems, and document every cellular connection.
- Replace default credentials and disconnect what does not need to be online.
Sources
-
July 26July 26 to 27, 2026
Coordinated attack disrupts more than 30 Minnesota water systems
Between July 26 and 27, a coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities, according to Tenable's summary. Some automated controls were affected and Maple Plain declared a local state of emergency. In Plymouth, only equipment connected over cellular links was hit and manual operation kept water flowing. Separately, cyber activity caused a pressure drop at the Clayton County Water Authority in Georgia, prompting a boil-water advisory for 300,000 customers, with service restored within hours. A federal investigation is pending and attribution is not confirmed, although the timing matches the Iran-linked controller activity in CISA's advisory.
Why it matters, what to do and sources
Why it matters
Small utilities were hit at scale, and the ability to switch to manual operation is what limited the impact.
What defenders can take from it
- Rehearse manual operation of pumps and valves.
- Find every cellular modem and remote-access path to your controllers, including ones installed by vendors.
Sources
-
July 22Published April 7, updated July 22, 2026
US agencies warn that Iran-linked actors are disrupting industrial controllers, then widen the warning
A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.
Why it matters, what to do and sources
Why it matters
The advisory covers the whole period. It turned an alert about one vendor's products into a warning about any internet-reachable controller.
What defenders can take from it
- Take controllers off the internet, or put them behind a VPN with multi-factor authentication.
- Change default passwords and use the advisory's detection guidance on PLC program changes.
Sources
-
July 21Mid-July 2026
Stadler Rail refuses a 10 million franc demand after a supplier-platform breach
The Swiss rail manufacturer said criminals used compromised login details to reach a data-exchange platform shared with a supplier in mid-July, exposing the supplier's technical information. The Everest group demanded about 10 million Swiss francs (roughly $12.3 million). Stadler refused, filed a criminal complaint and said its own IT systems, production and trains in service were not affected. Everest later listed Stadler on its leak site, according to SOCRadar.
Why it matters, what to do and sources
Why it matters
It shows the current extortion pattern: steal data, skip the encryption, and go through a partner's platform rather than the victim's own network.
What defenders can take from it
- Require multi-factor authentication on shared partner portals.
- Decide your ransom policy before an incident, as Stadler had.
Sources
-
JulyMay to July 2026
ShinyHunters pay-or-leak campaigns reach telecom and communications firms
In May the ShinyHunters group named Charter Communications, the parent of Spectrum, in a pay-or-leak extortion campaign. In July, data tied to about 1.6 million unique email addresses from RingCentral appeared in material the group published. These figures come from analysis of the group's own postings, and security reporters note that the group has a record of overstating its hauls.
Why it matters, what to do and sources
Why it matters
The group keeps hitting large service providers that hold data on many downstream customers, so one claim can affect many organizations.
What defenders can take from it
- Treat attacker-published numbers as claims until the victim confirms them.
- Check which of your suppliers are named in extortion postings, and ask them what was taken.
Sources
-
JuneReported mid-2026
ZionSiphon malware targets Israeli water treatment and desalination systems
Darktrace flagged ZionSiphon, malware built for industrial environments and aimed at Israeli water treatment and desalination systems. According to Bitsight's summary, it scans for industrial devices over several protocols and has sabotage capability aimed at chlorine and pressure controls. Bitsight says it may have been circulating since mid-2025.
Why it matters, what to do and sources
Why it matters
Malware written specifically for industrial processes is rare, so each case shows where state-aligned developers are putting effort.
What defenders can take from it
- Monitor OT networks for devices scanning other devices over several industrial protocols.
- Keep OT networks separated from business networks and the internet.
Sources
-
JuneMay to June 2026
A run of $10 million to $36 million bridge and key thefts
After the April thefts came a series of mid-sized ones. THORChain lost about $10.7 million on May 15 when a malicious node operator abused a flaw in its threshold-signature scheme. The Verus Ethereum bridge lost about $11.6 million on May 18 because of a missing check that let a forged proof pass. The Syscoin bridge lost about $10 million on June 7 after a parsing error in proof validation allowed unauthorized tokens to be minted. On June 8, Humanity Protocol lost about $31 million to $36 million after malware on a developer's laptop exposed seven private keys. Amounts vary by tracker.
Why it matters, what to do and sources
Why it matters
Two of the four were plain verification mistakes in bridges, and one was a stolen-keys problem on a single laptop. Individually small, together they show the same weak spots again and again.
What defenders can take from it
- Keep signing keys off everyday developer machines and use hardware-backed storage.
- Have bridge proof-validation code reviewed independently, including edge cases in parsing.
Sources
-
June 4June 4 to 25, 2026
Cisco SD-WAN zero-day gives root access, the seventh exploited SD-WAN flaw this year
Cisco confirmed exploitation of CVE-2026-20245, a command-injection flaw in Catalyst SD-WAN Manager, Controller and Validator that lets an attacker who already has administrator-level access run commands as root. CISA added it to its list of known exploited vulnerabilities on June 4. Mandiant later reported it was used as a zero-day at least two months before disclosure, chained with earlier SD-WAN authentication flaws (CVE-2026-20127 and CVE-2026-20182). It is the seventh Cisco SD-WAN vulnerability exploited in 2026.
Why it matters, what to do and sources
Why it matters
The SD-WAN management layer controls routing and policy for an entire network. Root access there lets an attacker reconfigure the devices at every site.
What defenders can take from it
- Keep management interfaces off the internet and patch the earlier SD-WAN flaws as well.
- Collect forensic data before upgrading, as Cisco advises, so evidence is not lost.
Sources
-
May2026
DentaQuest breach exposes health data of 15 million people
DentaQuest says a May network breach affected 15 million people, exposing Social Security numbers and dental or vision health information. It is described as the largest US health data breach reported so far in 2026.
Why it matters, what to do and sources
Why it matters
Records that combine identity numbers and health details are hard to replace and are useful for fraud for years.
What defenders can take from it
- If you receive a breach notice, freeze your credit and take the offered monitoring.
- Organizations: keep identity numbers only as long as you need them, and encrypt them at rest.
Sources
-
MayDetected April 14, disclosed May 2026
Carnival discloses social-engineering breach affecting about 6 million customers
Carnival's notice says it found unauthorized activity involving an employee account on April 14. The company said an unauthorized actor used social engineering to trick an employee into giving access to a limited part of its IT systems. An industry summary puts the number of affected customers at about 6 million. The breach was made public in May.
Why it matters, what to do and sources
Why it matters
A single convincing conversation with one employee was enough. Technical controls were not the weak point.
What defenders can take from it
- Train staff, especially help desks, to verify the identity of anyone asking for access.
- Limit what a single compromised employee account can reach.
Sources
-
May 142026
Researchers: Sandworm escalates inside industrial networks it has already entered
Nozomi Networks research reports that the Russian state-linked group Sandworm continues to target industrial and critical infrastructure using aggressive lateral movement and older malware, and that its activity intensifies after detection instead of stopping. Affected sectors include manufacturing and transportation. Targets included engineering workstations, operator screens (HMIs), PLCs, remote terminal units and other field controllers.
Why it matters, what to do and sources
Why it matters
Spotting an intruder is not the end of an intrusion. This group appears to rely on access it already has rather than on new vulnerabilities.
What defenders can take from it
- Protect engineering workstations and operator screens as closely as the controllers themselves.
- Assume an intruder detected in IT may already be in OT, and plan the response for both.
Sources
-
May 7April 29 to May 12, 2026
Canvas learning platform breached and school logins defaced
Instructure, the company behind the Canvas learning platform, confirmed unauthorized activity in late April. The ShinyHunters extortion group claimed responsibility, set ransom deadlines and on May 7 defaced the login pages of roughly 330 institutions. Canvas was taken offline briefly and restored the next day. On May 11 Instructure said it had reached an agreement with the actor and received confirmation that the data was destroyed. Claims of hundreds of millions of records have not been verified.
Why it matters, what to do and sources
Why it matters
One education-technology provider serves about 9,000 institutions, and the outage landed during exam season. It was reportedly the second ShinyHunters breach of Instructure in about eight months, and the intrusion reportedly abused a free teacher-account program that the company then shut down permanently.
What defenders can take from it
- List the vendors that hold student, employee or customer data, and plan how to keep working if one goes offline.
- Warn users about phishing messages that mention the incident. The FTC issued such a warning.
- Free and trial account programs are part of your attack surface.
Sources
-
April 22March to August 2026
Security tools turned into credential stealers in a supply-chain campaign
A campaign that Microsoft attributes to a group called TeamPCP compromised developer and security tooling. Attackers hijacked the release pipeline of the Trivy scanner, then reached Checkmarx KICS and LiteLLM. On April 22 a malicious Bitwarden CLI package (version 2026.4.0) was live on npm for 93 minutes, built to steal developer credentials such as GitHub tokens and cloud keys. Bitwarden said vault data and production systems were not affected. In August, CloudSEK published a lookup of thousands of potentially affected organizations.
Why it matters, what to do and sources
Why it matters
Scanners and command-line tools run inside build systems where secrets are available. In the Trivy case, 76 of 77 tags of its GitHub Action were repointed, so anyone referencing a tag by name pulled the malicious code.
What defenders can take from it
- Pin GitHub Actions and packages to exact versions or commit hashes instead of movable tags.
- If you ran an affected version, rotate every secret that build could see.
- Give build jobs the minimum secrets they need.
Sources
-
April 182026
KelpDAO bridge exploited for about $290 million, and LayerZero points to North Korea
On April 18, attackers got the Kelp bridge to release 116,500 rsETH tokens, worth about $290 million, using a forged cross-chain message. LayerZero's post-mortem says the attackers took over two RPC nodes that its verifier relied on, then flooded the other nodes with a denial-of-service attack so the verifier switched to the compromised ones, and the malicious software then erased its traces. LayerZero said it preliminarily links the attack to North Korea's Lazarus Group (its TraderTraitor unit) and blames Kelp's setup, which used a single verifier. Kelp has disputed that account. LayerZero said it will no longer sign messages for applications that use a single verifier.
Why it matters, what to do and sources
Why it matters
A configuration choice, relying on one verifier, turned a compromise of node infrastructure into a total loss. April was the costliest month of the year for crypto theft, and Drift and Kelp together made up about $577 million of it.
What defenders can take from it
- Use several independent verifiers for anything that moves large value across chains.
- Monitor RPC and data providers for forced fail-over and for answers that differ between providers.
Sources
-
April2026
FBI declares a major cyber incident after a surveillance system is compromised
The FBI declared a major cyber incident in April, which triggers a legally required disclosure to Congress, after finding that one of its surveillance systems had been compromised. Reports say the breach could have exposed phone numbers of people under surveillance. TechCrunch's roundup describes a second major incident involving ATF surveillance systems.
Why it matters, what to do and sources
Why it matters
Systems used for lawful surveillance hold highly sensitive targeting data, so they are prime espionage targets.
What defenders can take from it
- Treat surveillance, lawful-intercept and investigative systems as top-tier assets: segment them, log every access and review vendor access.
Sources
-
April 1Staged from March 11, drained April 1, 2026
Drift Protocol loses about $285 million after attackers get signers to pre-approve transactions
Drift, a trading protocol on the Solana blockchain, confirmed on April 2 that attackers drained about $285 million of user assets on April 1, in roughly 12 minutes. TRM Labs reports that attackers got members of Drift's Security Council to pre-sign transactions that looked routine but carried hidden permissions for administrative actions, then used a worthless token with a staged price history as collateral to withdraw real assets. Drift tied the operation to a six-month social-engineering effort by suspected North Korean actors, and TRM also judges North Korean hackers likely responsible. That view rests on on-chain indicators, not a government finding.
Why it matters, what to do and sources
Why it matters
It was not a bug in the code. On March 27, Drift had moved its Security Council to a 2-of-5 approval threshold with no waiting period, which removed the delay that might have let someone notice and stop the transactions.
What defenders can take from it
- Put a time delay on administrative actions so unusual changes can be caught before they run.
- Treat approaches to signers and staff, including in-person ones at conferences, as a possible attack route.
- Check exactly what a transaction authorizes before signing it, and limit which assets can be accepted as collateral.
Sources
No incidents match these filters.