CVE-2025-55182 (CVSS 10.0) affects React Server Components and Next.js App Router. The UAT-10608 group (Cisco Talos) exploits the flaw to automatically harvest database credentials, SSH keys, AWS secrets, GitHub tokens, and Stripe keys from 766 confirmed hosts.
On March 30, 2026, the Axios npm package was compromised for 39 minutes via a hijacked maintainer account. The North Korean group UNC1069 deployed the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Iranian group Handala breached FBI Director Kash Patel's personal Gmail. 300+ emails published in retaliation for domain seizures and $10M bounty.
TeamPCP compromised LiteLLM on PyPI on March 24, 2026 via a cascading supply chain attack. 95 million monthly downloads, credentials stolen.
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, deploying custom ransomware GenieLocker.
UNC6201 (China) exploited CVE-2026-22769 (CVSS 10.0) in Dell RecoverPoint since mid-2024 without detection. Three malware strains deployed, root persistence achieved.
The GlassWorm campaign compromised 72 Open VSX extensions to target developers. Attack analysis and protection measures for development teams.
Microsoft DART reveals an active vishing campaign via Teams where attackers impersonate IT support and use Quick Assist to take control of workstations.
Hacktivist group Handala, linked to Iran's IRGC, carried out a destructive wiper attack against medtech giant Stryker via Microsoft Intune. 50 TB of data stolen.
Analysis of the 2026 ransomware landscape: Qilin reaches 1,480+ victims, data-only exfiltration tactics emerge, and new non-Russian actors enter the scene.
Supply chain attacks exploded in 2025 (+95%). From the Shai-Hulud worm to OAuth compromises, analysis of key incidents and defenses to implement.