This week’s cybersecurity developments included Linux kernel flaws, Microsoft Defender zero days, GitHub supply chain compromises, active router botnets, and increasing exploitation of vulnerabilities worldwide.
Kaspersky’s latest ransomware report highlights evolving cybercriminal tactics, including encryption less extortion, EDR killers, and the sale of stolen credentials through Telegram channels and dark web forums.
European and North American authorities have dismantled First VPN Service, a criminal VPN infrastructure reportedly used by 25 ransomware groups to conceal cyberattacks, fraud, and data theft operations.
Cybersecurity researchers have uncovered Showboat, a Linux malware targeting a Middle East telecom provider, featuring SOCKS5 proxy capabilities and links to China affiliated threat activity clusters.
Threat actors compromised popular GitHub Actions workflows to exfiltrate CI/CD credentials through malicious code, raising concerns around software supply chain security and GitHub repository integrity.
Microsoft has disclosed active exploitation of CVE 2026 42897 affecting on premises Exchange Server deployments, allowing spoofing and JavaScript execution through crafted emails in Outlook Web Access.
A critical cPanel vulnerability CVE 2026 41940 is being actively exploited to target government, military, and MSP networks globally, enabling authentication bypass and remote control, with thousands of systems impacted.
AI assisted cyber attacks are rising sharply in 2026, lowering barriers for attackers, accelerating exploit timelines, and increasing phishing, malware, and supply chain threats globally.
Researchers uncover a global IRSF scam using fake CAPTCHA pages and over 120 Keitaro campaigns driving SMS fraud, crypto theft, and large scale cybercrime operations.
Tropic Trooper launches a cyber campaign using a trojanized SumatraPDF reader and GitHub powered AdaptixC2 to target users in Taiwan, Japan, and South Korea.
Chartered Institute of Bankers of Nigeria CIBN faces alleged 250GB data breach exposing member PII, identity documents, academic certificates, and source code.
CISA updates its Known Exploited Vulnerabilities catalog with eight new flaws, including Cisco SD WAN Manager issues, urging federal agencies to patch by April and May 2026.