Live cyber security incidents, explained in plain language

What happened

Recent cyber attacks are succeeding through basic oversights such as unauthenticated devices, fake support calls, and malicious shared links. At the same time, criminals are targeting critical software flaws to build hidden botnet networks and steal corporate funds. Canadian businesses need to be aware that everyday digital tools and simple human errors are actively being weaponised.

Who is affected

Any organisation running internet-connected devices with default passwords, unvetted software extensions, or mobile devices receiving unverified support requests is at risk.

How to mitigate it

• Audit all networked hardware immediately to verify that no devices are operating without strong, unique passwords.
• Enforce strict policies restricting the installation of unapproved browser extensions and third-party software.
• Educate employees to hang up on unsolicited IT support calls and reject unexpected device login prompts.
• Identify and patch critical software vulnerabilities across all Linux servers, mobile endpoints, and workstations.

What happened

Google disrupted a botnet of over 1.3 million Android devices, primarily TV set-top boxes, after seizing control of the attacker servers. Investigations revealed that device manufacturer Videostrong intentionally installed a backdoor at the factory to sell network access to cybercriminals. Attackers exploited these compromised devices to commit digital advertising fraud and secretly route external internet traffic through owners' connections.

Who is affected

Organizations and remote employees using unvetted Android TV set-top boxes, specifically hardware produced by manufacturer Videostrong.

How to mitigate it

• Identify and inventory all streaming boxes and smart devices operating on your corporate and home-office networks.
• Immediately disconnect and replace unauthorized or off-brand Android TV devices, particularly those manufactured by Videostrong.
• Isolate smart televisions and multimedia equipment onto a dedicated, segregated IoT network segment.
• Require all workplace hardware and boardroom electronics to be vetted and purchased through approved IT procurement channels.

What happened

Security researchers revealed that an Iran-aligned cyber espionage group compromised a government cloud environment and a high-profile individual. The campaign highlights how state-aligned actors target cloud infrastructure and identity accounts to gather intelligence. Canadian businesses should take note, as threat groups frequently use similar tactics to compromise corporate cloud systems.

Who is affected

Organisations utilizing cloud environments and high-profile accounts that manage sensitive communications or operational data.

How to mitigate it

• Enforce robust multi-factor authentication across all cloud platforms and user accounts.
• Audit cloud infrastructure permissions to ensure the principle of least privilege is strictly maintained.
• Monitor cloud sign-in logs and user activity alerts for unexpected access attempts or anomalous behaviour.
• Review and revoke unused third-party application permissions and administrative roles in cloud tenants.

What happened

Critical security vulnerabilities have been identified in Langflow, a popular open-source tool used to build artificial intelligence agents and workflows. Remote attackers can bypass authentication and run unauthorised code on host servers without needing any login credentials. Businesses using this software risk having their underlying systems compromised if deployments remain unpatched.

Who is affected

Organisations hosting Langflow versions 1.0.0 through 1.12.8 for AI agent and workflow development are vulnerable.

How to mitigate it

• Upgrade all Langflow installations to version 1.13.0 immediately.
• Audit internal networks and development environments to locate all running instances of Langflow.
• Restrict public internet access to Langflow instances using firewalls or private networks until updates are complete.
• Review server activity logs for any unauthorised remote code execution or suspicious access attempts.

What happened

A recent industry survey reveals that 96 percent of security teams are either actively using or testing artificial intelligence in their daily operations. For organizations currently evaluating these tools, deploying AI agents requires a clear assessment of existing security operations maturity. Businesses must ensure their underlying security foundations are ready before relying on automated AI systems.

Who is affected

Organizations and security operations teams planning or testing the deployment of artificial intelligence tools.

How to mitigate it

• Conduct a formal readiness assessment of existing security operations before deploying automated AI tools.
• Evaluate internal processes to verify whether current workflows can reliably support AI integration.
• Benchmark testing outcomes thoroughly prior to moving AI security agents into production environments.

What happened

Cybercriminals are impersonating internal IT support staff on Microsoft Teams to convince employees to hand over remote control of their workstations. Once connected, the attackers exploit weak Active Directory Certificate Services configurations to obtain administrator credentials and steal sensitive business data. This highlights how attackers use familiar workplace chat tools to bypass traditional defences and exploit user trust.

Who is affected

Organizations using Microsoft Teams alongside Active Directory Certificate Services are vulnerable to these targeted social engineering attacks.

How to mitigate it

• Train staff to verify any unsolicited IT support requests through a known secondary channel before granting remote PC access.
• Audit Active Directory Certificate Services templates and settings to remove misconfigurations that allow privilege escalation.
• Restrict and monitor the use of remote desktop software across all company devices.
• Monitor domain controllers and privileged accounts for unexpected certificate requests and suspicious logins.

What happened

Cybersecurity researchers have uncovered a targeted espionage campaign attacking Linux server infrastructure with a new trojan named SysGoRAT and suspected AI-generated scripts. Threat actors use these tools to compromise critical servers and establish persistent, covert control over networks. While observed attacks focus on government and affiliated systems, tactics and tools like these frequently expand to target private sector infrastructure.

Who is affected

Organizations operating Linux servers, particularly government bodies and state-affiliated organizations, are at risk from this campaign.

How to mitigate it

• Audit Linux servers for unauthorized background processes, unfamiliar cron jobs, and unexpected network connections.
• Implement endpoint detection and response agents on all Linux systems to detect remote access trojans and suspicious script execution.
• Enforce strict least-privilege access and multi-factor authentication on all administrative server accounts.
• Restrict shell access and monitor script activity across critical production server environments.

What happened

Security researchers have identified a new Windows infostealer called VOLTA that uses artificial intelligence to evaluate stolen corporate data and rank victims by monetization value. The malware actively steals browser cookies, saved passwords, Outlook profiles, and Slack workspace information. This allows cybercriminals to quickly pinpoint and exploit the most financially lucrative targets within compromised networks.

Who is affected

Organizations running Windows endpoints that use Chromium-based web browsers, Microsoft Outlook, or Slack.

How to mitigate it

• Deploy managed endpoint detection tools to block infostealer activity and flag suspicious processes on Windows systems.
• Enforce robust multi-factor authentication across all corporate accounts to limit the risk of stolen credentials.
• Restrict saving business passwords directly inside web browsers and mandate enterprise password managers instead.
• Revoke active browser sessions and reset compromised account credentials immediately upon any detection of malware.

What happened

A maximum-severity security flaw has been uncovered in Canonical LXD and MicroCloud software. Attackers with network access can impersonate trusted accounts using only a public certificate, completely bypassing the need for a private key. Once authenticated, intruders can gain full control over virtual machines and cloud clusters, putting business data at serious risk.

Who is affected

Organisations hosting virtual machines or container clusters using Canonical LXD or MicroCloud with accessible HTTPS APIs.

How to mitigate it

• Apply the latest vendor security patches from Canonical for LXD and MicroCloud immediately.
• Restrict access to HTTPS management APIs so they cannot be reached from untrusted networks or the public internet.
• Audit server and cluster access logs for suspicious authentication events and unexpected client connections.
• Place infrastructure management interfaces behind a secure virtual private network with strict access controls.

What happened

Hackers altered a trusted third-party page-speed script loaded on the Polymarket website, allowing malicious code to access signed-in accounts and divert approximately $2.7 million in funds. This incident highlights how an external vendor's compromised code can directly expose your business website and its visitors to serious harm. Canadian business owners must ensure that every external software tool integrated into their web platforms is properly vetted and secured.

Who is affected

Any organisation operating websites or online portals that load third-party scripts, analytics tools, or vendor software.

How to mitigate it

• Audit all external JavaScript libraries, tags, and third-party tools running on your company website.
• Implement Subresource Integrity (SRI) and Content Security Policies (CSP) to prevent unauthorized code from executing.
• Remove outdated, unmaintained, or unnecessary third-party plugins and tracking scripts immediately.
• Require multi-factor authentication and re-authentication prompts for sensitive account actions or monetary transfers.

What happened

Security researchers have identified a sophisticated attack chain involving a newly discovered malware loader named NetamLoader that injects malicious code through the .NET framework. The campaign specifically compromises custom Windows 10 builds utilized by government bodies in Asia. While current activity is tightly targeted, advanced techniques of this nature often influence broader cyber threats against enterprise networks.

Who is affected

Government organizations operating custom Windows 10 builds are the confirmed targets of this campaign.

How to mitigate it

• Ensure endpoint detection and response agents are active and configured to detect abnormal .NET process injection.
• Enforce strict application whitelisting and software restriction policies across all Windows workstations.
• Monitor endpoint systems continuously for unauthorized memory modifications or undocumented assembly-loading activity.

What happened

U.S. law enforcement agencies have officially tied a massive 6.43-billion-dollar cryptocurrency theft to the North Korean state-backed hacking group known as TraderTraitor. These elite state-sponsored actors deploy sophisticated techniques to compromise networks and siphon valuable digital holdings. This incident highlights the extreme financial risks businesses face when sophisticated threat actors target corporate infrastructure.

Who is affected

Cryptocurrency exchanges, financial technology companies, and organizations handling or custodying digital assets.

How to mitigate it

• Implement 24/7 endpoint detection and response tooling to spot and stop unauthorized intrusions early.
• Enforce strict multi-factor authentication and privileged access controls across all sensitive platforms.
• Segment networks to isolate high-value digital asset systems and transactional data from standard workstations.
• Conduct ongoing security awareness training to help staff recognize sophisticated social engineering attempts.

What happened

Blockchain intelligence firm Chainalysis confirmed an intrusion into its internal tools by an external actor, resulting in exposed customer identity records. The company confirmed that user credentials, active session tokens, and core investigation data were not accessed during the incident. Canadian businesses must stay vigilant as exposed customer details can be weaponized in targeted follow-up phishing attempts.

Who is affected

Organizations and individuals whose account or identity details were held within Chainalysis internal systems.

How to mitigate it

• Alert your staff to watch for targeted phishing emails or impersonation schemes that reference business relationships.
• Verify that phishing-resistant multi-factor authentication is enforced for all corporate accounts and vendor portals.
• Audit external supplier access and ensure least-privilege permissions are applied across internal tools.
• Monitor user login activity and report unexpected access attempts or unusual identity requests immediately.

What happened

Attackers are actively chaining security vulnerabilities in Ivanti Connect Secure appliances to gain unauthenticated root access to corporate networks. Government cybersecurity agencies have confirmed active exploitation in the wild, placing these flaws on high-priority watchlists. Canadian businesses using these appliances face immediate risk of complete system takeover and unauthorized internal network access.

Who is affected

Organizations running Ivanti Connect Secure (ICS) appliances exposed to the internet are at risk.

How to mitigate it

• Identify and inventory all external-facing Ivanti Connect Secure appliances across your network immediately.
• Apply all official security patches and vendor workarounds released for the affected vulnerabilities without delay.
• Review network access logs and appliance activity for any signs of unauthorized access or suspicious administrative behavior.
• Restrict external administrative access to Ivanti appliances using dedicated management networks or trusted IP allowlists.

What happened

Security researchers discovered a flaw in ChatGPT where opening a malicious shared link could execute attacker code directly inside a user's active session. This vulnerability allowed attackers to access and read private conversation histories belonging to anyone who opened the link. OpenAI resolved the issue within eight days, but the incident highlights significant privacy risks when employees use web-based AI tools for work.

Who is affected

Organizations whose employees use ChatGPT and open shared links from external or unverified sources.

How to mitigate it

• Instruct employees to avoid clicking ChatGPT share links received from unknown or untrusted senders.
• Define clear corporate policies restricting the entry of proprietary, client, or sensitive business data into public AI platforms.
• Implement endpoint web filtering and email security solutions to inspect and block suspicious links before users open them.
• Review active cloud application permissions and encourage staff to sign out of sensitive web sessions when they are not in use.

What happened

New data shows automated network-layer DDoS attacks surged by 38 percent in the third quarter, reaching over 18 million attacks globally. Cybercriminals launch thousands of these assaults every hour to overwhelm servers and take digital services offline. For small and mid-sized businesses, these disruptions can cause costly downtime and lock customers out of critical services.

Who is affected

Any organization relying on public-facing websites, cloud applications, or customer portals to conduct business.

How to mitigate it

• Implement automated DDoS protection and web application firewalls through your hosting or cloud provider.
• Configure rate-limiting rules on your network edge to filter out suspicious traffic spikes.
• Verify your backup and failover procedures so critical systems remain reachable during network disruptions.
• Establish clear incident escalation contacts with your internet and web service providers.

What happened

Chinese state-sponsored attackers are using an artificial intelligence-driven penetration testing framework called ARTEX to target hundreds of organisations simultaneously. Tracked as Vapor Panda, the group leverages this automated tool to rapidly probe and compromise high-value targets. This activity demonstrates how adversaries are adopting AI to accelerate the scale and speed of their intrusions.

Who is affected

High-value organisations worldwide across multiple sectors are at risk from these coordinated intrusion campaigns.

How to mitigate it

• Deploy continuous managed threat detection to identify and contain automated scanning and unauthorized access attempts.
• Enforce multi-factor authentication across all external-facing services and remote access portals.
• Routinely assess and patch all internet-exposed systems to eliminate vulnerabilities before automated tools can exploit them.

What happened

TeamViewer has resolved a vulnerability that allows a controlled computer to attack the system that connected to support it. A compromised or malicious host machine can exploit the issue to crash the viewer application and potentially execute unauthorized commands on the controller device. Businesses must update TeamViewer promptly to prevent support staff systems from being targeted during remote sessions.

Who is affected

Organizations and IT teams using TeamViewer to remotely connect to and control host computers.

How to mitigate it

• Update TeamViewer across all corporate workstations and servers to the latest patched version immediately.
• Verify that IT personnel update their local TeamViewer applications before connecting to external or unverified computers.
• Audit all endpoints to identify and update or uninstall outdated installations of TeamViewer.

What happened

Hackers launched nearly 63,000 attacks within 24 hours targeting a high-severity security flaw in WordPress Core. This vulnerability allows remote code execution, giving unauthorized attackers the ability to take control of affected websites. Canadian businesses hosting their own WordPress sites must act quickly to prevent system compromises.

Who is affected

Organizations running websites powered by WordPress Core versions 4.7 through 7.1.3 are at risk.

How to mitigate it

• Apply the latest security updates released for WordPress Core immediately.
• Monitor website traffic and server logs for abnormal activity or exploitation attempts.
• Ensure complete, restorable website backups are verified before and after applying the patch.
• Implement a web application firewall to help filter out malicious remote execution traffic.

What happened

A customer reported that a Trezor Safe 5 hardware wallet purchased through reseller CryptoBilis contained an unauthorized circuit board designed to broadcast recovery phrases over mobile networks. Trezor is urging anyone who purchased devices from this reseller since March 2026 to transfer their funds immediately to a clean wallet with a new phrase. This incident demonstrates the real-world operational risk of purchasing hardware through unauthorized or compromised supply chain channels.

Who is affected

Any organization or user who purchased a Trezor Safe 5 hardware wallet from reseller CryptoBilis since March 2026.

How to mitigate it

• Immediately transfer all digital assets held on affected devices to a new wallet with an entirely new recovery phrase.
• Cease using any Trezor hardware wallets purchased through CryptoBilis until the vendor completes its investigation.
• Review internal procurement policies to verify that sensitive hardware is sourced directly from original manufacturers or authorized distributors.

What happened

Critical security updates often stall for days because technical staff worry that fixes might disrupt core business applications or block regular network traffic. While waiting for proof that updates will not break existing operations, organizations leave themselves exposed to known vulnerabilities. Following a disciplined process of observing, testing, deploying, and verifying changes allows organizations to eliminate security risks without unplanned downtime.

Who is affected

Organizations that run critical business software, firewalls, and endpoint protections where operational stability is prioritized over immediate patching.

How to mitigate it

• Observe existing application traffic and baseline system activity before making any security alterations.
• Prove the safety of urgent fixes by testing rules and patches in non-blocking or staging environments first.
• Act promptly to deploy validated security fixes across the entire production network.
• Confirm that essential business operations and applications remain fully functional immediately following the change.

What happened

A hacker linked to the Syrian Electronic Army has been sentenced to 42 months in prison for participating in a state-backed conspiracy targeting Western news outlets. The group gained unauthorized access to media platforms to distribute fabricated statements that triggered severe real-world financial disruption. This case highlights the severe reputational and market fallout that can result when corporate communication channels are compromised.

Who is affected

Organisations that maintain public-facing communication channels, news media platforms, and businesses reliant on public brand credibility.

How to mitigate it

• Enforce multi-factor authentication on all corporate social media and public communication accounts.
• Restrict administrative and publishing privileges to only designated, trained personnel.
• Conduct regular employee training to spot credential-harvesting and targeted spear-phishing attempts.
• Implement an incident response protocol to immediately revoke access and issue verified corrections if an account is breached.

What happened

Attackers compromised the official Claude Code extension across the Open VSX registry and Cursor Marketplace to deploy a persistent SSH backdoor onto developer systems. This allowed threat actors to establish unauthorized remote access to affected workstations. Businesses with software development staff must verify their environments to prevent unauthorized access to internal code and systems.

Who is affected

Organizations and developers who downloaded the Claude Code extension via the Open VSX registry or the Cursor Marketplace.

How to mitigate it

• Verify developer workstations and immediately remove any versions of the Claude Code extension sourced from Open VSX or Cursor.
• Inspect system SSH configuration files and authorized key lists for unfamiliar entries or backdoors.
• Rotate all API keys, access tokens, and SSH credentials that were accessible from potentially affected developer devices.
• Deploy managed endpoint detection tools to isolate and investigate any endpoints exhibiting suspicious outbound connections.

What happened

Drupal has warned that attackers are actively exploiting a highly critical authorization flaw in its Commerce Core module. This security gap allows unauthorised actors to bypass restrictions within online shopping carts and store functions. Businesses running vulnerable versions are at immediate risk of compromise and operational disruption.

Who is affected

Organizations running websites with Drupal Commerce Core versions 0.0.0 to 2.41 or 3.0.0 to 3.3.13 are vulnerable to attack.

How to mitigate it

• Apply the latest official security updates for Drupal Commerce Core immediately.
• Review web server logs and online store transactions for signs of unauthorized access or tampering.
• Deploy web application firewall rules to detect and block malicious traffic targeting shopping cart endpoints.

What happened

Security authorities have confirmed that cybercriminals are actively exploiting vulnerabilities found in GitLab software and Cisco firewalls. The most severe flaw carries a maximum severity score of 10.0 and allows attackers to execute code remotely on affected systems. Canadian businesses using these tools risk network compromise or significant operational outages if systems are not updated quickly.

Who is affected

Organizations using GitLab Community Edition, GitLab Enterprise Edition, or vulnerable Cisco firewall appliances are at risk.

How to mitigate it

• Audit your environment to identify any exposed Cisco firewall devices and GitLab installations.
• Apply the latest vendor security updates for GitLab and Cisco equipment immediately.
• Monitor network and application logs for unusual connection requests or unauthorized configuration changes.
• Restrict administrative management interfaces so they are not directly reachable from the public internet.

What happened

Major cryptocurrency exchange Binance announced a security incident that has impacted roughly $6.3 billion worth of assets. Stablecoin issuers and partners have frozen billions of dollars in connected tokens to limit losses while investigations continue. Canadian businesses holding cryptocurrency or transacting through digital asset exchanges face potential liquidity disruptions and heightened account risks.

Who is affected

Organizations and individuals holding funds, accounts, or financial integrations connected to Binance and affected stablecoin networks.

How to mitigate it

• Audit all corporate cryptocurrency accounts, exchange logins, and associated API access keys immediately.
• Enforce strong multi-factor authentication across all commercial financial platforms and administrative services.
• Monitor corporate ledgers and outbound financial transactions for unapproved activity or delayed settlements.

What happened

Cybercriminals are capitalizing on both advanced tactics and simple oversights, targeting businesses through critical firewall flaws, token theft, and exposed passwords. Attackers are also abusing trust in familiar applications, weaponizing PDF files, and using artificial intelligence tools to accelerate their campaigns. Leaving old software unpatched or login doors unlocked exposes organizations to rented banking trojans and unauthorized network access.

Who is affected

Organizations running unpatched network firewalls, legacy software, or systems with exposed credentials and session tokens are at direct risk.

How to mitigate it

• Apply urgent security patches to perimeter firewalls and resolve lingering software vulnerabilities across your network.
• Reset exposed user credentials and invalidate stolen session tokens across all business accounts.
• Inspect incoming email attachments carefully, especially PDF files originating from unfamiliar or unexpected senders.
• Audit trusted workplace applications and monitor environments for unusual automated or artificial intelligence tool activity.

What happened

A severe security vulnerability in the Linux kernel TCP code allows remote attackers without credentials to run commands with full root access on servers. The issue received a near-maximum severity rating of 9.8 out of 10, and working exploit code has already been generated using artificial intelligence. Organizations running affected Linux servers face the threat of complete system takeover if these systems remain unpatched.

Who is affected

Organizations running servers on Ubuntu, Red Hat Enterprise Linux, or other Linux distributions using vulnerable kernel versions are affected.

How to mitigate it

• Identify all servers and cloud instances running Ubuntu, Red Hat Enterprise Linux, or other Linux distributions.
• Apply the latest kernel security updates from your operating system vendor as soon as they are released.
• Restrict external network access to Linux servers by limiting open TCP ports with firewalls.

What happened

Attackers are distributing malicious software disguised as desktop applications for ChatGPT and Claude through deceptive GitHub projects. These fake programs, using names like GPT-6 Astra and Claude Opus, secretly deploy malware loaders and cryptocurrency miners on infected systems. If downloaded by staff, these applications degrade system performance and leave business networks exposed to further compromise.

Who is affected

Any organisation whose employees download unapproved artificial intelligence software or executables from third-party repositories like GitHub.

How to mitigate it

• Restrict local administrator privileges to prevent employees from installing unauthorized software.
• Deploy endpoint detection and response tools to detect and terminate unauthorized cryptocurrency mining processes.
• Block or monitor downloads from unvetted code repositories and software hosting sites.
• Establish clear software procurement policies that require staff to use official, web-based AI tools.

What happened

Google has announced Gemini 4 Carbon, a frontier AI model demonstrating record performance in finding, exploiting, and patching security vulnerabilities. While these capabilities offer major advances for defensive patching, they also show how rapidly AI agents can identify and exploit weaknesses in software. Organizations must prepare for a threat environment where software vulnerabilities are discovered and weaponized at machine speed.

Who is affected

Any organization operating software, codebases, or internet-facing systems that rely on slow or manual vulnerability management.

How to mitigate it

• Accelerate patch management routines to ensure known software flaws are remediated promptly.
• Deploy continuous threat monitoring to spot automated scanning and exploitation activity early.
• Perform automated security audits and code reviews to locate and fix vulnerabilities before attackers find them.

What happened

Cyber attackers are now using advanced AI models to quickly discover system vulnerabilities and automatically generate exploit code. This development dramatically compresses the time security teams have left to react and stop an intrusion. Canadian businesses relying on traditional, slow-moving security processes are falling behind the rapid pace of automated attacks.

Who is affected

Organizations relying on manual or slow-moving security operations to identify and patch system vulnerabilities are at risk.

How to mitigate it

• Adopt continuous, automated threat detection to cut down the time required to spot unauthorized activity.
• Prioritize and accelerate vulnerability patching routines before attackers can exploit software weaknesses.
• Update your incident response plans to ensure your team can act immediately when a critical threat is flagged.

What happened

A security vulnerability in the Telegram app for Android allowed attackers to run malicious code on a victim's smartphone as soon as an incoming voice call was answered. The attack required nothing more than an ordinary Telegram account to execute. Organizations with employees using Telegram on Android devices could face compromised devices and data exposure if the app is outdated.

Who is affected

Organizations and individuals using Telegram on Android devices running versions prior to 12.10.4.

How to mitigate it

• Update Telegram for Android to version 12.10.4 or later immediately across all workplace devices.
• Verify that automatic application updates are enabled in the Google Play Store on all managed and personal employee phones.
• Implement centralized mobile device management to monitor app versions and enforce rapid patch deployment.

What happened

Artificial intelligence is beginning to automate routine security analyst workflows, including alert investigation, evidence collection, and response execution. This development is fundamentally changing how security operations centres structure their teams and handle day-to-day defence. For business owners, these advancements enable faster threat containment but require modernized security strategies.

Who is affected

Businesses that depend on traditional, manual security operations centres and alert monitoring processes to handle cyber incidents.

How to mitigate it

• Review internal security monitoring workflows to determine where automated alert triage can reduce response delays.
• Define clear operational boundaries and safeguards for automated threat response actions across connected systems.
• Partner with security providers that incorporate advanced analytics to rapidly correlate alerts and isolate compromised assets.

What happened

A security researcher uncovered over 26,400 valid cloud and artificial intelligence access keys accidentally published in public code repositories on Gitee. Anyone who copied these exposed credentials could immediately use them to access the underlying cloud infrastructure and services. Businesses face significant risks of unauthorized access and data loss if software developers inadvertently commit live secrets to public code.

Who is affected

Any business whose internal developers or external contractors publish code containing live cloud or AI access keys to public code repositories.

How to mitigate it

• Scan all existing software repositories to identify and remove any hardcoded API tokens or cloud credentials.
• Immediately revoke and rotate any access keys that may have been committed to code sharing platforms.
• Implement automated secret-detection tools within development workflows to stop credentials from being uploaded.
• Apply least-privilege permissions to all cloud and AI service keys to limit damage if a credential is leaked.

What happened

Cisco has released emergency updates for a high-severity flaw in its firewall and VPN software that attackers are actively exploiting in the wild. An unauthenticated remote attacker can exploit this weakness to crash affected network firewalls. This leaves businesses vulnerable to sudden network outages, VPN downtime, and disrupted operations.

Who is affected

Organizations using Cisco Secure Firewall Adaptive Security Appliance (ASA) Software or Secure Firewall Threat Defense (FTD) Software are at risk.

How to mitigate it

• Identify all perimeter appliances running Cisco ASA or FTD software across your environment.
• Apply the vendor-provided security patches for CVE-2026-76418 as soon as possible.
• Review firewall logs for unexpected reboots or service crashes that could indicate exploitation attempts.

What happened

GitHub has launched a public preview of a package firewall that stops malicious npm packages from being installed. The tool reviews package downloads and metadata requests in real time to prevent harmful code from entering projects. For businesses that build or manage internal software, this provides an essential safeguard against software supply chain attacks.

Who is affected

Organizations and development teams relying on npm packages to build or maintain software and web applications.

How to mitigate it

• Test and enable the GitHub package firewall preview across your active npm development pipelines.
• Audit existing software dependencies to confirm that all installed third-party libraries originate from trusted sources.
• Implement access controls and security policies to restrict developers from installing unverified software components.

What happened

Attackers recently attempted to exploit a maximum-severity flaw in GitLab just days after a security fix was published. The vulnerability allows malicious actors to execute arbitrary code on the server through manipulated configuration settings. Businesses hosting their own development environments face immediate risk if these critical updates are delayed.

Who is affected

Organizations running self-hosted GitLab servers that have not applied the latest security updates.

How to mitigate it

• Apply the latest official GitLab security updates to all on-premises and cloud servers immediately.
• Verify that underlying server environments and runtime dependencies are fully updated alongside the application.
• Inspect application and server logs for abnormal continuous integration activity or unauthorized command execution.
• Restrict administrative consoles and developer tools to internal networks or protected VPN connections.

What happened

Attackers exploited a critical vulnerability in Cisco Catalyst SD-WAN systems to install custom malware known as KeyDrift. The malware was designed to quietly copy and store the encryption keys used to protect data flowing between branch offices. If these keys are stolen, unauthorized actors could potentially decrypt and monitor sensitive communications across your network.

Who is affected

Organizations that run unpatched Cisco Catalyst SD-WAN controller software are affected.

How to mitigate it

• Verify and apply the official Cisco security updates released in February to all SD-WAN controllers immediately.
• Inspect SD-WAN systems for indicators of compromise or unexpected software installations associated with KeyDrift.
• Rotate your SD-WAN encryption keys and administrative credentials to invalidate any potentially stolen data.
• Ensure administrative access to SD-WAN management portals is restricted from the public internet.

What happened

Security authorities have confirmed that hackers are actively exploiting a zero-day vulnerability in Broadcom VMware ESX to tamper with audit trails. Cyber espionage actors have weaponized this security flaw to conceal their activity during targeted attacks. Businesses relying on VMware virtual infrastructure face the risk of undetected network compromise if their systems remain unaddressed.

Who is affected

Organizations running Broadcom VMware ESX environments, particularly professional service firms such as legal organizations, are at risk.

How to mitigate it

• Identify and inventory all Broadcom VMware ESX servers deployed across your organization.
• Review security guidance from Broadcom regarding CVE-2026-41709 and apply vendor updates immediately.
• Examine VMware server audit logs and monitoring feeds for anomalies or evidence of log suppression.
• Isolate VMware ESX management interfaces to ensure they are accessible only via secured, restricted administrative networks.

What happened

Threat actors are actively targeting recently patched security vulnerabilities in Palo Alto Networks devices with management interfaces exposed to the public internet. If an administrative portal is publicly accessible, attackers can exploit these flaws to compromise the device and access your network. Organizations using these appliances must immediately secure their devices to prevent unauthorized control.

Who is affected

Organizations running Palo Alto Networks appliances with management interfaces exposed directly to the public internet are at risk.

How to mitigate it

• Disable public internet access to all Palo Alto Networks management interfaces immediately.
• Restrict administrative access strictly to internal networks or a dedicated secure administrative VPN.
• Apply the latest official security updates from Palo Alto Networks to resolve the PHP2Shell vulnerabilities.
• Inspect access logs on all perimeter appliances for unusual or unauthorized administrative connection attempts.

What happened

State-sponsored threat group Volt Typhoon hijacked small office routers, IoT equipment, and enterprise systems to build a covert network for zero-day attacks. This infrastructure, dubbed Silent Train, allowed attackers to conceal their activities while targeting organisations for strategic access. Small and mid-sized businesses face real risks when perimeter hardware and smart devices are co-opted into these stealth operations.

Who is affected

Organisations operating small office or home office (SOHO) routers, internet-connected IoT devices, and enterprise network infrastructure are at risk.

How to mitigate it

• Audit all network perimeter devices, small office routers, and IoT hardware across your organisation.
• Apply all current vendor firmware updates and security patches to internet-facing equipment.
• Replace legacy or end-of-life routers and appliances that no longer receive security support.
• Monitor outbound traffic for unusual connection patterns originating from networking gear and IoT assets.

What happened

Google will allow approved third-party app stores outside the United States to install apps with one tap and run background updates starting December 1. To participate, stores must pass identity verification and submit their entire catalogue and updates to Google for ongoing malware scanning. Canadian business owners should ensure their mobile settings prevent employees from installing unapproved software on corporate devices.

Who is affected

Businesses outside the United States with employees using Android devices for work tasks or corporate data access.

How to mitigate it

• Review mobile device management policies to restrict app installations to approved sources.
• Verify that corporate Android devices require administrative approval before adding third-party app marketplaces.
• Remind staff not to install unvetted software or alternative app stores on devices used for business.

What happened

A security researcher revealed a chain of logic flaws in Microsoft Edge that allowed a malicious website to escape the browser sandbox and execute code directly on a Windows computer. Microsoft released a patch shortly after the technique was demonstrated in competition, but technical details of the exploit have now been made public. Unpatched systems remain exposed to device compromise simply by opening an untrusted web link.

Who is affected

Organizations using outdated installations of Microsoft Edge on Windows devices are at risk.

How to mitigate it

• Verify that Microsoft Edge is updated to the latest available release across all company computers.
• Ensure automatic browser updates are enabled and not blocked by local group policies or user settings.
• Deploy regular vulnerability scans to identify endpoints missing critical software patches.

What happened

Attackers are chaining PHP2Shell vulnerabilities with kernel exploits to gain complete root control over internet-facing servers. Researchers observed AI-assisted threat actors using this technique to successfully compromise dozens of servers and breach sensitive networks. Canadian businesses with exposed, unpatched web infrastructure risk total server takeover and severe operational disruption.

Who is affected

Organisations operating internet-exposed servers running vulnerable PHP services and unpatched operating system kernels are at risk.

How to mitigate it

• Identify and inventory all public-facing servers running PHP applications immediately.
• Apply available security updates to address PHP2Shell vulnerabilities and patch server operating system kernels.
• Restrict direct public access to administrative interfaces and enforce strict firewall rules.
• Monitor server logs for unusual privilege escalation attempts and unauthorised remote shell execution.

What happened

Security researchers have detected threat actors actively probing systems for a critical vulnerability in Oracle E-Business Suite. With a near-maximum severity rating, this weakness can allow unauthorized attackers to execute code remotely on vulnerable systems. Businesses using this software need to ensure security updates are applied immediately to prevent unauthorized access.

Who is affected

Organizations running Oracle E-Business Suite utilizing the Oracle Application Object Library are at risk.

How to mitigate it

• Apply Oracle's latest Critical Patch Update to all Oracle E-Business Suite installations immediately.
• Monitor network logs and perimeter defences for abnormal scanning or probing activity directed at Oracle applications.
• Restrict public internet exposure to Oracle E-Business Suite components until systems are confirmed to be patched.

What happened

A critical vulnerability has been uncovered in common server firmware that allows attackers to run unauthorized code before the operating system loads. The flaw affects machines while they are booting over a network, effectively bypassing Secure Boot defences. If exploited, an attacker on the network can gain deep, persistent control over the server.

Who is affected

Organisations operating servers or endpoints that rely on EDK II-based UEFI firmware and boot over the network are at risk.

How to mitigate it

• Disable network booting in the system BIOS or UEFI settings on all devices where it is not actively needed.
• Restrict and segment network access so unauthorized devices cannot communicate with servers during boot processes.
• Monitor hardware vendor advisories and apply official firmware and BIOS updates as soon as they become available.

What happened

Artificial intelligence is transforming cybersecurity as threat actors increasingly leverage AI tools to automate attacks. Organizations must modernise their security operations to identify hidden patterns across massive datasets and accelerate incident response. Integrating AI into security monitoring enables defenders to make faster decisions and stay ahead of automated threats.

Who is affected

Organizations across sectors such as healthcare, finance, manufacturing, and education that rely on digital systems.

How to mitigate it

• Deploy security operations tooling that uses AI to uncover patterns hidden within large activity datasets.
• Automate repetitive security workflows to speed up incident investigation and decision-making.
• Implement continuous security monitoring to detect and respond to automated attacker activity promptly.

What happened

Adobe has released critical security patches to fix eight serious flaws in its Campaign Classic software. If exploited, these vulnerabilities allow attackers to bypass security measures, gain elevated privileges, and execute malicious code on target systems. Canadian businesses using the platform risk severe operational compromise if these updates are not applied quickly.

Who is affected

Businesses and marketing teams running installations of Adobe Campaign Classic are affected.

How to mitigate it

• Identify and inventory all deployments of Adobe Campaign Classic across your infrastructure.
• Apply the latest security updates released by Adobe immediately to all affected instances.
• Verify that software update processes and system access controls are functioning properly across the environment.

What happened

A phishing campaign called Skyw4lker is hijacking corporate accounts by abusing legitimate cloud authentication processes instead of stealing passwords directly. Attackers exploit device code authorization workflows to gain persistent access while leaving fewer visible warning signs. Canadian businesses should take note, as these advanced tactics easily bypass traditional security defences.

Who is affected

Organizations utilizing cloud platforms with device code authentication workflows enabled are at risk.

How to mitigate it

• Disable or strictly limit device code flow authentication if it is not required for your daily operations.
• Enforce conditional access policies that restrict logins to trusted, company-managed devices and approved locations.
• Train staff to recognize device code phishing prompts and never enter external authorization codes into their accounts.
• Monitor cloud identity audit logs regularly for unusual login patterns and unexpected device registrations.

What happened

Anthropic demonstrated that an unreleased artificial intelligence model could successfully discover and combine multiple security flaws into working exploits across major operating systems and browsers. While these tests were strictly confined to a laboratory and all identified vulnerabilities have already been patched by vendors, it highlights how quickly AI tools can uncover security gaps. Canadian businesses should ensure regular software updates remain a top priority to defend against increasingly sophisticated vulnerability discovery.

Who is affected

Organisations operating devices running Microsoft Windows, Linux, Android, Google Chrome, or Apple Safari are affected if regular updates are not applied.

How to mitigate it

• Apply all pending operating system updates across Windows, Linux, and Android endpoints immediately.
• Ensure Google Chrome and Apple Safari web browsers are updated to their latest versions on all company devices.
• Enable automated patching policies for both operating systems and third-party software.
• Audit business hardware to confirm all devices are still supported with vendor security updates.

What happened

The US Department of Justice has seized the web domain for Virtualine, a bulletproof hosting service accused of supporting widespread criminal operations and cryptocurrency money laundering. These rogue hosting services knowingly shield threat actors who deploy malicious infrastructure against organizations and individuals. While this takedown dismantles a key criminal hub, attackers will quickly migrate their operations to competing bulletproof services.

Who is affected

Any organization whose networks and staff are exposed to cyber threats staged on unmonitored bulletproof hosting infrastructure.

How to mitigate it

• Verify that your firewall and DNS filtering rules block traffic to known bulletproof hosting providers and newly flagged criminal domains.
• Ensure your threat intelligence feeds and endpoint detection signatures are updating automatically.
• Audit perimeter network logs for any outbound traffic or connections associated with seized rogue hosting infrastructure.
• Implement multi-factor authentication across all external access points to prevent unauthorized entry from compromised external hosts.

What happened

Japanese provider GMO Internet Group is offering a $1 million bounty to identify attackers who breached its cloud desktop service after the company refused an extortion demand. The compromised service hosts remote Windows desktops primarily used for foreign exchange trading. This incident demonstrates that hosted remote desktop services remain high-value targets for cybercriminals seeking leverage through operational disruption.

Who is affected

Organisations and traders relying on GMO's Onamae.com Desktop Cloud, as well as businesses that host critical business functions on remote Windows desktop infrastructure.

How to mitigate it

• Enforce multi-factor authentication across all remote desktop and virtual workspace access portals.
• Restrict administrative and remote desktop access using network allowlists and conditional access policies.
• Deploy 24/7 endpoint detection and response tools across hosted virtual machines to identify suspicious activity quickly.
• Maintain isolated, tested backups of critical desktop configurations and operational data to reduce extortion leverage.

What happened

Tailscale has issued an update to address security flaws in its built-in SSH server. The vulnerabilities could allow an attacker with access to a compromised device to reach protected root-level files and services on other connected servers. Canadian businesses using the platform should apply updates quickly to prevent unauthorized access across their networks.

Who is affected

Organizations using Tailscale with the built-in SSH server enabled on versions prior to 1.104.4.

How to mitigate it

• Upgrade Tailscale to version 1.104.4 or newer on all client devices and servers.
• Review your Tailscale network access controls to ensure only authorized endpoints can connect.
• Audit systems for any unusual root-level activity or unrecognized SSH connection requests.

What happened

Cybercriminals known as ShinyHunters have been actively exploiting a critical zero-day vulnerability in Oracle PeopleSoft since May. Security researchers revealed that the attack chains three separate flaws together to bypass internal controls and reach administrative interfaces. Oracle released an urgent patch in June, making immediate updates essential to prevent unauthorized access.

Who is affected

Organizations running unpatched installations of Oracle PeopleSoft are at risk.

How to mitigate it

• Apply the June Oracle security update addressing CVE-2026-35273 across all PeopleSoft instances immediately.
• Restrict access to internal management interfaces and isolate PeopleSoft servers from direct internet exposure.
• Inspect system and network logs dating back to May for signs of suspicious access or unusual server-side requests.

What happened

Cyber attackers are actively exploiting critical vulnerabilities in Adobe Commerce, Magento, and related software components, resulting in breaches across hundreds of online storefronts. Cybersecurity authorities have formally warned that these flaws are being actively leveraged by attackers in the wild. Unpatched e-commerce sites face immediate risk of unauthorized access and system compromise.

Who is affected

Organizations running Adobe Commerce or Magento e-commerce platforms, as well as systems utilizing Google's Brotli decoder library.

How to mitigate it

• Audit all online stores and hosting environments to locate installations of Adobe Commerce, Magento, or the Brotli library.
• Apply all available security updates and patches from the vendors immediately.
• Inspect web directories and store files for unauthorized changes or uploaded web shells.
• Review incoming web traffic logs for signs of exploit attempts targeting these specific components.

What happened

Security researchers have uncovered cyber attacks leveraging dozens of artificial intelligence agents to automate intrusion operations. Attackers utilized these AI agents autonomously and alongside human operators to scan and compromise target networks. This shift toward automated tooling enables threat actors to execute attacks at greater speed and scale than traditional methods.

Who is affected

Organizations with internet-exposed servers are at risk as threat actors deploy automated tools that can target any vulnerable business.

How to mitigate it

• Deploy 24/7 managed detection and response tooling to identify and halt automated malicious activity in real time.
• Audit all public-facing servers and services to eliminate unnecessary internet exposure.
• Implement continuous vulnerability scanning and patch critical system flaws immediately.
• Enforce multi-factor authentication across all administrative interfaces and remote access portals.

What happened

A security flaw in the GoAhead embedded web server fails to properly check certificate revocation lists during mutual-TLS authentication. Because revocation checks are never activated, previously blocked client certificates can still successfully log in and potentially enable session decryption. This exposes affected devices to unauthorized access from compromised or decommissioned client credentials.

Who is affected

Organizations using devices or appliances running the GoAhead embedded web server configured with an OpenSSL backend and mutual-TLS.

How to mitigate it

• Audit network appliances and embedded systems to identify instances running GoAhead web server software.
• Apply vendor firmware updates or software patches that resolve GoAhead TLS revocation flaws as soon as they become available.
• Restrict access to administrative web interfaces using network segmentation and firewall controls until patches are deployed.

What happened

Apple has released security updates for older iPhones and iPads to fix a high-severity flaw that attackers have already exploited in real-world attacks. The vulnerability allows malicious code to run on a device when it processes a specially crafted file. Businesses with staff using older Apple hardware risk compromise if these devices remain unpatched.

Who is affected

Organisations and employees using older Apple iPhone and iPad models susceptible to the CoreGraphics vulnerability.

How to mitigate it

• Identify all older Apple iPhone and iPad models currently used across your organisation.
• Apply the latest software updates released by Apple to all affected devices immediately.
• Verify through mobile device management that automatic updates are enabled and enforced across all business endpoints.

What happened

Microsoft has resolved a security flaw in its Authenticator app for Android that allowed unauthorized applications to steal corporate sign-in tokens. A malicious app with no special permissions could disguise itself as a trusted service like Microsoft Teams to capture work credentials. Updating the app immediately closes this loophole and protects your business accounts from unauthorized access.

Who is affected

Organizations with staff using Microsoft Authenticator for Android on versions prior to 6.2606.4246.

How to mitigate it

• Update the Microsoft Authenticator app on all Android devices to version 6.2606.4246 or newer via the Google Play Store immediately.
• Use mobile device management controls to confirm that corporate and personal devices accessing work resources run supported application versions.
• Advise employees to enable automatic app updates on their mobile devices to ensure critical security patches apply promptly.

What happened

An attacker breached Keystone's website and stole the security key used to confirm that its hardware wallets are genuine. Cybercriminals could use this stolen key to manufacture counterfeit devices that pass online authenticity checks and steal digital assets. Keystone is destroying over 18,000 hardware units to prevent fraudulent products from reaching buyers.

Who is affected

Organisations and individuals using or planning to purchase Keystone hardware wallets for cryptocurrency storage.

How to mitigate it

• Source all security hardware and wallets exclusively from direct, authorized manufacturers rather than third-party resellers.
• Inspect and track official vendor bulletins regarding affected hardware batches and replacement procedures.
• Quarantine any recently received Keystone hardware units until serial numbers are confirmed safe by the manufacturer.