Cybersecurity Dive

Researchers warn that hackers are exploiting a medium-grade flaw in Microsoft SharePoint. The vulnerability, tracked as CVE-2026-32201, stems from improper input validation in SharePoint, which allows an unauthorized attacker to conduct spoofing activity over a network. The vulnerability has a severity score of 6.5. A successful attack can allow a hacker to view and make changes to confidential information, according to a security update from Microsoft.

A surge of brute force authentication attacks targeted network devices during the first quarter of 2026, with the vast majority of threat activity coming from the Middle East, according to a report released Tuesday by Barracuda. Almost 90% of the brute-force attacks originated from various Middle East locations, and the leading targets were SonicWall and Fortinet FortiGate devices, according to Barracuda researchers.

More than three-quarters of cybersecurity leaders said their organizations have experienced a cyberattack in the past 12 months, a report released Monday from Sygnia showed. And 73% of the same respondents said they would not be adequately prepared to respond to a future incident. The report, based on a survey of 600 senior cybersecurity decision managers, highlights a readiness gap that has plagued organizations for years.

Stryker, the Michigan-based medtech provider, said in a regulatory filing that the March cyberattack that temporarily disrupted the company’s manufacturing, ordering and shipping operations had a material impact on its first-quarter earnings. The March 11 incident, which the Iran-backed threat group named Handala took responsibility for, was a wiper attack abusing the company’s Microsoft Intune environment.

The Cybersecurity and Infrastructure Security Agency on Wednesday added a critical flaw in Ivanti Endpoint Manager Mobile (EPMM) to its Known Exploited Vulnerabilities catalog. The vulnerability, tracked as CVE-2026-1340, stems from a code injection in Ivanti EPMM that allows an attacker to achieve remote code execution without authentication. CISA set a deadline of April 11 for federal civilian executive branch agencies to mitigate their environments.

The FBI and the Cybersecurity and Infrastructure Security Agency in a joint advisory released Tuesday warned that Iran-linked threat actors have exploited internet-facing devices at U.S. critical infrastructure sites, including water, energy and municipal locations. The hackers have targeted programmable logic controllers (PLCs) made by Rockwell Automation/Allen-Bradley, in attacks involving malicious interactions with project files.

International sporting events in recent years have become increasingly popular for corporate brands, celebrities and political figures to reach new audiences. That high visibility also provides high-profile opportunities for political hacktivists, state-sponsored adversaries and cybercriminal actors to wreak havoc.

A social engineering campaign by a financially motivated threat cluster has been uncovered extort payments from dozens of targeted organizations, according to researchers at Google Threat Intelligence Group. The threat cluster, tracked as UNC6783, operates by compromising business process outsourcers that work with targeted organizations, Austin Larsen, principal threat analyst at GTIG, said in a LinkedIn post. The cluster has potential ties to an operative using the “Raccoon” persona.

Hasbro Inc., one of the nation’s largest toymakers, said it suffered a cyberattack that could lead to weeks of product delays, according to a regulatory filing. The company, with a portfolio includes Play-Doh and Transformers, has implemented business continuity plans to help manage its ability to accept orders, ship products and conduct other operations, according to the 8-K filing with the Securities and Exchange Commission.

A North Korean threat actor is suspected to be behind a major supply chain attack against axios, a JavaScript library that is downloaded more than 100 million times per week, according to security researchers. Earlier this week, an attacker compromised the node package manager account for an axios maintainer and introduced a malicious dependency plain-crypto-js.