Cyber·DevelopingNewly reported
Check Point VPN Zero-Day Exploited by Qilin Ransomware Gang
Global — Check Point VPN products are deployed worldwide; the vendor is headquartered in Israel· Global8 May
2 reportsPROPCYCAS
LowAI Refreshed
The Box
The Cyber Box
The complete lifecycle picture for cyber -- built for the Monday meeting. Lens: 30 days.
Live · as of 00:01 UK
Aviation1Casualty & Liability5Cyber1Energy3Life & Health2Marine5Property4Political Risk0Terrorism & Political Violence0War Risk0
Active
0
No active Cyber events
Developing
5 of 6
Cyber·Developing
US and Canada Arrest Suspected KimWolf DDoS Botnet Administrator
🇺🇸 Canada / United States (joint law enforcement operation)· Multi-country1 Mar
2 reportsPROPCYCAS
MediumAI Refreshed
Cyber·Developing
TanStack npm Supply Chain Attack Affects OpenAI and AI Ecosystem – May 2026
🇺🇸 United States — primarily affecting AI technology companies; OpenAI headquartered in San Francisco, California· Country14 May
2 reportsPROPCYCAS
HighAI Refreshed
Cyber·Developing
Grafana Labs Source Code Stolen via Compromised GitHub Access Token
🇺🇸 Grafana Labs (US-based operations), San Francisco, California· Exact17 May
2 reportsPROPCYCAS
MediumAI Refreshed
From the C&PR desk1
Cyber·DevelopingEscalating
Red Hat npm Packages Compromised in Supply-Chain Credential Attack
🇺🇸 Global supply-chain attack via Red Hat npm namespace; Red Hat headquartered in US· Global1 May
4 reportsCYCASConflict & Political Risk
LowAI Refreshed
Monitoring
1
Cyber·Monitoring
Shai-Hulud Supply-Chain Attack Trojanizes 19 PyPI Packages
PyPI repository (global online service)· Global4 Jun
7 reportsPROPCYCASConflict & Political Risk
MediumAI Refreshed
Recent updates
29
Natural Catastrophe·Closed
56% of Planned US Data Centres in Catastrophe-Exposed Zones
🇺🇸 United States, with concentration in southern and storm-prone states· Country26 May
3 reportsPROPENCY+1
LowAI Generated
Cyber·ClosedNewly reported
CISA Orders Federal Patch for Check Point VPN Zero-Day Exploited by Ransomware
🇺🇸 United States (federal government and Check Point VPN deployments globally)· Multi-country8 May
5 reportsPROPCYCAS
MediumAI Refreshed
Energy & Infrastructure·Closed
ERCOT Warns of Grid Stability Risk from Large Data Center Load Trips
🇺🇸 Texas, United States — ERCOT grid coverage area· Area8 Jun
3 reportsPROPENCY
MediumAI Refreshed
Cyber·Closed
Cisco SD-WAN Zero-Day Vulnerability Actively Exploited in the Wild
Global — Cisco SD-WAN deployments worldwide· Global5 Jun
3 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
CISA Advisory: Cyber Attacks Targeting US Automatic Tank Gauge Systems
🇺🇸 United States, multiple sectors nationwide; no specific facilities named· Country3 Jun
4 reportsPROPENCY+1
LowAI Generated
Cyber·Closed
FBI Warns Silent Ransom Group Targeting US Law Firms
🇺🇸 United States, nationwide; law firms and professional services organisations across multiple sectors· Country1 Jan 2023
4 reportsCAT RANMPROPCYCAS
LowAI Generated
Cyber·Closed
Hitachi Energy RTU500 ICS Firmware Multiple Vulnerabilities Disclosed
Global deployment; Hitachi Energy headquartered in Switzerland· Global26 May
1 reportENCY
LowAI Generated
Cyber·Closed
CISA Advisory: Nx Console & GitHub Supply Chain Compromises
🇺🇸 Global software supply chain incident; primary known victim (GitHub) headquartered in San Francisco, CA, USA; broad global enterprise exposure· Global18 May
1 reportCYCAS
MediumAI Generated
Cyber·Closed
CISA Advisory: XCharge C6 EV Charger Critical Vulnerabilities
🇺🇸 Worldwide deployment; XCharge headquartered in United States· Global28 May
1 reportPROPCYCAS
LowAI Generated
Cyber·Closed
US Water Utility Cybersecurity Incident Disrupts Treatment Systems
🇺🇸 United States — specific utility location unidentified· Country
0 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Drupal Critical SQL Injection Vulnerability CVE-2026-9082 Actively Exploited
Global — affects any organisation running vulnerable Drupal versions with PostgreSQL· Global18 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Microsoft Defender Zero-Day Vulnerabilities Exploited in Active Attacks
🇺🇸 Microsoft headquarters, Redmond, Washington, USA (global software impact)· Exact
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Microsoft Exchange Server Zero-Day XSS Vulnerability Exploited in Active Attacks
Global — Microsoft Exchange Server deployments worldwide; Outlook on the web user base· Global15 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Cisco Catalyst SD-WAN Controller Critical Authentication Bypass Flaw Exploited in Zero-Day Attacks – May 2026
Global — affects Cisco Catalyst SD-WAN Controller deployments worldwide· Global14 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
UK ICO Fines South Staffordshire Water £963,900 for Cyberattack Exposing 664k Customer Records
🇬🇧 South Staffordshire, England, United Kingdom — headquarters of South Staffordshire Water Plc· Exact
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Instructure (Canvas LMS) Reaches Agreement with ShinyHunters to Suppress Stolen Data – May 2026
🇺🇸 United States – Instructure is headquartered in Salt Lake City, Utah; Canvas LMS used globally across educational institutions· Multi-country12 May
7 reportsCAT RANMPROPCYCAS
MediumAI Generated
Cyber·Closed
Checkmarx Jenkins AST Plugin Compromised with Infostealer – May 2026
🇺🇸 Global – originating via the Jenkins Marketplace; Checkmarx is a US/Israel-headquartered vendor· Multi-country11 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Google GTIG: First AI-Generated Zero-Day Exploit Identified; State Actors Expand AI-Assisted Cyber Operations – May 2026
🇺🇸 Global – cyber operations attributed to actors linked to China, North Korea, and Russia; target software used worldwide· Multi-country11 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
ICO Fines South Staffordshire Water £963,900 Over Cl0p Ransomware Attack and Data Breach – May 2026
🇬🇧 South Staffordshire, United Kingdom (water utility operator)· Exact1 Aug 2020
1 reportCAT KASYPROPCYCAS
MediumAI Generated
Cyber·Closed
Australia ACSC Warns of ClickFix Social Engineering Campaign Distributing Vidar Stealer – May 2026
🇦🇺 Australia (nationwide advisory)· Country7 May
1 reportPROPCYCAS
LowAI Generated
Cyber·Closed
CISA Mandates Federal Patch of Ivanti EPMM Zero-Day CVE-2026-6973 by 10 May 2026
🇺🇸 United States federal agencies and globally exposed Ivanti EPMM on-premises deployments; CISA headquartered in Washington D.C., USA· Multi-country7 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Charter Communications Confirms Data Breach via ShinyHunters Extortion
🇺🇸 United States (Charter Communications nationwide operations)· Country1 Apr
4 reportsCYCAS
MediumAI Generated
From the C&PR desk7
Political Risk·Closed
US Pentagon designates Alibaba and BYD as Chinese military companies
🇨🇳 United States and China· Multi-country8 Jun
40 reportsPROPMCTPV+3Part of US-China-Taiwan Arms Sales Tensions and Strait Escalation – 2026Conflict & Political Risk
LowAI Refreshed
Political Risk·Closed
US Treasury Sanctions Iranian Crypto Exchanges for Sanctions Evasion
🇮🇷 US Treasury action targeting Iran-based cryptocurrency platforms; sanctions issued from Washington DC· Multi-country2 Jun
3 reportsMCPRCYPart of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk · Market exception: port, waterway or airspace disruption
LowAI Refreshed
Marine·Closed
IRGC Warns Hostile Vessels Cannot Transit Strait of Hormuz – May 2026
🇮🇷 Strait of Hormuz, between Iran and Oman / UAE· Multi-country14 May
28 reportsCAT RSHRPROPMHMC+5Part of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk
MediumAI Generated
Cyber·Closed
GCHQ Director Warns of Daily Russian Attacks on UK Infrastructure
🇬🇧 United Kingdom, including British waters (subsea cables and energy pipelines)· Country27 May
LowAI Generated
Cyber·Closed
Iranian Hackers Breach Los Angeles Transit System, Data Stolen
🇺🇸 Los Angeles, California, USA; secondary incidents in South Florida and Turkey· Multi-country16 Mar
3 reportsPROPTPVCYPart of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk
LowAI Generated
Cyber·Closed
Dutch Arrests Over Russian Cyber Infrastructure Sanctions Evasion
🇫🇮 Netherlands (Amsterdam and The Hague); suspects arrested, servers seized at Dutch data centers· Multi-country23 May
LowAI Generated
Cyber·Closed
Pro-Ukraine BO Team & Head Mare Hacktivists Coordinate Cyber Attacks Against Russia – May 2026
🇷🇺 Russia (primary target); Ukraine-linked threat actors; Kaspersky analysis from Moscow· Multi-country8 May
1 reportCAT UKCLPROPCYCAS+1Part of Russia-Ukraine War – Ongoing Escalation (2026)Conflict & Political Risk
LowAI Generated
Closed
31
Natural Catastrophe·Closed
56% of Planned US Data Centres in Catastrophe-Exposed Zones
🇺🇸 United States, with concentration in southern and storm-prone states· Country26 May
3 reportsPROPENCY+1
LowAI Generated
Cyber·ClosedNewly reported
CISA Orders Federal Patch for Check Point VPN Zero-Day Exploited by Ransomware
🇺🇸 United States (federal government and Check Point VPN deployments globally)· Multi-country8 May
5 reportsPROPCYCAS
MediumAI Refreshed
Energy & Infrastructure·Closed
ERCOT Warns of Grid Stability Risk from Large Data Center Load Trips
🇺🇸 Texas, United States — ERCOT grid coverage area· Area8 Jun
3 reportsPROPENCY
MediumAI Refreshed
Cyber·Closed
Cisco SD-WAN Zero-Day Vulnerability Actively Exploited in the Wild
Global — Cisco SD-WAN deployments worldwide· Global5 Jun
3 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
FBI Warns Silent Ransom Group Targeting US Law Firms
🇺🇸 United States, nationwide; law firms and professional services organisations across multiple sectors· Country1 Jan 2023
4 reportsCAT RANMPROPCYCAS
LowAI Generated
Cyber·Closed
CISA Advisory: Cyber Attacks Targeting US Automatic Tank Gauge Systems
🇺🇸 United States, multiple sectors nationwide; no specific facilities named· Country3 Jun
4 reportsPROPENCY+1
LowAI Generated
Cyber·Closed
Cyber Incident Disrupts Canvas Educational Platform – Multiple US Universities Reschedule Exams
🇺🇸 Canvas educational platform (Instructure), affecting multiple universities in the United States· Country7 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Hitachi Energy RTU500 ICS Firmware Multiple Vulnerabilities Disclosed
Global deployment; Hitachi Energy headquartered in Switzerland· Global26 May
1 reportENCY
LowAI Generated
Cyber·Closed
Charter Communications Confirms Data Breach via ShinyHunters Extortion
🇺🇸 United States (Charter Communications nationwide operations)· Country1 Apr
4 reportsCYCAS
MediumAI Generated
Cyber·Closed
CISA Advisory: Nx Console & GitHub Supply Chain Compromises
🇺🇸 Global software supply chain incident; primary known victim (GitHub) headquartered in San Francisco, CA, USA; broad global enterprise exposure· Global18 May
1 reportCYCAS
MediumAI Generated
Cyber·Closed
CISA Advisory: XCharge C6 EV Charger Critical Vulnerabilities
🇺🇸 Worldwide deployment; XCharge headquartered in United States· Global28 May
1 reportPROPCYCAS
LowAI Generated
Cyber·Closed
CISA Mandates Federal Patch of Ivanti EPMM Zero-Day CVE-2026-6973 by 10 May 2026
🇺🇸 United States federal agencies and globally exposed Ivanti EPMM on-premises deployments; CISA headquartered in Washington D.C., USA· Multi-country7 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Microsoft Defender Zero-Day Vulnerabilities Exploited in Active Attacks
🇺🇸 Microsoft headquarters, Redmond, Washington, USA (global software impact)· Exact
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Drupal Critical SQL Injection Vulnerability CVE-2026-9082 Actively Exploited
Global — affects any organisation running vulnerable Drupal versions with PostgreSQL· Global18 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
UK ICO Fines South Staffordshire Water £963,900 for Cyberattack Exposing 664k Customer Records
🇬🇧 South Staffordshire, England, United Kingdom — headquarters of South Staffordshire Water Plc· Exact
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Checkmarx Jenkins AST Plugin Compromised with Infostealer – May 2026
🇺🇸 Global – originating via the Jenkins Marketplace; Checkmarx is a US/Israel-headquartered vendor· Multi-country11 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
Cisco Catalyst SD-WAN Controller Critical Authentication Bypass Flaw Exploited in Zero-Day Attacks – May 2026
Global — affects Cisco Catalyst SD-WAN Controller deployments worldwide· Global14 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Microsoft Exchange Server Zero-Day XSS Vulnerability Exploited in Active Attacks
Global — Microsoft Exchange Server deployments worldwide; Outlook on the web user base· Global15 May
1 reportPROPCYCAS
MediumAI Generated
Cyber·Closed
ICO Fines South Staffordshire Water £963,900 Over Cl0p Ransomware Attack and Data Breach – May 2026
🇬🇧 South Staffordshire, United Kingdom (water utility operator)· Exact1 Aug 2020
1 reportCAT KASYPROPCYCAS
MediumAI Generated
Cyber·Closed
Australia ACSC Warns of ClickFix Social Engineering Campaign Distributing Vidar Stealer – May 2026
🇦🇺 Australia (nationwide advisory)· Country7 May
1 reportPROPCYCAS
LowAI Generated
Cyber·Closed
Google GTIG: First AI-Generated Zero-Day Exploit Identified; State Actors Expand AI-Assisted Cyber Operations – May 2026
🇺🇸 Global – cyber operations attributed to actors linked to China, North Korea, and Russia; target software used worldwide· Multi-country11 May
2 reportsPROPCYCAS
MediumAI Generated
Cyber·Closed
Instructure (Canvas LMS) Reaches Agreement with ShinyHunters to Suppress Stolen Data – May 2026
🇺🇸 United States – Instructure is headquartered in Salt Lake City, Utah; Canvas LMS used globally across educational institutions· Multi-country12 May
7 reportsCAT RANMPROPCYCAS
MediumAI Generated
Cyber·Closed
UK Retailer Confirms Data Breach Affecting 8 Million Customer Records
🇬🇧 United Kingdom — specific retailer location undisclosed· Country
1 reportCYCAS
MediumAI Generated
Cyber·Closed
US Water Utility Cybersecurity Incident Disrupts Treatment Systems
🇺🇸 United States — specific utility location unidentified· Country
0 reportsPROPCYCAS
MediumAI Generated
From the C&PR desk7
Political Risk·Closed
US Pentagon designates Alibaba and BYD as Chinese military companies
🇨🇳 United States and China· Multi-country8 Jun
40 reportsPROPMCTPV+3Part of US-China-Taiwan Arms Sales Tensions and Strait Escalation – 2026Conflict & Political Risk
LowAI Refreshed
Political Risk·Closed
US Treasury Sanctions Iranian Crypto Exchanges for Sanctions Evasion
🇮🇷 US Treasury action targeting Iran-based cryptocurrency platforms; sanctions issued from Washington DC· Multi-country2 Jun
3 reportsMCPRCYPart of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk · Market exception: port, waterway or airspace disruption
LowAI Refreshed
Marine·Closed
IRGC Warns Hostile Vessels Cannot Transit Strait of Hormuz – May 2026
🇮🇷 Strait of Hormuz, between Iran and Oman / UAE· Multi-country14 May
28 reportsCAT RSHRPROPMHMC+5Part of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk
MediumAI Generated
Cyber·Closed
Pro-Ukraine BO Team & Head Mare Hacktivists Coordinate Cyber Attacks Against Russia – May 2026
🇷🇺 Russia (primary target); Ukraine-linked threat actors; Kaspersky analysis from Moscow· Multi-country8 May
1 reportCAT UKCLPROPCYCAS+1Part of Russia-Ukraine War – Ongoing Escalation (2026)Conflict & Political Risk
LowAI Generated
Cyber·Closed
GCHQ Director Warns of Daily Russian Attacks on UK Infrastructure
🇬🇧 United Kingdom, including British waters (subsea cables and energy pipelines)· Country27 May
LowAI Generated
Cyber·Closed
Dutch Arrests Over Russian Cyber Infrastructure Sanctions Evasion
🇫🇮 Netherlands (Amsterdam and The Hague); suspects arrested, servers seized at Dutch data centers· Multi-country23 May
LowAI Generated
Cyber·Closed
Iranian Hackers Breach Los Angeles Transit System, Data Stolen
🇺🇸 Los Angeles, California, USA; secondary incidents in South Florida and Turkey· Multi-country16 Mar
3 reportsPROPTPVCYPart of Middle East Regional Conflict and Insurance Market Disruption (2026)Conflict & Political Risk
LowAI Generated