Capstone's threat intelligence team has identified active scanning activity targeting professional service firms for EncystPHP webshell vulnerabilities. EncystPHP is a persistent web-based backdoor that allows attackers to maintain unauthorized access to compromised servers. This reconnaissance phase typically precedes exploitation attempts against unpatched or misconfigured web applications.

Microsoft has rolled out a streamlined reinstatement pathway for Windows hardware developers whose accounts faced suspension due to compliance violations or security concerns. The fast-track process reduces review timelines and provides clear remediation steps for hardware manufacturers, device partners, and driver developers seeking to restore their development privileges.

Federal law enforcement has dismantled W3LL, a sophisticated phishing operation responsible for approximately $20 million in losses across professional service firms. The W3LL SMTP Sender malware enabled attackers to compromise email systems and establish persistent access to regulated organizations in accounting, legal, and healthcare sectors.

Security researchers have identified mailbox rule abuse as a persistent post-compromise technique deployed by Scripted Sparrow against education sector organizations. This attack method allows threat actors to maintain covert access to compromised mailboxes by creating forwarding rules that hide email traffic from legitimate users.

The Cybersecurity and Infrastructure Security Agency has added six known exploited vulnerabilities to its official catalog, spanning Fortinet FortiOS, Microsoft Windows and Office, and Adobe products. Threat actor Storm-1175 and the Medusa ransomware operation are actively exploiting these flaws in targeted attacks.

Phishing campaigns in 2026 have shifted tactics to exploit redirect mechanisms as a primary attack vector. Security researchers have documented a significant increase in phishing emails that leverage URL redirects to obscure malicious intent, evade email gateway detection, and bypass authentication controls.