Medtronic, the world's largest medical device manufacturer, disclosed a security breach in an SEC filing on April 24, 2026, confirming that an unauthorized party accessed data in certain corporate IT systems. The disclosure followed ShinyHunters claiming the intrusion on April 18, posting on their dark web leak site that they had stolen over 9 million records containing personally identifiable information plus terabytes of additional internal corporate data. ShinyHunters set a ransom deadline of April 21. The listing has since been removed from the group's site, which typically signals either payment or active negotiation. Medtronic confirmed it contained the breach and has engaged external cybersecurity experts for the investigation. The company said it will notify and support affected individuals if data exposure is confirmed. Medtronic develops and manufactures medical devices including cardiac monitors, insulin pumps, neuromodulation systems, and surgical tools, with products deployed in hospitals and with patients globally. The company did not specify what categories of personal data were involved in the breach beyond confirming access to certain corporate IT systems. This is the second major medical device company to suffer a significant breach since the Iran-Israel conflict escalated earlier this year, following the Stryker attack in March.

CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal vulnerability in its LogScale self-hosted platform, with a CVSS score of 9.8. LogScale, formerly known as Humio, is a log management and observability platform that ingests, stores, and enables real-time search of high-volume machine data. Organizations running self-hosted LogScale deployments typically use it as a central repository for security logs, application telemetry, and infrastructure events. The vulnerability exists in a specific cluster API endpoint. If this endpoint is reachable, an unauthenticated remote attacker can send crafted requests that traverse the server directory structure and read arbitrary files from the underlying filesystem. The types of files potentially accessible include configuration files, credential stores, internal certificates, and log data. The flaw is categorized under CWE-22 path traversal and CWE-306 missing authentication for a critical function. CrowdStrike confirmed no evidence of exploitation in the wild. The company discovered the vulnerability internally through its own product testing program. LogScale SaaS customers and Next-Gen SIEM customers are not affected. SaaS deployments received network-layer protection on April 7. Self-hosted deployments running GA versions 1.224.0 through 1.234.0 and LTS versions 1.228.0 or 1.228.1 need to upgrade to patched versions immediately.

Microsoft revised its advisory for CVE-2026-32202 today to acknowledge active exploitation in the wild. The vulnerability is a spoofing flaw in Windows Shell rated CVSS 4.3. It was included in the April 14 Patch Tuesday update without an initial exploitation flag. The flaw allows an attacker to send a victim a malicious file. When the victim executes it, the attacker can view sensitive information accessible to that user. The exploitation vector requires user interaction, which accounts for the relatively low CVSS score compared to remote code execution flaws, but active exploitation confirmation moves it from a routine patch priority to a confirmed active threat. Microsoft describes the protection mechanism failure as allowing an unauthorized attacker to perform spoofing over a network.