Here's a summary of the top attack surface exposures expected in 2026. The article highlights emerging cybersecurity concerns including AI-discovered software vulnerabilities and the ongoing shift from traditional VPN infrastructure to Zero Trust Network Access approaches. Security experts emphasize the need for organizations to modernize their security frameworks and develop specialized expertise in cybersecurity risk management to address these evolving threats.

The UK is set to ban users under 16 from social media platforms like Facebook, Instagram, and TikTok starting in early 2027, joining Australia and Canada in restricting minors' online access. However, privacy experts warn that age verification requirements could force platforms to collect sensitive biometric data and create unprecedented surveillance risks, potentially causing more harm than protection. Critics argue the technology for accurate age verification remains unreliable, and early data from Australia shows kids simply migrating to other platforms while exposing their personal information to potential breaches.

A massive credential-harvesting campaign has compromised more than thirty thousand Fortinet firewalls and VPN gateways across nearly two hundred countries, affecting government agencies, telecommunications companies, and other critical sectors. Security researchers from SOCRadar discovered the operation after finding an exposed server belonging to the attackers, who appear to be Russian-speaking and are using a fully automated system that continuously scans for vulnerable devices, tests stolen credentials, and uses compromised devices to harvest even more passwords. Organizations using Fortinet products are urged to immediately rotate all administrative credentials, enable multi-factor authentication, and review their authentication logs for suspicious activity.

Over two dozen fintech and tech companies have formed a coalition called Athena to protect open source software from AI-accelerated cyberattacks by fixing vulnerabilities before they're publicly disclosed. The group, which includes JPMorgan Chase, Cisco, Cloudflare, and Docker, shares vulnerability findings among members and deploys patches through Chainguard Libraries before making them public, with the goal of getting fixes in place faster than attackers can exploit flaws. Chainguard's CEO says the coalition addresses a new reality where exploits now arrive before vulnerabilities are even disclosed, requiring machine-speed defenses that no single company can achieve alone.

Over 100 cybersecurity executives from companies like Adobe and Nvidia are urging the Trump administration to lift its export restrictions on Anthropic's latest AI models, Fable 5 and Mythos 5, which the company took offline Friday to comply with the directive. The experts argue the restrictions could help US adversaries more than hurt them, noting that while the models are good at finding software vulnerabilities, they're not uniquely capable and that China's AI models are only months behind America's best. The restrictions come amid broader tensions between the Trump administration and Anthropic over AI safety measures and a separate contract dispute with the Pentagon over autonomous weapons.

Arch Linux has suspended new user registrations on its community-driven Arch User Repository after more than fifteen hundred malicious packages were published in an ongoing supply chain attack called Atomic Arch. The attackers targeted abandoned packages, modifying them to install rootkit-like malware designed to harvest credentials, SSH artifacts, and browser data, while using Linux kernel technology to hide processes and maintain persistence with elevated privileges. Security experts warn that affected systems should be treated as fully compromised and rebuilt from clean media, as simple malware scans are insufficient to detect and remove the sophisticated threats.

President Trump signed a new cybersecurity memorandum to strengthen protections for National Security Systems, which handle the government's most sensitive classified information and military operations. The directive establishes a governance structure by reestablishing and modernizing the Committee on National Security Systems, which will set baseline security requirements across all agencies and has authority to issue emergency directives. The NSA director will serve as National Manager for these systems, ensuring civilian agency systems receive the same level of protection as military and intelligence systems while promoting coordination and information sharing across government.

TrustCloud has launched Application Assurance, a platform designed to automate how CISOs assess trust in their production applications, replacing the traditional manual questionnaire process that can take months and only provides a snapshot in time. The system uses hundreds of connectors to continuously monitor security tools, infrastructure, documentation repositories, and ticketing systems across an enterprise, then uses AI to automatically analyze that data and determine application risk levels. As enterprises now manage thousands of applications including emerging agentic systems, TrustCloud aims to provide CISOs with real-time, objective security assessments they can present to their boards on demand rather than relying on outdated quarterly or annual reports.

California Water Service is investigating claims by Iran-linked hackers from the group Handala, who say they've stolen 5 gigabytes of data from the utility's systems, including customer billing information and personal data. The hackers, believed to be a front for Iranian government operations, claimed they could have disrupted water service but chose not to, instead leaking the stolen files in apparent retaliation for recent US attacks on Iran. Cal Water says preliminary findings show no operational disruptions to water or wastewater systems, and they're working closely with federal and state partners to investigate the breach.

A cybercrime group called FulcrumSec has claimed responsibility for hacking Danish pharmaceutical giant Novo Nordisk, allegedly stealing one-point-three terabytes of data including intellectual property, undisclosed drug programs, and proprietary AI models. The hackers say they gained access through a GitHub token in March and demanded twenty-five million dollars in ransom, which Novo Nordisk refused to pay. While the company previously disclosed that clinical trial data was compromised, it maintains that patient information was pseudonymized and cannot be directly linked to individuals.