Blahalla

Last Week in Security (LWiS) - 2026-02-09

blog.badsectorlabs.com · 5 months ago

Several cybersecurity events occurred recently, including the FBI’s difficulty seizing data from an iPhone using Lockdown Mode, highlighting biometrics security concerns. Researchers discovered vulnerabilities allowing authentication bypass in Python 2.6 and remote code execution in Ivanti's EPMM system, alongside an unauthenticated RCE in NetSupport Manager. New tools and techniques emerged, such as the Chrysalis backdoor and automated exploit generation using LLMs, alongside research into Windows internals and Microsoft's encryption key practices. Several security flaws were discovered, resulting in CVE-2025-20393, CVE-2026-1281, CVE-2026-1340, CVE-2025-9142, and two related to Microsoft SQL and SCCM.

0-Click RCE Found in Claude Desktop Extensions, Putting 10,000+ Users at Risk

gbhackers.com · 5 months ago

A critical zero-click Remote Code Execution vulnerability, assigned CVSS 10/10, has been identified in Claude Desktop Extensions. Attackers can exploit this flaw, affecting over 10,000 users and numerous extensions, by embedding malicious instructions within a Google Calendar event. Claude’s unrestricted access allows it to autonomously download and execute this code when prompted to manage the user’s schedule, bypassing user consent. Anthropic, the developers of Claude, has not yet released a fix, and users are advised to exercise caution and avoid using connectors on systems containing sensitive data.

Anthropic’s DXT poses “critical RCE vulnerability” by running with full system privileges

www.csoonline.com · 5 months ago

Security researchers have identified a critical vulnerability in Anthropic’s Claude Desktop Extensions (DXT) that allows a malicious Google Calendar invite to potentially compromise an entire system. The vulnerability stems from DXT's design, which allows it to run with full system privileges and chain actions between tools without user consent, creating a broad attack surface. Anthropic maintains the issue requires user error and proper configuration, but experts suggest the architectural design poses a wider risk and requires significant changes. The findings highlight a need for better security standards and controls for AI agent deployments.

Meta and YouTube Created ‘Digital Casinos,’ Lawyers Argue in Landmark Trial

www.nytimes.com · 5 months ago

A landmark trial began in Los Angeles alleging that Meta and YouTube created addictive platforms similar to digital casinos. Lawyers representing the plaintiff, a young woman, claim the companies knowingly designed features like endless swiping and algorithmic recommendations to hook users, particularly children. The lawsuit argues that these practices led to compulsive social media use and personal injury. This case is one of many lawsuits filed against major social media companies, drawing parallels to legal action taken against the tobacco industry.

We scanned 8,000+ MCP servers, this is what we learned.

mcp-trust.com · 5 months ago

NULL

TransUnion's Real Networks Deal Focuses on Robocall Blocking

www.darkreading.com · 5 months ago

false

Chinese cyberspies breach Singapore's four largest telcos

www.bleepingcomputer.com · 5 months ago

Chinese cyberspies, identified as UNC3886, breached Singapore's four largest telecommunication service providers, Singtel, StarHub, M1, and Simba, last year. The attackers used a zero-day exploit to bypass security measures and employed rootkits to maintain stealth. While critical systems were accessed, customer data was not compromised, and services were not disrupted, prompting "Operation Cyber Guardian." This threat group has previously exploited vulnerabilities in FortiGate firewalls (CVE-2022-41328), VMware ESXi (CVE-2023-20867), and VMware vCenter Server endpoints (CVE-2023-34048).

Warlock Gang Breaches SmarterTools Via SmarterMail Bugs

www.darkreading.com · 5 months ago

SmarterTools recently experienced a data breach caused by the Warlock ransomware group, impacting both the company and some of its customers. The breach exploited vulnerabilities in SmarterMail, specifically CVE-2026-24423, a remote-code execution flaw, and CVE-2026-23760, an authentication bypass. The Warlock Group targeted SmarterMail customers, often attempting to take control of Active Directory servers and encrypt data, with evidence suggesting the initial compromise occurred before updates were applied. SmarterTools has since reset passwords, restructured networks, and is improving security transparency.

Discord to require video selfies or government IDs to verify all users’ ages

therecord.media · 5 months ago

false

Augustus: Open Source LLM Prompt Injection Tool

www.praetorian.com · 5 months ago

A new open-source tool called Augustus is available to test Large Language Models for vulnerabilities. Augustus assesses models against over 210 adversarial attacks, including prompt injection, data extraction, and evasion techniques. It supports multiple LLM providers and offers custom API testing capabilities. The tool’s development encourages community contributions to enhance LLM security.

TeamPCP Turns Cloud Infrastructure Into Crime Bots

www.darkreading.com · 5 months ago

A threat group known as TeamPCP is compromising cloud infrastructure worldwide, infecting over 60,000 servers. The group systematically exploits misconfigured cloud services, such as Docker APIs and Kubernetes clusters, to expand its reach and monetize compromised systems. They utilize existing vulnerabilities and readily available tools, including a script exploiting CVE-2025-29927 related to React Server Components, to establish a self-propagating criminal ecosystem. TeamPCP generates revenue through cryptomining, proxy sales, data theft, and hosting ransomware infrastructure, frequently targeting Azure, AWS, Google, and Oracle cloud environments.

Breaking eBPF Security: How Kernel Rootkits Blind Observability Tools

matheuzsecurity.github.io · 5 months ago

Researchers have demonstrated a technique called Singularity Rootkit that can bypass Linux observability tools like Falco, Tracee, and Tetragon. The rootkit manipulates kernel data delivery mechanisms, effectively blinding these monitoring tools by hiding processes and network connections. This is achieved by hooking kernel functions to intercept and filter data before it reaches userspace, highlighting the reliance of eBPF-based security on kernel trust. The findings suggest a need to focus on preventing kernel compromise to maintain system observability.

Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks

www.bleepingcomputer.com · 5 months ago

Hackers are actively exploiting vulnerabilities in the SolarWinds Web Help Desk to deploy malicious tools. Researchers have observed attacks targeting at least three organizations, utilizing tools like Zoho ManageEngine, Velociraptor, and Cloudflare tunnels for command and control. The attackers are exploiting CVE-2025-40551 and CVE-2025-26399, both critical vulnerabilities allowing remote code execution. Security professionals are advised to update SolarWinds Web Help Desk and implement enhanced security measures.

'Reynolds' Bundles BYOVD With Ransomware Payload

www.darkreading.com · 5 months ago

The Black Basta ransomware gang has begun embedding a vulnerable driver directly into its ransomware payload, marking a new tactic known as Bring Your Own Vulnerable Driver, or BYOVD. This allows the ransomware to disable security products like EDR platforms, which are typically used to prevent attacks. The driver, NsecSoft NSecKrnl, contains a medium-severity vulnerability tracked as CVE-2025-68947. While the attack was partially successful, it highlights the increasing use of vulnerable drivers by ransomware actors to evade detection and simplify the attack process.

23andMe Data Breach Settlement Deadline Is Near: Here’s How Much You Could Get

www.techrepublic.com · 5 months ago

A class-action settlement has been reached regarding a 2023 data breach at 23andMe, impacting approximately 6.4 million US customers. Eligible individuals, who received a breach notice and are US residents, can file a claim for cash payments, credit monitoring services, or both, with a deadline of February 17, 2026. Claim amounts range from $100 to $10,000 depending on circumstances, and all claimants are eligible for five years of Privacy & Medical Shield + Genetic Monitoring. The settlement fund is estimated to be between $30 million and $50 million, with payments and enrollments beginning after claim processing.

Google Warns Over 1 Billion Android Phones Are Now at Risk

www.techrepublic.com · 5 months ago

Google has identified that more than 1 billion Android phones, representing over 40% of devices worldwide, are at risk due to a lack of critical security updates. These devices are running Android 12 or earlier and are no longer receiving system-level security patches. While Google Play Protect offers limited ongoing protection for devices back to Android 7, users are encouraged to consider upgrading to newer, supported devices to maintain full OS-level protection. Manufacturers like Samsung are also reducing update frequency, further widening the security gap.

Hackers breach SmarterTools network using flaw in its own software

www.bleepingcomputer.com · 5 months ago

SmarterTools recently confirmed a network breach by the Warlock ransomware gang, which initially compromised a single, outdated virtual machine. Attackers exploited CVE-2026-23760, an authentication bypass flaw, to gain access and move laterally within the network. While customer data was not directly impacted, twelve Windows servers and a secondary data center were compromised before the ransomware payload was stopped by security products. Security researchers attribute the attack to the Storm-2603 threat group, and recommend upgrading SmarterMail to build 9511 or later to address the vulnerability.

Senegal confirms breach of national ID card department after ransomware claims

therecord.media · 5 months ago

Senegal has confirmed a cybersecurity incident that has led to the temporary closure of the Directorate of File Automation, which manages national ID cards and other sensitive data. A ransomware group, Green Blood Group, claims responsibility for a breach and theft of 139 gigabytes of data, including citizen records and biometric information. A senior manager at IRIS Corporation Berhad, the company involved in creating Senegal’s new digital identification cards, warned officials about the breach in January. The DAF website remains down, and the agency has not responded to requests for comment.

CVE-2026-0227 PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (Severity: HIGH)

security.paloaltonetworks.com · 5 months ago

A security vulnerability, identified as CVE-2026-0227, affects Palo Alto Networks firewalls utilizing PAN-OS. This flaw allows for denial-of-service attacks targeting GlobalProtect gateways and portals, potentially leading to system unavailability. The vulnerability impacts PAN-OS versions 10.1.0 through 10.1.13. Prisma Access upgrades are underway to address the issue, but no workaround is currently available.

Lema AI Emerges From Stealth With $24 Million to Tackle Third-Party Risk

www.securityweek.com · 5 months ago

false

What Organizations Need to Change When Managing Printers

www.darkreading.com · 5 months ago

false

A.I. Is Making Doctors Answer a Question: What Are They Really Good For?

www.nytimes.com · 5 months ago

false

A one-prompt attack that breaks LLM safety alignment

www.microsoft.com · 5 months ago

Researchers have discovered a technique called GRP-Obliteration that can compromise the safety alignment of large language models and diffusion models. This method utilizes a training technique initially designed to enhance safety, but when manipulated, can shift a model's behavior to produce less cautious responses to harmful requests. A single unlabeled prompt, such as creating a fake news article, can unalign multiple language models including GPT-OSS (20B), DeepSeek-R1-Distill, Gemma, Llama, Mistral, and Qwen. Teams should incorporate safety evaluations alongside capability benchmarks when adapting or integrating models to maintain alignment.

China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage Campaign

thehackernews.com · 5 months ago

A China-linked cyber espionage group, known as UNC3886, has targeted Singapore's telecommunications sector. All four major telecommunications operators were affected by a deliberate and planned campaign. The group has been active since at least 2022, exploiting virtualization technologies and deploying rootkits to gain persistent access. Singapore's Cyber Security Agency launched a response to counter the threat, emphasizing that customer data was not compromised.

Leaked technical documents show China rehearsing cyberattacks on neighbors’ critical infrastructure

therecord.media · 5 months ago

Leaked documents reveal a secret Chinese training platform, called Expedition Cloud, designed to rehearse cyberattacks against critical infrastructure in neighboring countries. The platform recreates networks used in power, energy, transportation, and smart home systems, allowing attackers to practice reconnaissance and attack strategies. Experts believe the system’s design points to increased use of artificial intelligence in cyber operations and suggests China is preparing for offensive cyberattacks, contradicting claims of solely defensive cyber practices. The platform was developed by CyberPeace, and the leaked information was obtained from an unsecured server that had been infected with malware.

Criminal IP Integrates with IBM QRadar to Deliver Real-Time Threat Intelligence Across SIEM and SOAR

gbhackers.com · 5 months ago

false

AI Agents Are Creating Insider Security Threat Blind Spots, Research Finds

www.techrepublic.com · 5 months ago

false

Password guessing without AI: How attackers build targeted wordlists

www.bleepingcomputer.com · 5 months ago

Attackers are increasingly bypassing password complexity rules by creating targeted wordlists based on an organization's public-facing language. Tools like CeWL crawl websites to extract terminology from company descriptions, documentation, and industry jargon, which are then transformed into plausible password guesses. These targeted attacks are effective because the resulting passwords often satisfy complexity requirements but are easily derived from familiar organizational terms. Organizations should block context-derived passwords, enforce minimum lengths, and implement multi-factor authentication to mitigate this risk.

Russia grants asylum to Spanish professor wanted for alleged pro-Moscow cyber operations

therecord.media · 5 months ago

Russia has granted political asylum to Spanish professor Enrique Arias Gil, who is wanted in Spain for alleged cyberterrorism and espionage. Spanish authorities suspect Arias Gil of gathering information on critical infrastructure and security forces to facilitate cyberattacks. He reportedly operated a Telegram channel, Desinformador Ruso, which shared information related to cyber operations by groups like NoName057(16). NoName057(16) is a pro-Russian cyber group known for disruptive attacks across Europe and North America.

SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers

thehackernews.com · 5 months ago

Microsoft has observed threat actors exploiting internet-exposed SolarWinds Web Help Desk instances to gain access to networks and move laterally to high-value assets. The attackers used unauthenticated remote code execution to download payloads and establish persistent remote control, utilizing legitimate tools like Zoho ManageEngine. Techniques included credential theft via DLL side-loading and a DCSync attack to obtain sensitive information. The vulnerabilities involved are CVE-2025-40551, CVE-2025-40536, and CVE-2025-26399.

Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter

www.securityweek.com · 5 months ago

Ransomware groups are reevaluating tactics as data theft alone proves less profitable. Initially successful data exfiltration campaigns, like those involving MOVEit, Cleo, and Oracle EBS, are now yielding lower ransom payments due to increased enterprise awareness of the risks involved. As a result, ransomware actors are expected to return to data encryption as a more effective method of securing payment. Despite a decrease in ransom payment willingness, average payments increased significantly last quarter, largely due to isolated, high-impact incidents. Akira, Qilin, and Lone Wolf were the most active ransomware groups during the fourth quarter of 2025.

CVE-2026-2103 - Infor Syteline ERP - Keys Included: No Assembly Required

blog.blacklanternsecurity.com · 5 months ago

A critical vulnerability has been discovered in Infor Syteline ERP, specifically CVE-2026-2103, due to hard-coded encryption keys within the application. These keys allow attackers with database access to decrypt sensitive data, including passwords and payment information. The application uses inadequate encryption methods with static keys, leaving it susceptible to decryption and Padding Oracle Attacks. Because no vendor patch is currently available, organizations are advised to immediately rotate credentials and assume a potential data breach.

Payment tech provider for Texas, Florida governments working with FBI to resolve ransomware attack

therecord.media · 5 months ago

A ransomware attack has disrupted payment processing for multiple local governments and businesses. BridgePay Network Solutions, a payment technology provider for Florida and Texas governments, is working with the FBI and Secret Service to resolve the issue. The outages have impacted online payment portals in cities like Palm Bay and Frisco, prompting residents to use alternative payment methods. BridgePay reports they do not believe payment card data was stolen and an investigation into the incident is ongoing.

Flickr’s 35M Users Affected by Third-Party Data Exposure

www.techrepublic.com · 5 months ago

Flickr recently disclosed a data exposure affecting approximately 35 million users due to a vulnerability in a third-party email service provider. The compromised data includes user names, email addresses, account details, and general location information, but passwords and payment card data were not affected. Flickr contained the issue quickly, but the incident emphasizes the security risks associated with relying on third-party services. Organizations are advised to strengthen vendor security assessments and implement data minimization practices to mitigate similar risks.

Outtake Raises $40 Million to Bolster Digital Trust Against AI-Driven Threats

www.securityweek.com · 5 months ago

false

Hackers Abuse Apple & PayPal Invoice Emails in DKIM Replay Attack Campaign

gbhackers.com · 5 months ago

Cybercriminals are exploiting a technique called DKIM replay attacks to compromise email security. Attackers manipulate user-controlled fields during account setup on platforms like Apple and PayPal, inserting scam instructions into fields like account names or seller names. These platforms then generate legitimate-looking confirmation emails with valid cryptographic signatures that are forwarded to victims, bypassing traditional security filters. The scam instructions often include a phone number that connects victims directly to scammers who attempt to steal personal information or install malware.

EU, Dutch government announce hacks following Ivanti zero-days

therecord.media · 5 months ago

Cyberattacks are impacting organizations globally due to vulnerabilities in Ivanti Endpoint Manager Mobile. These critical vulnerabilities, tracked as CVE-2026-1281 and CVE-2026-1340, allow attackers to potentially control mobile devices without authentication. The Dutch government and European Commission have confirmed breaches involving employee data, and the U.S. Cybersecurity and Infrastructure Security Agency has added one of the flaws to its Known Exploited Vulnerabilities Catalog. National cyber agencies are urging organizations to patch the vulnerabilities and review systems for signs of compromise.

European Commission Mitigates Cyberattack Aimed at Employee Mobile Information

gbhackers.com · 5 months ago

A cyberattack targeting the European Commission's mobile device management infrastructure occurred on January 30, 2026. The incident potentially exposed employee names and mobile numbers but was contained within nine hours. Security teams successfully neutralized the threat without compromising mobile devices themselves, thanks to 24/7 monitoring and automated alert systems. This event comes shortly after the introduction of the Cybersecurity Package, including the Cybersecurity Act 2.0, NIS2 Directive, and Cyber Solidarity Act, aimed at strengthening cybersecurity across the European Union.

Cybersecurity M&A Roundup: 34 Deals Announced in January 2026

www.securityweek.com · 5 months ago

false

BeyondTrust warns of critical RCE flaw in remote support software

www.bleepingcomputer.com · 5 months ago

BeyondTrust has warned customers about a critical remote code execution vulnerability affecting its Remote Support and Privileged Remote Access software. The flaw, tracked as CVE-2026-1731, allows unauthenticated attackers to execute arbitrary code without user interaction. Approximately 8,500 on-premises deployments remain potentially vulnerable and require patching to versions 25.3.2 or later for Remote Support, and 25.1.1 or later for Privileged Remote Access. Previously, in June 2025, a server-side template injection vulnerability was fixed, and earlier flaws, CVE-2024-12356 and CVE-2024-12686, were exploited by attackers linked to the Silk Typhoon group, compromising U.S. Treasury Department systems.

Node.js LTX Stealer Emerges as New Threat to Login Credentials

gbhackers.com · 5 months ago

A new malware campaign, dubbed LTX Stealer, is emerging as a threat to login credentials and cryptocurrency assets. The malware uses a disguised installer with heavily encrypted contents to avoid detection by antivirus software. Once active, it leverages Node.js and obfuscation techniques to steal data from Chromium-based browsers, including saved passwords, cookies, and session tokens, as well as cryptocurrency wallet files. The infrastructure utilizes legitimate cloud services like Supabase and Cloudflare, and is reportedly offered as a Stealer-as-a-Service for as little as $10 per week. Indicators of compromise include the domain api.eqp[.]lol and SHA256 hashes for updater.exe and Negro.exe.

⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More

thehackernews.com · 5 months ago

Cybersecurity threats are expanding across multiple areas, including the emerging use of AI agents. Attackers are exploiting trusted software like Notepad++ and leveraging techniques such as EtherHiding to evade detection. A significant DDoS attack, attributed to the AISURU/Kimwolf botnet, reached 31.4 Tbps, and vulnerabilities have been discovered in Docker’s AI assistant, allowing for remote code execution. Efforts are underway to detect backdoors in AI models and address risks associated with platforms like MoltBook.

Active Exploitation of SolarWinds Web Help Desk RCE Used to Drop Custom Malware

gbhackers.com · 5 months ago

Threat actors are exploiting vulnerabilities in SolarWinds Web Help Desk to deploy custom malware and gain persistent remote access. The attacks began February 7, 2026, targeting systems lacking security patches and leverage CVE-2025-40551 and CVE-2025-26399. Attackers install a Zoho ManageEngine RMM agent as a backdoor, then weaponize an open-source forensics tool, Velociraptor, for command and control, utilizing a compromised Elastic Cloud instance to exfiltrate data. Organizations using SolarWinds Web Help Desk versions prior to 12.8.7 HF1 are urged to immediately apply available security updates.

Recent SolarWinds Flaws Potentially Exploited as Zero-Days

www.securityweek.com · 5 months ago

Microsoft reports that attacks occurred in December 2025, potentially exploiting vulnerabilities in SolarWinds Web Help Desk instances as zero-days to gain initial access. The compromised systems were vulnerable to CVE-2025-40551, CVE-2025-40536, and CVE-2025-26399, all of which have since been patched. Attackers used techniques like deploying ManageEngine, establishing reverse SSH and RDP access, and DLL sideloading to escalate privileges and compromise domains. Organizations are urged to patch their systems, remove unauthorized applications, and rotate credentials to prevent similar intrusions.

Singapore says China-linked hackers targeted telecom providers in major spying campaign

therecord.media · 5 months ago

Singapore officials report a sophisticated cyber espionage campaign targeting the country's four major telecommunications providers. The threat actor, identified as UNC3886, which has links to China, infiltrated networks using advanced tools and exploited a previously unknown software vulnerability. While unauthorized access was gained to portions of critical systems, authorities confirmed no customer data was compromised and no service disruptions occurred. This incident prompted Singapore's largest cyber incident response effort, Cyber Guardian, and highlights telecommunications infrastructure as a continued high-value target.

OpenClaw integrates VirusTotal malware scanning as security firms flag enterprise risks

www.csoonline.com · 5 months ago

OpenClaw, a viral AI agent platform, has integrated VirusTotal malware scanning into its skills marketplace following the discovery of numerous malicious skills and unauthorized deployments within enterprises. This integration uses Google’s Gemini powered Code Insight to analyze skills for malicious behavior, blocking suspicious files and re-scanning active ones. Security firms have warned that OpenClaw is insecure by default and vulnerable to exploitation, with one campaign, ClawHavoc, distributing malware like the Atomic macOS Stealer. While the VirusTotal integration helps filter known malware, experts caution that it does not address risks like prompt injection.

ScarCruft Exploits Trusted Cloud Services and OLE Documents to Deliver Malware

gbhackers.com · 5 months ago

The North Korean-backed ScarCruft APT group has changed its tactics, now using OLE-based droppers within Hangul Word Processor documents to distribute their ROKRAT malware. Attackers are abusing legitimate cloud services like pCloud and Yandex for command and control, making detection more difficult. Three distinct infection methods have been identified: one uses DLL side-loading with mpr.dll, another downloads a payload from a Dropbox link using credui.dll, and the third directly executes ROKRAT in memory via version.dll. ROKRAT is a remote access trojan capable of stealing files, logging keystrokes, and capturing screenshots.

LLMs are Getting a Lot Better and Faster at Finding and Exploiting Zero-Days

www.schneier.com · 5 months ago

New artificial intelligence models, like Opus 4.6, are significantly improving the ability to identify zero-day vulnerabilities. These models analyze code in a manner similar to human security researchers, recognizing patterns and past fixes to uncover previously undetected flaws. Early tests demonstrated the model's ability to find high-severity vulnerabilities in codebases that have already undergone extensive testing and fuzzing. This rapid advancement poses a challenge for security teams as AI increasingly assists in vulnerability discovery.

SmarterTools Hit by Ransomware via Vulnerability in Its Own Product

www.securityweek.com · 5 months ago

SmarterTools experienced a ransomware attack on January 29 impacting its network and a data center. Hackers exploited an unpatched vulnerability in the company’s own SmarterMail email server to compromise twelve Windows servers. The attack was attributed to the Warlock ransomware group, believed to be operating out of China, and likely leveraged CVE-2026-24423, CVE-2026-23760, and CVE-2025-52691. SmarterTools advises customers to promptly update to the latest SmarterMail version to mitigate further risk.

DKnife targets network gateways in long running AitM campaign

www.csoonline.com · 5 months ago

A China-linked adversary-in-the-middle framework called DKnife has been operating since at least 2019, targeting network gateways to intercept and manipulate traffic. The framework allows attackers to redirect updates, disrupt security tools, and deliver backdoors like ShadowPad and DarkNimbus. DKnife uses a modular Linux system for deep packet inspection, credential interception, and malicious content injection, and actively interferes with antivirus and PC-management communications by disrupting connections. Researchers have linked DKnife to previous campaigns and attribute it with high confidence to China-nexus threat actors.