Blahalla

12 OpenSSL Vulnerabilities Found With LLMs

aisle.com · 6 months ago

There are 12 OpenSSL vulnerabilities discovered by AISLE’s autonomous analyzer and disclosed in January 2026, including the higher and moderate severity CVEs CVE-2025-15467 and CVE-2025-11187 and the lower severity CVEs CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795, and CVE-2026-22796. Some issues date back decades and affect multiple subsystems such as CMS, QUIC, and post quantum signature handling, and AISLE recommended fixes that were incorporated directly into OpenSSL for five of the twelve CVEs. The findings were reported through responsible disclosure and coordinated with OpenSSL maintainers, resulting in fixes and additional preemptive merges before release.
From Triage to Threat Hunts: How AI Accelerates SecOps

thehackernews.com · 6 months ago

Agentic AI is reshaping security operations by augmenting human analysts rather than replacing them, automating full investigations of every alert to eliminate triage bottlenecks and reduce missed threats. These systems ingest telemetry from EDR identity email cloud SaaS and network tools to build unified context, create structured feedback loops that expose noisy detections for tuning, and enable natural language threat hunting so analysts can run complex hypotheses without query language expertise while vendors emphasize depth accuracy transparency adaptability and workflow integration with claimed accuracy above ninety eight percent under a Glass Box explainability model. CVEs mentioned on the page include CVE-2024-37079 and CVE-2026-20045.
Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

thehackernews.com · 6 months ago

A critical sandbox escape in the vm2 Node.js library allows attackers to break out of the sandbox and execute arbitrary code on the underlying operating system. The flaw, tracked as CVE-2026-22709 with a CVSS score of 9.8, stems from improper sanitization of Promise handlers, specifically a bypass involving Promise.prototype.then and Promise.prototype.catch when async functions return global Promise objects. The vulnerability was fixed in vm2 3.10.2 and users are advised to update to the latest 3.10.3 release which contains additional sandbox escape fixes. Previous sandbox escape vulnerabilities affecting vm2 include CVE-2022-36067, CVE-2023-29017, CVE-2023-29199, CVE-2023-30547, CVE-2023-32314, CVE-2023-37466, and CVE-2023-37903.
New WhatsApp lockdown feature protects high-risk users from hackers

www.bleepingcomputer.com · 6 months ago

Meta has started rolling out a new WhatsApp Strict Account Settings lockdown style security feature to protect journalists, public figures, and other high risk individuals from sophisticated threats including spyware. Users enable the feature only from their primary device under Settings Privacy Advanced, and it applies the most restrictive privacy controls by automatically turning on two step verification, blocking media and attachments from unknown senders, silencing calls from unknown people, turning off link previews, and locking last seen, online status, profile photo, About details, and profile links. WhatsApp said the feature will roll out gradually over the coming weeks and that it is migrating parts of the app to the Rust programming language to boost protection against spyware targeting photos, videos, and messages. The change follows past targeted zero click spyware infections and recently patched zero day exploits used against WhatsApp clients, and WhatsApp warned the setting is intended only for the very few users who may be targets of highly sophisticated cyber campaigns.
Critical FortiCloud SSO zero‑day forces emergency service disablement at Fortinet

www.csoonline.com · 6 months ago

Fortinet disclosed a critical authentication bypass zero day in FortiCloud single sign on tracked as CVE 2026 24858 and rated CVSS 9.4, and noted two related December fixes CVE 2025 59718 and CVE 2025 59719. Active exploitation was reported on January 20 and 21 with attackers using FortiCloud access to create persistent local administrator accounts on fully patched FortiGate, FortiManager and FortiAnalyzer devices and to download customer configuration files. Fortinet temporarily disabled FortiCloud SSO globally on January 26 and re enabled it on January 27 with server side blocking that prevents logins from vulnerable product versions until customers upgrade, and the company has released FortiOS 7.4.11 with additional patched versions listed as upcoming for affected releases from 7.0 through 7.6. The United States Cybersecurity and Infrastructure Security Agency added CVE 2026 24858 to its Known Exploited Vulnerabilities catalog and set a federal deadline of February 17, 2026 for agencies to patch or discontinue use of vulnerable systems.
Mustang Panda Deploys Updated COOLCLIENT Backdoor in Government Cyber Attacks

thehackernews.com · 6 months ago

There is an updated COOLCLIENT backdoor that was used in 2025 by threat actors tied to China to carry out cyber espionage and comprehensive data theft from infected endpoints, with attacks primarily targeting government entities in Myanmar, Mongolia, Malaysia, and Russia. The backdoor is deployed as a secondary payload alongside PlugX and LuminousMoth, often delivered via encrypted loader files and executed through DLL side loading using legitimate signed binaries from vendors including Bitdefender, VLC, Ulead PhotoImpact, and Sangfor, with one campaign delivering a variant that installed a previously unseen rootkit. COOLCLIENT captures keystrokes, clipboard data, files, and HTTP proxy credentials, can establish reverse tunnels, load in memory plugins such as ServiceMgrS, FileMgrS, and RemoteShellS, and operators also used browser credential stealers, TONESHELL, QReverse, and a USB worm called TONEDISK as part of broader post exploitation and surveillance activity. Analysis shows code sharing between tools used by Mustang Panda and LuminousMoth and indicates a shift toward active user surveillance capabilities that go beyond traditional document theft.
Trump’s Acting Cyber Chief Allegedly Leaked Data to ChatGPT

www.techrepublic.com · 6 months ago

Sources say the interim leader of the US civilian cyber defense agency uploaded sensitive government contracting documents marked for official use only into a publicly accessible version of ChatGPT last summer, triggering multiple automated cybersecurity alerts and prompting a Department of Homeland Security level review into potential exposure of federal information. The official had requested a temporary exception to use ChatGPT and CISA says the use was short term and limited under DHS controls, while other officials say uploads were detected in August and that the activity raised concerns about use of public AI platforms. After the activity was flagged, senior DHS officials reviewed the uploads and met with the acting general counsel and the department chief information officer, and the episode has intensified questions about leadership and governance at the agency.
Layoffs are up, hiring is down as Amazon cuts reverberate through the economy

www.washingtonpost.com · 6 months ago

false
Sicarii ransomware locks your data and throws away the keys

www.csoonline.com · 6 months ago

A newly observed Sicarii ransomware strain contains a critical encryption key handling defect that can leave encrypted data unrecoverable because it generates fresh RSA key pairs on each execution and discards the private key. As a result, victims cannot rely on ransom payments or published decryptors to restore files unless independent verification shows the specific infected sample fixes the flaw, forcing organizations to assume total data loss and prioritize containment and restoration from known good offline or immutable backups. Researchers say the issue appears to stem from poor key management and possibly AI assisted or vibe coded development, and Sicarii also conducts credential harvesting, network reconnaissance, vulnerability scanning, and data exfiltration, elevating the impact beyond financial extortion to potential permanent data loss and prolonged business disruption.
TP-Link Archer Router Flaw Exposes Users to Remote Attacks and Full Device Control

gbhackers.com · 6 months ago

There is a high command injection vulnerability in TP Link Archer MR600 v5 routers that allows authenticated attackers to execute arbitrary system commands through the device admin interface. The issue is tracked as CVE 2025 14756 with a CVSS version 4.0 score of 8.5 and can be exploited via the browser developer console under character length restrictions, potentially allowing complete device compromise. Devices running firmware versions prior to 1.1.0, including v0.9.1 and v0001.0 Build 250930 Rel.63611n, are affected and TP Link released patched firmware version 1.1.0 on January 26, 2026, with updates available for English and Japanese regions. Users are advised to verify their firmware version, immediately upgrade to version 1.1.0 or later, change administrative credentials after patching, and monitor network activity for suspicious admin interface access.
Microsoft Exchange Online to End Support for SMTP AUTH Basic Authentication

gbhackers.com · 6 months ago

Microsoft has revised the deprecation timeline for SMTP AUTH Basic Authentication in Exchange Online, leaving behavior unchanged through December 2026, disabling SMTP AUTH by default for existing tenants at the end of December 2026 while allowing administrators to reenable it, making OAuth the supported authentication method for new tenants created after December 2026, and pledging to announce a final removal date in the second half of 2027. The update responds to customer feedback and adoption challenges and is intended to give organizations more time to modernize legacy email workflows and migrate devices and applications to modern authentication such as OAuth or alternatives like the Microsoft Graph API.
Password Reuse in Disguise: An Often-Missed Risky Workaround

thehackernews.com · 6 months ago

Near-identical password reuse continues to slip past security controls because users make small predictable changes that satisfy complexity and history rules while leaving the underlying secret effectively the same. Attackers exploit this predictability by starting from breached credentials and applying automated transformations such as adding characters, changing symbols, and incrementing numbers to quickly move from one compromised account to another. To reduce risk organizations need continuous monitoring against breach data, intelligent similarity analysis that blocks passwords too similar to previous ones, and centralized enforcement of password policies across corporate systems rather than relying solely on basic complexity rules.
Millions in bets ride on what Trump will say, do or invade next

www.washingtonpost.com · 6 months ago

false
WhatsApp Boosts Account Security for At-Risk Individuals

www.securityweek.com · 6 months ago

There are new Strict Account Settings on WhatsApp designed to protect at risk users such as journalists and public figures. The feature, rolling out over the coming weeks, lets users block attachments and media from unknown senders and silence calls from unknown people while enabling additional extreme protection settings that limit how the app works. These controls are available in Settings under Privacy in Advanced options and complement existing protections including end to end encryption, encrypted cloud backups, two factor authentication, passkeys, IP address protection for calls, and the ability to block unknown accounts.
Tesla bet big on Elon Musk. His politics continue to haunt it.

www.washingtonpost.com · 6 months ago

false
Chinese National Sentenced to 46 Months for Laundering Millions Stolen from U.S. Investors

gbhackers.com · 6 months ago

A Chinese national, Jingliang Su, was sentenced to 46 months in U.S. federal prison and ordered to pay 26,867,242.44 dollars in restitution for laundering more than 36.9 million dollars stolen from American investors through a large scale digital asset investment scam. The operation ran from scam centers in Cambodia and relied on unsolicited social media messages, phone calls, text messages, and online dating to groom victims and steer them to fake cryptocurrency trading websites that displayed manipulated account balances. Victim funds were funneled into U.S. bank accounts controlled by shell companies, consolidated into a single account at Deltec Bank in the Bahamas, converted to the stablecoin Tether USDT, and transferred to a digital asset wallet controlled in Cambodia, with investigators identifying 174 U.S. victims. Eight co conspirators have pleaded guilty, and the investigation was led by the U.S. Secret Service with support from Homeland Security Investigations and other federal and international partners.
Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

thehackernews.com · 6 months ago

There is active exploitation of a critical WinRAR path traversal vulnerability CVE-2025-8088, patched in WinRAR version 7.13 on July 30, 2025 with a CVSS score of 8.8, that allows crafted archives to drop files into the Windows Startup folder to achieve persistence and arbitrary code execution. Google reports nation state actors linked to Russia and China and financially motivated groups are using the flaw to gain initial access and deploy payloads including SnipBot, Poison Ivy, AsyncRAT, XWorm, Telegram bot controlled backdoors, and ransomware linked to UNC2596. Researchers observed the RomCom cluster exploiting the flaw as a zero day as early as July 18, 2025, and other groups such as Sandworm, Gamaredon, and Turla have used decoy files and malicious shortcuts hidden in alternate data streams to extract and execute payloads. The advisory also highlights exploitation of another WinRAR flaw CVE-2025-6218 with CVSS 7.8 by actors including GOFFEE, Bitter, and Gamaredon and warns that underground exploit sales are accelerating widespread abuse.
Fake Python Spellchecker Packages on PyPI Delivered Hidden Remote Access Trojan

thehackernews.com · 6 months ago

Cybersecurity researchers found two malicious PyPI packages named spellcheckerpy and spellcheckpy that masqueraded as spellcheckers while embedding a base64 encoded payload in a Basque language dictionary file to deliver a Python remote access trojan. The packages were downloaded just over one thousand times before removal, and the attacker published three dormant versions before releasing spellcheckpy version 1.2.0 on January 21, 2026, which added an obfuscated trigger that executes the payload when the SpellChecker module is imported. The infection chain abuses a test file extraction function to retrieve and decode a hidden downloader that fetches a RAT from an external domain hosted by a provider traced to RouterHosting LLC also known as Cloudzy. The campaign mirrors a November 2025 malicious spell check package and raises concerns about slopsquatting and AI agents installing nonexistent packages.
Always-on privileged access is pervasive — and fraught with risks

www.csoonline.com · 6 months ago

Ninety one percent of end users log in at their highest privilege, a pervasive practice traced to years of lax IT governance, legacy integrations, and the operational convenience of always on access. Organizations maintain permanent privileges to keep pipelines, integrations, and recovery processes running, and administrators often bypass privileged access management tools that are perceived as onerous or risky to use. Always on access raises the likelihood of accidental system damage and data exposure and gives attackers a powerful avenue to move laterally through environments. The growing dominance of non human identities such as service accounts, APIs, and continuous integration and continuous delivery pipelines is making the problem worse and is driving calls for a shift to just in time privilege models despite very low adoption.
US Charges 31 More Defendants in Massive ATM Hacking Probe

www.securityweek.com · 6 months ago

There are 31 additional individuals charged by the US Justice Department in a massive ATM jackpotting probe, bringing the total charged to 87. The suspects are mostly Venezuelan nationals, including members of the Tren de Aragua syndicate, with some Colombian nationals, and they face charges including conspiracy to commit bank fraud and burglary, computer fraud, and intentional damage to protected systems. Investigators say the network used Ploutus malware together with physical tampering to swap ATM hard drives or infect machines via USB to issue unauthorized cash dispensing commands, with the malware deleting its own traces, and authorities say two convicted Venezuelan nationals will be deported while all charged may face deportation.
Beware! Fake ChatGPT browser extensions are stealing your login credentials

www.bitdefender.com · 6 months ago

Security researchers uncovered at least 16 malicious Chrome extensions posing as ChatGPT productivity tools that steal users authentication tokens and hijack sessions. These extensions hook into the Chrome browser, intercept outgoing requests that contain authorization headers, extract session tokens and send them to a remote server controlled by attackers. A criminal with such a token can access the victim's chat history and any connected services, and researchers found about 900 downloads across the 16 extensions and published a list of the offending extension names. Users are advised to remove suspicious ChatGPT related extensions, change their OpenAI password, and verify publisher reputation and reviews before installing extensions.
APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability

www.securityweek.com · 6 months ago

Russian and Chinese state sponsored threat actors and financially motivated groups have widely exploited a high severity WinRAR path traversal vulnerability tracked as CVE-2025-8088, with exploitation observed beginning in July 2025 and the flaw patched on July 30, 2025. Attackers abuse Alternate Data Streams inside RAR archives to write files to arbitrary locations, commonly the Windows Startup folder, enabling persistence and arbitrary code execution when a vulnerable version of WinRAR opens the archive. Observed targets include government, military, and technology organizations with tailored campaigns against Ukrainian entities, while financially motivated actors have used the flaw globally to deploy commodity RATs and other malware including PoisonIvy. The exploit has been commoditized in underground markets with sellers advertising ready to use WinRAR exploits since July 2025, increasing the diversity and scale of attacks.
WhatsApp Introduces New Strict Account Settings to Protect Users from Hackers

gbhackers.com · 6 months ago

There is a new Strict Account Settings feature in WhatsApp that provides lockdown style protections intended to shield high risk users such as journalists, public figures, and activists from sophisticated targeted attacks. When enabled, it automatically blocks attachments and media from unknown contacts and silences incoming calls from unrecognized numbers, reducing exposure to malicious files and voice based social engineering while operating alongside existing end to end encryption. Users can activate the feature through WhatsApp Settings Privacy Advanced by toggling lockdown mode, and WhatsApp plans a global rollout over the coming weeks. The restrictions may disrupt normal communications by blocking legitimate content and calls, so users should weigh their threat profile against the operational limitations.
Android Phones Get AI-Powered Anti-Theft Features

www.techrepublic.com · 6 months ago

false
Indurex Emerges From Stealth to Close Security Gap in Cyber-Physical Systems

www.securityweek.com · 6 months ago

Indurex, a Netherlands based cybersecurity startup founded by Jalal Bouhdada and Maarten Oosterink, emerged from stealth on January 28, 2026 to close security gaps in cyber physical systems. Its AI powered platform ingests and correlates data from industrial historians, instrumentation and asset management systems, alarm management, and OT network and endpoint sources to unify cyber, process, and safety context into a single operational view with adaptive risk scoring. The company can integrate with third party OT security solutions, aims to cut noisy alerts and improve uptime and compliance, and is preparing a pre seed funding round while remaining bootstrapped until the round closes.
Fortinet Patches Exploited FortiCloud SSO Authentication Bypass

www.securityweek.com · 6 months ago

Fortinet rolled out emergency patches after a FortiCloud single sign on authentication bypass tracked as CVE-2026-24858 was exploited in the wild to create new administrator accounts and exfiltrate configuration files. The vulnerability allows an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts and is related to earlier FortiCloud SSO bugs CVE-2025-59718 and CVE-2025-59719; fixes were released for FortiOS, FortiManager, FortiAnalyzer and FortiProxy across multiple 7.0, 7.2, 7.4 and 7.6 versions. CISA added CVE-2026-24858 to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch by January 30 while Fortinet blocked the malicious FortiCloud accounts and briefly disabled FortiCloud SSO between January 26 and 27.
Delegation is a risk decision every leader makes, not an ops choice

www.csoonline.com · 6 months ago

There are everyday delegation choices that move authority into software and create persistent risk rather than mere operational tradeoffs. Automating actions such as refunds, credits, remediation, or pricing can scale decisions faster than oversight, harden into infrastructure, and leave ownership gaps that surface in audits, regulatory action, or customer harm. Security teams often surface these risks first because permissions and automated actions make delegated authority visible, but the exposure spans finance, legal, compliance, operations, and reputation and therefore requires cross functional governance and deliberate tradeoffs aligned to risk appetite. Individuals delegating personal agents face the same dynamics because responsibility ultimately remains with the principal, so leaders must explicitly define who accepts downstream risks, document authority and constraints, and preserve the ability to revise delegated powers.
High-Severity Remote Code Execution Vulnerability Patched in OpenSSL

www.securityweek.com · 6 months ago

There are twelve vulnerabilities patched in OpenSSL, all discovered by cybersecurity firm Aisle using an autonomous analyzer. The most serious is tracked as CVE-2025-15467, a stack buffer overflow when parsing CMS AuthEnvelopedData that use AEAD ciphers such as AES GCM where an oversized IV can be copied into a fixed-size stack buffer before authentication, enabling a crash or potential remote code execution depending on platform and toolchain mitigations. The update also addresses CVE-2025-11187, a moderate issue that can cause denial of service or lead to remote code execution, and several remaining low severity flaws that mostly enable DoS or affect authentication and information exposure while Aisle additionally reported six more issues fixed prior to release.
Skills CISOs need to master in 2026

www.csoonline.com · 6 months ago

CISOs in 2026 must combine deep business and world knowledge, strong artificial intelligence literacy, and the ability to shape organizational culture so they function as business value and resilience executives rather than technical gatekeepers. They need technical fluency in cloud native architectures and AI governance, financial risk quantification skills, and traditional security foundations, together with soft skills such as strategic judgment, calm incident leadership, board level communication, and cross functional influence. Low cost ways to build these capabilities include peer CISO communities, vendor and cloud provider training, internal learning loops, AI tools for rapid study, and mentoring, while entry level and single vendor certifications are increasingly less differentiating at the executive level.
[Research] Analysis of 74,636 AI Agent Interactions: 37.8% Contained Attack Attempts - New "Inter-Agent Attack" Category Emerges

raxe.ai · 6 months ago

In Week 3 of 2026, inference time on device threat detection across 38 production AI agent deployments recorded 28,194 threats across 74,636 interactions, a 37.8 percent attack rate. New inter agent attacks made up 3.4 percent of threats with agents sending poisoned messages to other agents, data exfiltration led at 19.2 percent primarily targeting system prompts and retrieval augmented generation context, and jailbreaks were detected with 96.3 percent confidence. Attack technique breakdown showed instruction override at 9.7 percent, tool and command injection at 8.2 percent, RAG poisoning at 8.1 percent trending up, and system prompt extraction at 7.7 percent, with concerns that the inter agent vector enables goal hijacking, constraint removal and recursive propagation across the multi agent ecosystem.
Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected

thehackernews.com · 6 months ago

Fortinet is addressing a critical vulnerability, CVE-2026-24858, impacting FortiOS, FortiManager, and FortiAnalyzer. The flaw allows unauthorized access through an authentication bypass related to FortiOS single sign-on, requiring a FortiCloud account and registered device. Threat actors have been actively exploiting this vulnerability to create administrator accounts, modify configurations, and steal firewall settings. The U.S. Cybersecurity and Infrastructure Security Agency has added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to take action.
Corrupting the Hive Mind: Persistence Through Forgotten Windows Internals

www.praetorian.com · 6 months ago

Researchers have developed a technique to achieve registry persistence on Windows systems without triggering standard Endpoint Detection and Response (EDR) alerts. This method leverages Windows’ mandatory user profiles and the Offline Registry Library to modify registry hives without using traditional registry APIs. The tool, named Swarmer, allows for the creation and deployment of modified registry hives as NTUSER.MAN files, enabling persistence even for low-privilege users. While effective, the technique has limitations, including the inability to update persistence without administrative privileges and the potential for detection based on file creation or unusual library loading.
AI-powered polymorphic attack lures victims to phishing webpages

www.csoonline.com · 6 months ago

Researchers have identified a new malware attack using artificial intelligence to create highly customized phishing webpages. Attackers leverage client-side API calls to large language models like DeepSeek and Google’s Gemini to generate malicious JavaScript code dynamically, bypassing traditional detection methods. This polymorphic technique assembles code fragments within a user's browser, leaving minimal trace for security tools to identify. Experts suggest that user awareness and existing email security measures remain crucial defenses against these sophisticated attacks.
UPS will slash 30,000 jobs as company shifts away from Amazon

www.washingtonpost.com · 6 months ago

United Parcel Service plans to eliminate 30,000 jobs in 2026 as it untangles its partnership with Amazon. The company will also close 24 buildings in the first half of the year and expects those moves to generate three billion dollars in savings with cuts achieved through attrition and a second voluntary separation program for full time drivers. UPS reported 2.6 billion dollars in profit on 24.5 billion dollars in revenue for the last three months of 2025 and had previously cut 48,000 positions in 2025.
Fixes released for a serious Microsoft Office zero-day flaw

www.csoonline.com · 6 months ago

Microsoft has released fixes for a critical zero-day vulnerability affecting Microsoft Office. The flaw, tracked as CVE-2026-21509, allows attackers to bypass security measures by exploiting the older OLE document format, similar to macro exploitation. While Office 2021 and later versions receive automatic updates requiring a restart, users of Office 2016 and 2019 must apply patches manually. Security experts advise immediate action to update systems and prioritize employee awareness of suspicious attachments.
Fortinet blocks exploited FortiCloud SSO zero day until patch is ready

www.bleepingcomputer.com · 6 months ago

A critical zero-day vulnerability, CVE-2026-24858, has been identified in Fortinet’s FortiCloud single sign-on (SSO) system, allowing attackers to gain administrative access to other customers' devices. Attackers have been using email addresses [email protected] and [email protected] to create new administrator accounts and exfiltrate configurations. Fortinet has blocked vulnerable devices from authenticating via FortiCloud SSO and is developing patches for FortiOS, FortiManager, and FortiAnalyzer. While a server-side change prevents exploitation, Fortinet advises reviewing administrator accounts and restoring configurations from backups.
AI & the Death of Accuracy: What It Means for Zero-Trust

www.darkreading.com · 6 months ago

The increasing use of AI-generated content poses a risk to large language models, potentially leading to "model collapse" where models degrade over time due to flawed training data. Gartner predicts 50% of organizations will adopt zero-trust data governance by 2028 to address this issue, emphasizing continuous model behavior evaluation. Experts warn this degradation can erode system guardrails and create opportunities for attackers through prompt injection. Organizations should prioritize verifying data provenance and maintaining a focus on high-quality, human-generated data to mitigate these risks.
Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor

www.bleepingcomputer.com · 6 months ago

Chinese hackers linked to the Mustang Panda threat group have updated their CoolClient backdoor. The malware now steals login data from browsers, monitors the clipboard, and deploys a previously unseen rootkit. Attackers have used CoolClient to target government entities in Myanmar, Mongolia, Malaysia, Russia, and Pakistan, often leveraging legitimate software from companies like Sangfor, Bitdefender, and VLC. The updated backdoor includes new features like a remote shell plugin, service management, and infostealers for Chrome, Edge, and other Chromium-based browsers.
Microsoft Issues Emergency Patch for Active Office Zero-Day

www.techrepublic.com · 6 months ago

Microsoft has released an emergency security update to address an actively exploited vulnerability in Microsoft Office. The flaw, identified as CVE-2026-21509, allows attackers to bypass security protections by tricking users into opening malicious files, often through phishing. This vulnerability involves manipulating how Office handles Object Linking and Embedding, potentially allowing unsafe components to execute. Organizations are urged to patch affected systems immediately and implement additional security measures like Protected View and monitoring for suspicious activity.
Vibe-Coded 'Sicarii' Ransomware Can't Be Decrypted

www.darkreading.com · 6 months ago

A new ransomware variant called Sicarii has emerged, initially offered as a ransomware-as-a-service. Researchers have discovered a critical flaw: the ransomware's decryption process doesn't work, even if a ransom is paid, because it generates new encryption keys locally and discards the private key. Security experts suspect the malware's developers may have used AI-assisted tooling, contributing to the error. The group claims to have targeted several small businesses, and exhibits unusual branding suggesting possible false-flag behavior. Victims are strongly advised against paying the ransom and to focus on data recovery through alternative means.
Meta Campaigns to Change Opinions on Data Centers

www.nytimes.com · 6 months ago

Meta has spent more than six million dollars on television ads airing in state capitals and in Washington. The campaign promotes the message that data centers create jobs.
Judge dismisses case alleging use of Flock cameras in Virginia city is unconstitutional

therecord.media · 6 months ago

A Virginia federal judge, Mark Davis, ruled that the warrantless use of 176 Flock automated license plate reader cameras in Norfolk is constitutional and dismissed a case seeking to remove them. Davis found that 75 camera clusters across 66 square miles that retain images on a 21 day rolling basis do not amount to the continuous or intimate tracking at issue in Carpenter and the Leaders of a Beautiful Struggle case, noting captures were infrequent and on average 2.5 to 3.5 miles apart and 45 to 50 minutes apart. The Institute for Justice said it will appeal after discovery showed one plaintiff's vehicle was recorded 475 times in a four month period.
Critical Telnet Server Flaw Exposes Forgotten Attack Surface

www.darkreading.com · 6 months ago

A critical authentication bypass vulnerability, CVE-2026-24061, has been identified in the GNU InetUtils telnetd server, allowing attackers to gain complete control of affected devices. This flaw, present since May 2015, affects hundreds of thousands of exposed telnet servers globally, many of which are used in legacy systems and Internet of Things (IoT) equipment. While the vulnerability can be mitigated by updating to version 2.8 of InetUtils, organizations are urged to disable telnet servers or restrict network access as a long-term solution. Recent data indicates an increase in telnet usage, particularly in government networks, making this a significant and persistent security risk.
Safeguarding sources and sensitive information in the event of a raid

freedom.press · 6 months ago

There are concrete measures reporters can take to reduce the risk of source exposure during government raids and device seizures, a trend that has recently escalated beyond subpoenas. Reporters should perform a data inventory, minimize what they retain, designate an encrypted data custodian such as an editor for necessary copies, and digitize and encrypt or destroy paper records to avoid retaining source identifying material. Do not rely on remote wiping after a seizure; instead use strong full disk encryption and file containers with tools such as VeraCrypt, enable platform encryption features including FileVault, BitLocker and LUKS and cloud protections like Apple Advanced Data Protection, disable biometrics in favor of complex alphanumeric passphrases, and keep devices powered off when not needed. Additional protections include rebooting before sleep, using kill cord solutions to shut down or wipe on disconnection while seeking legal advice about wiping risks, destroying sensitive removable media such as SD cards, and seeking assistance from press freedom and journalist support networks.
Microsoft Rushes Emergency Patch for Office Zero-Day

www.darkreading.com · 6 months ago

Microsoft rushed out an emergency patch for a zero day vulnerability in multiple versions of Microsoft Office and Microsoft 365 that is being actively exploited. The vulnerability is tracked as CVE-2026-21509 with a CVSS score of 7.8 and it allows attackers to bypass security controls protecting against unsafe COM OLE behavior and execute arbitrary code, with exploitation requiring either prior system access or convincing a user to open a malicious Office file. CISA added the bug to its known exploited vulnerabilities catalog and directed federal civilian agencies to patch or discontinue use by February 16, and Microsoft said Office 2021 and later were fixed server side while Office 2016 and 2019 require installing the update or applying registry mitigations; viewing a file in the preview pane does not trigger the flaw. Security firms assessed the issue as complex and likely part of multistage attacks associated with advanced persistent threats, and related previously exploited vulnerabilities include CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706, and CVE-2025-62554.
How Computer Warfare Is Becoming Part of the Pentagon’s Arsenal

www.nytimes.com · 6 months ago

The Pentagon tested a new computer warfare approach that was used to support operations in Venezuela and to augment strikes on Iranian nuclear facilities. The effort paired cyber operations aimed at degrading sensors, communications, and control systems with traditional military strikes to create windows of tactical advantage while prompting debate over legal oversight and strategic risks.
WhatsApp unveils anti-spyware ‘lockdown’ feature

therecord.media · 6 months ago

WhatsApp is rolling out a Strict Account Settings lockdown-style feature that will block attachments and media from people not in a user’s contacts list, aimed at protecting journalists and other public-facing individuals who may be targeted by sophisticated spyware. The feature is intended as an extreme safeguard against surveillance tools such as the NSO Group’s Pegasus, which reportedly targeted about 1,400 WhatsApp users in a 2019 zero-click attack. WhatsApp says the feature will roll out gradually in the coming weeks and the move follows a federal judge’s order barring NSO Group from using WhatsApp infrastructure.
WinRAR path traversal flaw still exploited by numerous hackers

www.bleepingcomputer.com · 6 months ago

There are multiple state sponsored and financially motivated threat actors exploiting a high severity WinRAR path traversal vulnerability tracked as CVE-2025-8088 to gain initial access and deliver malicious payloads. The flaw abuses Alternate Data Streams to hide and extract payloads such as LNK, HTA, BAT, CMD, and script files into arbitrary locations including the Windows Startup folder for persistence, with exploitation observed as early as July 18, 2025 and continuing into 2026. Observed operators include UNC4895 known as RomCom, APT44, TEMP.Armageddon, Turla, and China linked actors, and financially motivated groups are deploying commodity remote access tools and stealers while working exploits have been sold by specialized suppliers, lowering the barrier for attacks on unpatched systems.
Apple Issues Urgent Software Fix Affecting Over 2 Billion iPhones

www.techrepublic.com · 6 months ago

There are urgent iOS updates rolling out across a wide range of iPhones, affecting an estimated over two billion devices and including iOS 26.2.1 for newer phones and legacy updates such as iOS 18.7.4, iOS 16.7.13, iOS 15.8.6, and iOS 12.5.8 for older models. The push was triggered by emergency call connectivity failures reported in Australia and to extend a certificate required for features like iMessage FaceTime and device activation to continue working after January 2027 on older iPhones. Apple also released watchOS 26.2.1 for cellular Apple Watch models and urged users to install the updates via Settings to ensure emergency services and core features keep functioning.
OpenSSL January 2026 Security Update: CMS and PKCS#12 Buffer Overflows

securitylabs.datadoghq.com · 6 months ago

On January 27, 2026 OpenSSL disclosed security updates affecting OpenSSL 1.0.2, 1.1.1 and the 3.x series including versions 3.0 through 3.6. There are two prominent vulnerabilities. CVE-2025-15467 is a high severity stack buffer overflow in CMS AuthEnvelopedData AEAD parsing that can crash processes and may enable remote code execution, and CVE-2025-11187 is a moderate severity PBMAC1 PBKDF2 key length validation failure in PKCS 12 MAC verification that can cause denial of service. Both issues primarily affect systems that parse untrusted CMS or PKCS 12 inputs such as S MIME gateways and certificate import services, FIPS modules are not affected, and real world exploitability depends on downstream build configurations and platform mitigations so users should upgrade affected OpenSSL builds or bundled runtimes.