Blahalla

Microsoft Rushes Emergency Patch for Office Zero-Day

www.darkreading.com · 6 months ago

Microsoft rushed out an emergency patch for a zero day vulnerability in multiple versions of Microsoft Office and Microsoft 365 that is being actively exploited. The vulnerability is tracked as CVE-2026-21509 with a CVSS score of 7.8 and it allows attackers to bypass security controls protecting against unsafe COM OLE behavior and execute arbitrary code, with exploitation requiring either prior system access or convincing a user to open a malicious Office file. CISA added the bug to its known exploited vulnerabilities catalog and directed federal civilian agencies to patch or discontinue use by February 16, and Microsoft said Office 2021 and later were fixed server side while Office 2016 and 2019 require installing the update or applying registry mitigations; viewing a file in the preview pane does not trigger the flaw. Security firms assessed the issue as complex and likely part of multistage attacks associated with advanced persistent threats, and related previously exploited vulnerabilities include CVE-2025-53770, CVE-2025-53771, CVE-2025-49704, CVE-2025-49706, and CVE-2025-62554.
How Computer Warfare Is Becoming Part of the Pentagon’s Arsenal

www.nytimes.com · 6 months ago

The Pentagon tested a new computer warfare approach that was used to support operations in Venezuela and to augment strikes on Iranian nuclear facilities. The effort paired cyber operations aimed at degrading sensors, communications, and control systems with traditional military strikes to create windows of tactical advantage while prompting debate over legal oversight and strategic risks.
WhatsApp unveils anti-spyware ‘lockdown’ feature

therecord.media · 6 months ago

WhatsApp is rolling out a Strict Account Settings lockdown-style feature that will block attachments and media from people not in a user’s contacts list, aimed at protecting journalists and other public-facing individuals who may be targeted by sophisticated spyware. The feature is intended as an extreme safeguard against surveillance tools such as the NSO Group’s Pegasus, which reportedly targeted about 1,400 WhatsApp users in a 2019 zero-click attack. WhatsApp says the feature will roll out gradually in the coming weeks and the move follows a federal judge’s order barring NSO Group from using WhatsApp infrastructure.
WinRAR path traversal flaw still exploited by numerous hackers

www.bleepingcomputer.com · 6 months ago

There are multiple state sponsored and financially motivated threat actors exploiting a high severity WinRAR path traversal vulnerability tracked as CVE-2025-8088 to gain initial access and deliver malicious payloads. The flaw abuses Alternate Data Streams to hide and extract payloads such as LNK, HTA, BAT, CMD, and script files into arbitrary locations including the Windows Startup folder for persistence, with exploitation observed as early as July 18, 2025 and continuing into 2026. Observed operators include UNC4895 known as RomCom, APT44, TEMP.Armageddon, Turla, and China linked actors, and financially motivated groups are deploying commodity remote access tools and stealers while working exploits have been sold by specialized suppliers, lowering the barrier for attacks on unpatched systems.
Apple Issues Urgent Software Fix Affecting Over 2 Billion iPhones

www.techrepublic.com · 6 months ago

There are urgent iOS updates rolling out across a wide range of iPhones, affecting an estimated over two billion devices and including iOS 26.2.1 for newer phones and legacy updates such as iOS 18.7.4, iOS 16.7.13, iOS 15.8.6, and iOS 12.5.8 for older models. The push was triggered by emergency call connectivity failures reported in Australia and to extend a certificate required for features like iMessage FaceTime and device activation to continue working after January 2027 on older iPhones. Apple also released watchOS 26.2.1 for cellular Apple Watch models and urged users to install the updates via Settings to ensure emergency services and core features keep functioning.
OpenSSL January 2026 Security Update: CMS and PKCS#12 Buffer Overflows

securitylabs.datadoghq.com · 6 months ago

On January 27, 2026 OpenSSL disclosed security updates affecting OpenSSL 1.0.2, 1.1.1 and the 3.x series including versions 3.0 through 3.6. There are two prominent vulnerabilities. CVE-2025-15467 is a high severity stack buffer overflow in CMS AuthEnvelopedData AEAD parsing that can crash processes and may enable remote code execution, and CVE-2025-11187 is a moderate severity PBMAC1 PBKDF2 key length validation failure in PKCS 12 MAC verification that can cause denial of service. Both issues primarily affect systems that parse untrusted CMS or PKCS 12 inputs such as S MIME gateways and certificate import services, FIPS modules are not affected, and real world exploitability depends on downstream build configurations and platform mitigations so users should upgrade affected OpenSSL builds or bundled runtimes.
TikTok Settles Social Media Addiction Lawsuit Ahead of a Landmark Trial

www.nytimes.com · 6 months ago

Snap reached a settlement on January 20, 2026, in a social media addiction lawsuit brought by a teenager identified as K.G.M., avoiding a landmark trial scheduled in Los Angeles. Plaintiffs planned to argue that design features such as infinite scroll, auto video play, push notifications, and algorithmic recommendations made platforms inherently defective and caused depression, eating disorders, and self harm among young users, and they seek monetary damages and changes to product design. No settlement was reached with Meta, TikTok, or YouTube, and the remaining cases are proceeding as bellwether litigation that could expose internal documents and open new avenues of liability for major tech companies.
Why code indexing matters for AI security tools

www.gecko.security · 6 months ago

There is a fundamental gap between AST level static analysis and the semantic reasoning needed to find business logic vulnerabilities, so scanners consistently detect injection flaws but often miss authentication bypasses, broken access control, and privilege escalation. ASTs represent syntax inside single files but do not capture symbol resolution, types, cross file call chains, or missing authorization checks, and taint analysis tracks data flow without evaluating whether conditional logic implements correct security policy. Detecting business logic flaws requires compiler accurate semantic indexes, full call chain and parameter tracking across repositories and services, and mapping API contracts to link microservices. Building on language server indexing and using LLMs for intent and pattern reasoning can expose multi step chains like the Cal.com authentication bypass.
Tech leaders’ alliance with Trump is tested by a killing in Minneapolis

www.washingtonpost.com · 6 months ago

Top tech executives including Apple chief executive Tim Cook and Amazon chief executive Andy Jassy attended a White House screening with President Donald Trump shortly after the January 24, 2026 killing in Minneapolis of Alex Pretti by federal immigration agents, prompting frustration among tech workers who condemned the administration's immigration tactics. High-ranking employees at Google, Microsoft, OpenAI and other firms posted outraged messages, more than 700 tech workers signed a public letter urging companies to cancel contracts with federal immigration agencies, and OpenAI chief executive Sam Altman told staff that ICE is going too far while calling for unity. The episode exposed a widening rift in Silicon Valley between outspoken rank-and-file workers and senior executives whose recent closeness to the White House and participation in Trump events has muted corporate rebuke.
Chinese money launderers moved more than $16 billion of illicit crypto in 2025, report finds

therecord.media · 6 months ago

There are Chinese language money laundering networks that processed an estimated twenty percent of all illicit cryptocurrency funds in 2025, laundering on average forty four million dollars per day and totaling approximately sixteen point one billion dollars. Chainalysis estimates that eighty two billion dollars of cryptocurrency was laundered on chain in 2025, up from ten billion dollars in 2020. These networks have professionalized, advertising services on Telegram and using guarantee platforms that offer escrow while laundering funds with money mules, dedicated services that handle stolen crypto, and swapping services to convert assets. U S Treasury sanctions and other enforcement actions against operators prompted migrations to other platforms, and one alleged operator had fifteen billion dollars in bitcoin seized and was arrested and extradited to China.
'Stanley' Toolkit Turns Chrome Into Undetectable Phishing Vector

www.darkreading.com · 6 months ago

There is a malware as a service toolkit called Stanley being sold on a Russian cybercrime forum for between two thousand and six thousand dollars. It can generate malicious Chrome extensions, packaged as a seemingly legitimate note taking extension called Notely, that intercept user visits and overlay attacker controlled full screen phishing pages on real websites while leaving the legitimate domain visible in the browser address bar, enabling credential theft. Buyers receive a command and control panel to manage victims, configure spoofed redirects, and send fake browser notifications, and higher tier offerings claim a guarantee that created extensions will pass Chrome Web Store review. Security experts say this undermines defenses that rely on URL verification or installing only from official stores and recommend allow listing extensions, auditing permissions regularly, and flagging extensions that request excessive privileges.
Android Adds ‘Accountability Layer’ to Third-Party Apps

www.techrepublic.com · 6 months ago

Android is introducing an accountability layer that adds new verification steps to sideloaded apps to reduce malware, fraud, and scams while preserving the ability to sideload. Advanced users will be able to install without verifying but will encounter a high friction flow that provides specific warnings and safeguards, and a new student and hobbyist account type will permit limited distribution without full verification. The developer verification requirements were detailed on the Android Developers Blog in November 2025, and the update is expected to roll out regionally during 2026.
Google wants your emails and photos to ‘personalize’ its AI. Should you let it?

www.washingtonpost.com · 6 months ago

Google is offering a feature called Personal Intelligence that, when enabled, can access a user’s Gmail, Google Photos, past Search queries and YouTube history to personalize responses from Gemini and AI Mode. The feature promises more contextually useful answers and personal insights while Google says it will not directly train models on that data and that Gemini currently has no targeted ads. Privacy experts warn that mixing data across contexts can cause data bleed, producing embarrassing or harmful cross context disclosures and mistaken assumptions, so users are advised to try the feature cautiously and keep it off when not actively using it.
One-Click Hack Against Popular Video Platform

claroty.com · 6 months ago

A vulnerability in the IDIS Cloud Manager ICM Viewer allows one click remote code execution on the Windows host running the viewer when a user visits an attacker controlled page, because a local CWGService listens on localhost and accepts crafted WebSocket messages. The flaw is caused by missing origin validation, use of a constant encryption key, lack of argument sanitization in CWGService, and forwarding of untrusted arguments to the embedded Chromium engine which permits command line flag injection such as utility cmd prefix, and it is tracked as CVE 2025 12556 with a CVSS v4 score of 8.7. Users are advised to upgrade to ICM Viewer version v1.7.1 or uninstall the viewer until the patch is applied.
Audited hypervisor kernel escapes in regulated environments — Ring 0 is the real attack surface

www.rack2cloud.com · 6 months ago

Security audits in regulated environments find that most hardening focuses on management planes and guest operating systems while real world guest to host escape chains increasingly pivot through the host kernel, with recent ESXi heap overflow and vmx exit handler vulnerabilities cited. Three primitives consistently underlie successful guest to host escapes: loading unsigned drivers or using DKOM to bypass scheduler controls, memory corruption that defeats KASLR once the kernel base is leaked via side channels, and kernel write primitives. Enforcing strict kernel lockdown and signed modules is often relaxed for legacy agent compatibility, and kernel integrity enforcement such as HVCI or VBS carries a measured CPU impact of about twelve to eighteen percent while appearing to be one of the few effective controls against kernel write primitives after shared memory compromise.
Microsoft announces the 2026 Security Excellence Awards winners

www.microsoft.com · 6 months ago

Microsoft announced the winners of the 2026 Microsoft Security Excellence Awards at an event on January 26, 2026 in Redmond, Washington. Winners included Avertium for Security Trailblazer, BlueVoyant for Data Security and Compliance Trailblazer, Tata Consultancy Services for Secure Access Trailblazer, Anna Bordioug of Protiviti as Security Changemaker, Illumio as Security Software Development Company of the Year, and Invoke LLC as Security Services Partner of the Year.
Social Media Giants Face Landmark Legal Tests on Child Safety

www.nytimes.com · 6 months ago

A series of bellwether trials begins this week testing a new legal theory that Meta, TikTok, Snap and YouTube engineered addictive products that caused personal injury to young users. The first case, brought by a 19 year old identified as K.G.M., alleges features such as infinite scroll, autoplay and algorithmic recommendations led to compulsive use, depression and self harm, and Snap settled before trial while the other companies deny liability. Jury selection for the next trial was scheduled to begin January 27, 2026, and plaintiffs are seeking monetary damages and product design changes that could produce large settlements and reshape platform liability.
WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware

thehackernews.com · 6 months ago

Meta has added a Strict Account Settings mode to WhatsApp to protect targeted users such as journalists and public figures from sophisticated spyware by locking accounts to the most restrictive privacy options. When enabled, attachments and media from people not in a user s contacts are blocked, calls from unknown numbers are silenced, and other settings are restricted to trade some functionality for stronger security. The setting can be enabled from Settings, Privacy, Advanced and is rolling out gradually over the coming weeks. Meta is also adopting the Rust programming language for WhatsApp media sharing and deploying a cross platform library called wamedia while applying control flow integrity, hardened memory allocators, safer buffer handling, and other defenses as part of a memory safety strategy.
Nike investigates data breach after extortion gang leaks files

www.bleepingcomputer.com · 6 months ago

Nike is investigating a potential cybersecurity incident after the World Leaks extortion gang published 1.4 terabytes of files it claims were stolen from the company, alleging nearly 190,000 corporate documents related to business operations. Nike said it takes consumer privacy and data security very seriously and is actively assessing the situation, while independent verification of the leaked material was not available and the leak entry was later removed, suggesting possible negotiations or a ransom payment. World Leaks is believed to be a rebrand of the Hunters International ransomware group, which switched to data theft and extortion only in January 2025 and has previously targeted multiple high profile organizations.
Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities

thehackernews.com · 6 months ago

There are two Pakistan-linked cyber espionage campaigns targeting Indian government entities called Gopher Strike and Sheet Attack, identified in September 2025 and assessed with medium confidence to originate from a Pakistan-linked group that may be distinct from APT36. Sheet Attack abuses legitimate services including Google Sheets, Firebase and email for command and control, while Gopher Strike uses phishing PDFs that display a blurred image and a fake Adobe Acrobat update which only downloads an ISO when requests come from Indian IP addresses and a Windows user agent. The ISO drops a Golang downloader named GOGITTER that creates a VBScript to poll actor controlled command servers every 30 seconds and sets a scheduled task to run every 50 minutes, then retrieves an archive from a private GitHub repository to install a lightweight Golang backdoor that polls a command file to execute commands and upload results, with later stages including additional utilities, a bespoke GOSHELL loader artificially inflated to evade detection and a Cobalt Strike Beacon, and all tools are wiped from the machine after use.
WorldLeaks Extortion Group Claims It Stole 1.4TB of Nike Data

www.darkreading.com · 6 months ago

There are claims that extortion group WorldLeaks exfiltrated more than 1.4 terabytes of Nike data and published roughly 188,347 files, and Nike is investigating a potential cybersecurity incident. The files reportedly span 2020 through 2026 and include R and D assets, technical packs, bills of materials, prototypes, schematics, design files, supply chain and manufacturing documents, factory audits, partner information, production processes, workflows, strategic presentations, employee training materials, and internal videos. Threat intelligence group JustaBreach said WorldLeaks posted the dump after a ransom deadline expired around January 25, 2026, and characterized the exposure as a risk for industrial espionage and value chain extortion that could harm Nike and key partners. So far there is no evidence that personally identifiable information or payment data was exposed.
WorldLeaks Extortion Group Claims It Stole 1.4TB of Nike Data

www.darkreading.com · 6 months ago

WorldLeaks claims to have exfiltrated more than 1.4 terabytes of Nike data, reportedly publishing about 188,347 files after a ransom deadline expired on January 25 at around 6 p.m. GMT. Nike is investigating a potential cybersecurity incident and says it is actively assessing the situation. The leaked material reportedly spans 2020 through 2026 and includes research and development and product creation assets such as technical packs, bills of materials, prototypes, schematics and design files, along with supply chain and manufacturing documents, strategic presentations, training materials and other internal business records. There is no evidence so far that personally identifiable information was exposed, but experts warn the haul could enable industrial espionage, help counterfeiters and illustrates a rising trend of value chain extortion that could put partners and retail chains at risk.
Microsoft’s Patch Fixes Are Breaking Windows, Forcing a Second Emergency Update

www.techrepublic.com · 6 months ago

Microsoft released a Patch Tuesday update on January 13 that caused Remote Desktop sign in failures and shutdown and hibernation problems. An out of band fix on January 17, KB5077744, intended to resolve those issues introduced file system problems affecting OneDrive and Dropbox and caused Outlook to freeze and behave erratically. Microsoft issued a second emergency out of band update on January 24, KB5078127, and urged users to install the latest updates while concerns grow about the quality and reliability of recent patches.
Critical sandbox escape flaw found in popular vm2 NodeJS library

www.bleepingcomputer.com · 6 months ago

A critical severity vulnerability in the vm2 Node.js sandbox library tracked as CVE-2026-22709 allows attackers to escape the sandbox and execute arbitrary code on the underlying host. The issue arises from improper sanitization of Promise callbacks where async functions return a global Promise whose then and catch callbacks are not properly sanitized, enabling a bypass of Promise.prototype.then and Promise.prototype.catch sanitization. Partial fixes were issued in versions 3.10.1 and 3.10.2 and the maintainer says all disclosed issues are fixed in 3.10.3; related past vm2 sandbox escape flaws include CVE-2022-36067 CVE-2023-29017 and CVE-2023-30547.
US charges 31 more suspects linked to ATM malware attacks

www.bleepingcomputer.com · 6 months ago

A Nebraska federal grand jury charged 31 additional defendants for their role in an ATM jackpotting operation allegedly run by members of the Venezuelan gang Tren de Aragua. The indictment includes 32 counts and alleges the group used Ploutus malware to steal millions from U.S. bank ATMs by opening machine housings, installing preloaded hard drives or thumb drives, deleting evidence, and forcing ATMs to dispense cash. Many defendants are Venezuelan and Colombian nationals affiliated with Tren de Aragua, which the U.S. Treasury designated a Foreign Terrorist Organization in December, and authorities say the Justice Department has charged 87 members over six months with potential prison terms ranging from 20 to 335 years if convicted.
Dozens more are charged in Ploutus ATM jackpotting conspiracy

therecord.media · 6 months ago

The Department of Justice announced a federal grand jury indictment charging 31 people in a conspiracy that between February 2024 and December 2025 stole at least 5.4 million dollars from at least 63 ATMs, most of which belonged to credit unions. Investigators say gang members surveilled target ATMs, opened machine doors to test alarms, then removed or replaced hard drives or used thumb drives to deploy Ploutus malware that ordered the machines to dispense cash. Some defendants are alleged members of the Venezuelan gang Tren de Aragua and face charges including conspiracy to commit bank fraud, conspiracy to commit bank burglary and computer fraud, bank fraud, bank burglary and damage to computers, and 56 others were charged in a related sweep last month. Security vendors and U.S. agencies have warned about Ploutus for nearly a decade, noting it was first detected by Symantec in 2013 and has targeted ATM vendors including Diebold Nixdorf and the Kalignite platform.
Nike probes potential cyber incident after hackers claim data leak

therecord.media · 6 months ago

Nike is investigating a potential cybersecurity incident after a hacking group claimed to have leaked a large volume of the companys internal data. The group WorldLeaks said it had posted more than 1.4 terabytes of material allegedly including internal documents, five years of archives, and information on supply chain and manufacturing, but the data has not been independently verified and it is unclear whether customer data are involved. WorldLeaks is believed to be a rebranding of the now defunct Hunters International operation and security researchers have suggested some administrators may have ties to the Hive ransomware operation, while Nike declined to say whether it had received ransom demands or been contacted by the attackers. The report notes the claim comes amid similar incidents affecting sportswear companies, with Under Armour also investigating allegations that millions of customer records were posted online.
Memcyco Raises $37 Million for Anti-Impersonation Technology

www.securityweek.com · 6 months ago

Memcyco raised 37 million dollars in an oversubscribed Series A round, bringing its total funding to 47 million dollars. The round was led by E. Leon Jimenes, NAventures, and Pags Group with participation from Capri Ventures and Venture Guides, and the company will use the funds to expand its agentless anti impersonation platform globally with a focus on Latin America. Founded in 2021 and based in Boston and Tel Aviv, Memcyco uses covert agentless technology to provide visibility into victim and attacker behavior to predict and disrupt account takeover and brand impersonation attacks before credential theft or fraud occur.
As Tech Chiefs Woo Trump, Silicon Valley Seethes Over Minneapolis Shootings

www.nytimes.com · 6 months ago

Executives, investors and engineers are publicly condemning the Trump administration after the killings of Alex Pretti and another protester, in actions compared to Silicon Valley mobilizations from a decade ago. More than 450 tech workers have signed an open letter urging CEOs to press the White House to withdraw ICE from cities and to cancel corporate contracts with the agency, while prominent technology figures have posted strong condemnations on social media. The deaths have sparked nationwide protests, calls for independent investigations and mounting political pressure over the federal deployment in Minnesota.
G.M. Shares Rise as Investors Are Encouraged by 2026 Prospects

www.nytimes.com · 6 months ago

General Motors announced a new stock buyback program for up to six billion dollars and increased its quarterly dividend. The company said it expects profit to rise this year after pulling back from electric vehicle production and booking about six billion dollars in EV related charges that weighed on recent results. Management highlighted stronger demand for full size pickups and SUVs and guided to higher adjusted earnings and automotive cash flow for the year. Investors reacted positively to the capital return and the companys renewed focus on traditional vehicles.
4 Probleme, die CISOs behindern

www.csoonline.com · 6 months ago

There are four strategic problems impeding chief information security officers: insufficient empowerment of staff to make priority decisions, inability to keep pace with artificial intelligence innovation, limited adoption of AI to strengthen security operations, and a shortage of required cyber talent and skills. Survey findings show growing alarm, with about seventy six percent of CISOs expecting a major cyberattack within the next twelve months and fifty eight percent judging their organizations unprepared, while roughly eighty percent report high or extreme pressure and sixty seven percent experience weekly or daily burnout. Most organizations use AI but lack visibility and governance for those systems, only twenty eight percent have integrated AI into security operations, and leaders report urgent skill gaps in AI expertise, cloud security, risk assessment and application security.
From Cipher to Fear: The psychology behind modern ransomware extortion

www.bleepingcomputer.com · 6 months ago

Ransomware has shifted from file encryption to industrial-scale extortion that weaponizes stolen data, legal liability, and psychological pressure, carried out by a fragmented affiliate ecosystem including groups such as Qilin, Akira, SafePay, INC, Lynx, Cl0p, DragonForce, and RansomHub. Attackers deploy scripted pressure tactics like claims of surveillance, artificial deadlines, legal and reputational threats, internal blame, and friction reduction, while low-tech campaigns exploiting internet-exposed databases continue to scale rapidly. Defenses recommended include prepositioning legal and communications teams, organization-wide training against coercion, prioritizing vulnerability remediation with threat intelligence to focus on actively exploited CVEs for example CVE-2024-1234 and CVE-2025-5678, and targeted configuration audits of high-yield internet-facing misconfigurations.
Over 100 Organizations Targeted in ShinyHunters Phishing Campaign

www.securityweek.com · 6 months ago

Security firm Silent Push identified domains suggesting threat actors prepared or conducted attacks against over 100 organizations across sectors including software, biotech, financial services, real estate, energy, healthcare, logistics, manufacturing, retail, and insurance. Fake domains impersonated companies such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, GameStop, WeWork, Halliburton, Sonos, and Telstra, though it is unclear whether the attempts led to successful breaches. Attackers used voice phishing to target single sign on accounts tied to Okta and other identity platforms, deploying phishing kits with client side scripts that allow real time control of the authentication flow to intercept credentials and trick victims into approving push notifications or submitting one time passcodes to bypass multi factor authentication. The campaign is publicly claimed by ShinyHunters and has been attributed by researchers to a group called Scattered LAPSUS Hunters, and the actors have posted alleged stolen records from some victims.
ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

thehackernews.com · 6 months ago

There is a new campaign that uses fake CAPTCHA ClickFix prompts combined with a signed Microsoft App V script to deliver the Amatera information stealer. Attackers abuse SyncAppvPublishingServer.vbs to proxy PowerShell execution through a trusted signed component, fetch a staged loader that reads configuration from a public Google Calendar ICS file, and then retrieve a PNG from content delivery networks that hides an encrypted compressed PowerShell payload which is decrypted and executed in memory to launch Amatera. The technique targets Enterprise and Education Windows installations where App V is present, avoids common execution paths, performs sandbox checks, and leverages trusted third party services to evade detection.
Over 6,000 SmarterMail servers exposed to automated hijacking attacks

www.bleepingcomputer.com · 6 months ago

There are over 6,000 SmarterMail servers exposed online and likely vulnerable to a critical authentication bypass in the password reset API that allows unauthenticated attackers to reset administrator passwords and achieve full administrative compromise and remote code execution. The flaw was reported to SmarterTools on January 8, 2026, a fix was released on January 15, 2026, and the issue was assigned CVE-2026-23760 after researchers released a proof of concept and observed exploitation in the wild around January 21, 2026. Shadowserver and independent scans identified thousands of potentially vulnerable instances and the Cybersecurity and Infrastructure Security Agency added CVE-2026-23760 to its actively exploited vulnerabilities list, directing federal agencies to secure affected servers by February 16, 2026. This incident follows an earlier critical pre authentication SmarterMail vulnerability tracked as CVE-2025-52691 and security firms warn that observed activity indicates mass automated hijacking attacks.
Russian security systems firm Delta hit by cyberattack, services disrupted

therecord.media · 6 months ago

A cyberattack disrupted operations at Delta, a Russian provider of alarm and security systems for homes, businesses and vehicles, causing widespread service outages and a wave of customer complaints. Delta said the attack was large scale, coordinated and well organized and originated from an unspecified hostile foreign state, with the company reporting temporary disruptions while its technical team worked to restore systems and saying there was no evidence of customer data compromise. Customers reported car alarms that would not turn off, vehicles that could not be unlocked, remote start systems failing, doors locking unexpectedly, engines shutting down while in motion, and building alarm systems switching to emergency mode and becoming impossible to deactivate, while an unidentified Telegram channel published an alleged archive of stolen data that could not be verified. Delta communicated with customers via its page on the social media platform VKontakte after its website and phone lines went offline, and the outage coincided with a separate IT disruption affecting Russian airlines and airports.
‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks

www.securityweek.com · 6 months ago

There are half a dozen vulnerabilities in the NPM, PNPM, VLT, and Bun package managers that can bypass defenses intended to prevent automatic script execution and to verify package integrity, potentially enabling remote code execution. The flaws include a malicious.npmrc delivered via Git dependencies for NPM, PNPM disabling scripts only during the build phase but not for Git dependencies, a path traversal in VLT tarball extraction allowing arbitrary file writes, Bun applying its script allow list to package names but not sources, and PNPM and VLT storing only tarball URLs and not integrity hashes which permits tampering. The PNPM and VLT bugs are tracked as CVE-2025-69263 and CVE-2025-69264, PNPM, VLT, and Bun were patched within weeks, and the remaining report was closed as informative by NPM while security researchers warned that attackers have been discussing proof of concept code.
G_Wagon NPM Package Exploits Users to Steal Browser Credentials with Obfuscated Payload

gbhackers.com · 6 months ago

A highly sophisticated infostealer named GWagon is masquerading as the ansi-universal-ui npm package and was detected on January 23, 2026. The Python based malware uses multi stage obfuscation, memory only execution by fetching base64 encoded payloads and piping them to the Python interpreter, and a self dependency trick that causes postinstall hooks to run twice, with the threat actor releasing ten versions between January 21 and January 23 that added anti forensics and cleanup features. It targets Chrome, Edge and Brave on Windows and macOS to harvest cookies and decrypt saved passwords via Windows DPAPI, exfiltrates data from over one hundred browser wallet extensions including MetaMask Phantom Coinbase Wallet Trust Wallet Ledger Live and Exodus, copies cloud SDK credential files for AWS Azure and Google Cloud along with SSH keys and Kubernetes configuration files, and also steals messaging tokens and gaming authentication files. Stolen data is compressed and uploaded to Appwrite storage buckets in New York and Frankfurt with large files chunked into five megabyte pieces, and affected users are advised to remove ansi universal ui, rotate browser passwords, revoke crypto wallet credentials, regenerate cloud keys and invalidate messaging sessions.
CISA releases technology readiness list for post-quantum cryptography

www.csoonline.com · 6 months ago

CISA has issued an advisory mapping post-quantum cryptography standards to common enterprise hardware and software categories to help CIOs and security teams assess quantum-safe readiness following a June 6, 2025 executive order on federal cybersecurity. The advisory lists product categories already using or transitioning to NIST-standard PQC algorithms, including cloud services, collaboration software, web browsers and servers, and endpoint security, and it highlights networking hardware, SaaS, telecommunications hardware, computers, storage area networks, identity and access management hardware, password managers, and antivirus as adoption candidates. The agency warns that no category is fully quantum-resistant because most implementations support PQC key encapsulation and key agreement such as ML KEM based on CRYSTALS KYBER but have not widely implemented quantum-resistant digital signature and authentication standards like ML DSA rooted in CRYSTALS Dilithium and SLH DSA derived from SPHINCS plus under FIPS 203 through 205. The guidance is intended to inform procurement and long-term migration planning for federal civilian agencies and notes that operational technology and internet of things devices should also transition to PQC but were out of scope for the lists.
Hand CVE Over to the Private Sector

www.darkreading.com · 6 months ago

There is criticism that the Common Vulnerabilities and Exposures program created in 1999 has been mismanaged by MITRE for decades, with the database launched with 321 records despite more than 3,700 known vulnerabilities at the time. Criticisms focus on MITRE's federally funded research and development center funding model and no-bid contracting, slow assignment of CVE identifiers, and a late adoption of a policy for cloud and software as a service vulnerabilities in 2024. Funding for the program rose to about 29 million dollars in 2024 and 2025, a figure that amounted to about 664 dollars per CVE during a contract period and has prompted calls for a Government Accountability Office review. An early identifier cited is CVE-1999-0167, and prior public vulnerability databases maintained by companies such as ISS already provided broader coverage before CVE's launch.
UK plans sweeping overhaul of policing amid surge in online crimes

therecord.media · 6 months ago

There are proposals from the British Home Office to create a new National Police Service, described by officials as Britain s equivalent of the FBI, which would centralize responsibility for serious non local crimes such as cybercrime, fraud and counterterrorism and fold the National Crime Agency into the new force. Officials say about ninety percent of crime now involves a digital element and that fraud accounts for roughly forty four percent of recorded offences, and the plan includes a National Centre for AI in Policing backed by one hundred and fifteen million pounds over three years, greater use of artificial intelligence for investigations, and expanded facial recognition to help clear a backlog of around twenty thousand devices awaiting digital forensic examination. An independent review due in summer two thousand twenty six will determine how regional and national units are merged, and the government says it will legislate for stronger oversight including a public registry of AI systems used by police amid criticism and concerns about the expanded use of surveillance technology and policing of lawful online speech.
Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI

www.securityweek.com · 6 months ago

Quantum computers are expected to eventually run Shor's algorithm and defeat current public key cryptography such as RSA and ECC, which is driving harvest now decrypt later campaigns where adversaries steal encrypted data today to decrypt in the future. Timelines are uncertain but experts report roadmaps have shifted left with many predicting the capability to break asymmetric cryptography within about five years, and industry voices urge organizations to begin migrating to post quantum cryptography immediately, with 2026 cited as a deadline to start. The possible convergence of powerful quantum computing and advanced artificial intelligence raises the prospect of automated, quantum accelerated attacks that could outpace human defenders as well as quantum enhanced defensive tools, prompting calls for post quantum encryption, zero trust, autonomous key management, and machine speed protections.
Chrome, Edge Extensions Caught Stealing ChatGPT Sessions

www.securityweek.com · 6 months ago

There are 16 malicious browser extensions, 15 published to the Chrome Web Store and one to the Microsoft Edge Add-ons marketplace, marketed as ChatGPT enhancement and productivity tools with a combined download count of over 900 and remaining available as of January 26, 2026. The extensions inject content scripts into chatgpt.com that execute in the MAIN JavaScript world to monitor outbound requests, extract authorization headers and session authentication tokens, and exfiltrate them to a remote server, allowing the attacker to authenticate to victims’ ChatGPT services and obtain chat history and connectors. The tools also exfiltrate extension metadata, usage telemetry and backend access tokens, and analysis of shared code, icons and descriptions indicates a single threat actor is likely responsible while the technique remains difficult to detect with traditional endpoint or network security tools.
Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts

www.bleepingcomputer.com · 6 months ago

There was a breach of SoundCloud discovered in December 2025, confirmed on December 15, that allowed attackers to access an ancillary service dashboard and caused some users to see 403 errors when connecting via VPN. The incident exposed personal and contact details for about 29.8 million accounts, including email addresses, names, usernames, avatars, follower and following counts, and in some cases country or geographic location, while SoundCloud reported no access to passwords or financial data. The ShinyHunters extortion group carried out the attack, attempted to extort SoundCloud with demands and email flooding, and later publicly released the harvested data.
The Constitutionality of Geofence Warrants

www.schneier.com · 6 months ago

The US Supreme Court is considering the constitutionality of geofence warrants. The case concerns Okello Chatrie, who pleaded guilty to a 2019 robbery after police used a geofence warrant to obtain anonymized Google location data that led to three subscriber records, one of which was Chatrie. Police subsequently searched his home and allegedly seized a gun, almost one hundred thousand dollars in cash, and incriminating notes. Chatrie’s appeal contends that geofence warrants violate Fourth Amendment protections against unreasonable searches.
Overcoming AI fatigue

www.csoonline.com · 6 months ago

There is a clear spectrum of AI risk: generative AI responds to prompts and mainly risks data leakage and intellectual property exposure, while agentic AI can take autonomous actions and poses much greater operational and safety risks. Data integrity is foundational because compromised or incomplete data can lead AI systems to make harmful decisions that affect finances, supply chains, customer interactions, or physical safety. CISOs have a narrow window to set guardrails before autonomous systems become entrenched, giving security leaders more influence than in past technology waves. A practical governance approach is tiered risk categorization by autonomy and impact, consistent baseline controls such as enforceable acceptable use policies, training, monitoring and technical safeguards, a cross functional review forum, and non negotiable rules like human oversight, least privilege, zero trust and reliable kill switches for high risk agentic systems.
CTEM in Practice: Prioritization, Validation, and Outcomes That Matter

thehackernews.com · 6 months ago

Organizations are adopting Continuous Threat Exposure Management to move beyond isolated threat and vulnerability assessments and focus on exposures that are exploitable in their actual environments. CTEM, as defined by Gartner, is a continuous cycle of scoping, discovery, prioritization, validation, and mobilization designed to identify and remediate exposures attackers can realistically exploit. Threat intelligence and Priority Intelligence Requirements are central because more than 40,000 vulnerabilities were reported in 2024 and fewer than ten percent are ever exploited, so teams must prioritize flaws tied to observed adversary tactics. Validation through controlled attack simulations and improvements to people and processes is necessary to ensure defenses work, and CTEM requires top level leadership to break silos and define a scoped, measurable program focused on reducing cyber risk.
CISA Urges Public to Stay Alert Against Rising Natural Disaster Scams

gbhackers.com · 6 months ago

CISA warns of heightened malicious cyber activity targeting natural disaster victims, reporting that threat actors use social engineering such as phishing emails with malicious links or attachments, fraudulent charity appeals on social media and text messages, and door to door solicitations to exploit affected populations' emotional vulnerability. The agency advises verifying disaster guidance through trusted authorities including local officials, FEMA, and DHS Ready, and recommends consulting resources from the Federal Trade Commission and the Consumer Financial Protection Bureau to avoid scams. Individuals should exercise caution before clicking links or sharing personal or financial information and should report suspected fraud to appropriate authorities.
ShinyHunters Group Targets Over 100 Enterprises, Including Canva, Atlassian, and Epic Games

gbhackers.com · 6 months ago

There is a surge in infrastructure deployment mirroring the tactics of a predatory supergroup combining Scattered Spider, LAPSUS, and ShinyHunters. A human-led identity theft campaign is targeting Single Sign-On platforms, particularly Okta, across more than 100 high-value enterprises and relies on voice phishing to bypass multifactor authentication. Attackers use a live phishing panel to intercept credentials and MFA tokens in real time, pivot to internal collaboration tools to escalate privileges, and combine data theft with encryption and ransom demands. Recommended countermeasures include alerting support staff, conducting forensic audits of Okta logs for new device enrollments followed by unfamiliar IP activity, and deploying DNS-level defenses to block lookalike domains before infrastructure becomes operational.
Critical vm2 Flaw Lets Attackers Bypass Sandbox and Execute Arbitrary Code in Node.js

gbhackers.com · 6 months ago

There is a critical vulnerability in the vm2 JavaScript sandbox affecting versions up to 3.10.0 that enables attackers to bypass sandbox protections and execute arbitrary code with full system privileges. The flaw exploits improper sanitization of Promise callback functions by abusing inconsistencies between local Promise.prototype.then and the global Promise returned by async functions, allowing attackers to use Symbol properties on error objects to trigger async execution, expose the unsanitized then method, and gain access to the Error constructor Function prototype to run system commands such as via the child process module. The issue is tracked as CVE-2026-22709 with a CVSS score of 9.8 and advisory GHSA-99p7-6v5w-7xg8, it affects around 273,000 npm projects, and it is patched in vm2 version 3.10.2 with no viable workarounds so immediate updating is required.