It's been a busy 24 hours in the cyber world with significant updates on actively exploited vulnerabilities, evolving social engineering tactics, and some notable cyberattacks. Let's dive in:

London Boroughs Still Recovering Months After Cyberattack 🏙️
- Hammersmith & Fulham Council is slowly restoring services, two months after a cyberattack affected multiple London boroughs. Online payments have resumed, but some account balances may not be current.
- Westminster City Council and Kensington & Chelsea also remain impacted, with the latter confirming criminal intent and data compromise, and warning that full system restoration could take months.
- This incident highlights the ongoing threat to local authorities, with the NCSC recently warning about pro-Russia hacktivist attacks causing costly disruption to such targets.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/23/landmark_milestone_as_hammersmith_fulham/

Dresden Museum Network Hit by Cyberattack 🖼️
- Germany's Dresden State Art Collections (SKD), one of Europe's oldest museum networks, has suffered a targeted cyberattack that disrupted significant parts of its digital infrastructure.
- The attack, discovered on Wednesday, has limited digital and phone services, with online ticket sales and the museum shop unavailable, and on-site payments restricted to cash.
- While security systems protecting the collections remain intact, the incident underscores a growing trend of cultural institutions becoming targets for cybercriminals, as seen with recent attacks on national art museums and libraries.

🗞️ The Record | https://therecord.media/dresden-state-art-collections-cyberattack

ATM Jackpotting Ring Busted in US 💰
- Two Venezuelan nationals have been convicted and will be deported for an ATM jackpotting scheme that stole hundreds of thousands of dollars from US banks across several states.
- The attackers connected laptops to older ATM models and installed Ploutus malware to bypass security protocols, forcing machines to dispense all available cash directly from the banks.
- This operation is linked to a larger conspiracy, with Nebraska authorities indicting 54 individuals, including alleged leaders of the Venezuelan Tren de Aragua gang, for similar multi-million dollar thefts.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/us-to-deport-venezuelans-who-emptied-bank-atms-using-malware/

Vishing and AitM Phishing Attacks on the Rise 🎣
- Okta has warned about custom vishing (voice phishing) kits, sold as a service, actively targeting Okta, Google, and Microsoft SSO accounts, as well as cryptocurrency platforms.
- These kits feature adversary-in-the-middle (AitM) capabilities, allowing attackers to manipulate phishing page content in real-time during a call, effectively bypassing push-based MFA, including number matching.
- Microsoft also reported a multi-stage AitM phishing and BEC campaign targeting energy firms, abusing SharePoint for phishing payloads and creating inbox rules for persistence and evasion. Post-compromise, attackers leverage stolen session cookies and internal identities for large-scale intra-organizational and external phishing.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/okta-sso-accounts-targeted-in-vishing-based-data-theft-attacks/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/22/crims_sell_voice_phishing_kits/
🚨 The Hacker News | https://thehackernews.com/2026/01/microsoft-flags-multi-stage-aitm.html

RMM Tools Weaponised for Persistent Access 🛠️
- A new dual-vector campaign is leveraging stolen credentials to deploy legitimate Remote Monitoring and Management (RMM) software, specifically LogMeIn Resolve, for persistent remote access.
- The attack starts with fake Greenvelope invitation emails to harvest Microsoft Outlook, Yahoo!, or AOL.com login details. These stolen credentials are then used to register with LogMeIn and generate RMM access tokens.
- A malicious executable, "GreenVelopeCard.exe," signed with a valid certificate, silently installs LogMeIn Resolve, alters its service settings for unrestricted access, and creates hidden scheduled tasks to maintain persistence.

🚨 The Hacker News | https://thehackernews.com/2026/01/phishing-attack-uses-stolen-credentials.html

Malicious AI Extensions Steal Developer Data 💻
- Two malicious extensions in Microsoft's Visual Studio Code (VSCode) Marketplace, "ChatGPT – 中文版" (1.34M installs) and "ChatMoss (CodeMoss)" (150k installs), are exfiltrating developer data to China-based servers.
- Part of a campaign dubbed 'MaliciousCorgi,' these extensions, while providing advertised AI coding assistance, covertly monitor and transmit the entire contents of opened files, including changes, encoded in Base64.
- They also perform server-controlled harvesting of up to 50 files from a victim's workspace and use commercial analytics SDKs (Zhuge.io, GrowingIO, TalkingData, Baidu Analytics) for user profiling and device fingerprinting, exposing sensitive source code, configuration files, and credentials.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/malicious-ai-extensions-on-vscode-marketplace-steal-developer-data/

Fortinet FortiGate SSO Flaw Still Exploitable ⚠️
- Fortinet has confirmed that a critical FortiCloud SSO authentication bypass vulnerability (CVE-2025-59718), supposedly patched in December, is still being actively exploited via a new attack path.
- Threat actors are compromising fully patched FortiGate firewalls, creating generic accounts with VPN access, and exfiltrating firewall configurations within seconds, indicating automated activity.
- Fortinet advises customers to restrict administrative access to management interfaces, disable the FortiCloud SSO feature, and rotate all credentials if any indicators of compromise are detected, as the issue applies to all SAML SSO implementations.

👁️ Dark Reading | https://www.darkreading.com/cloud-security/fortinet-firewalls-malicious-configuration-changes
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fortinet-confirms-critical-forticloud-auth-bypass-not-fully-patched/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/23/fortinet_fortigate_patch/

Pwn2Own Automotive Uncovers 76 Zero-Days 🚗
- The Pwn2Own Automotive 2026 competition concluded with security researchers earning over $1 million for exploiting 76 zero-day vulnerabilities in automotive technologies.
- Targets included in-vehicle infotainment (IVI) systems, electric vehicle (EV) chargers, and car operating systems like Automotive Grade Linux.
- Vendors have 90 days to patch these newly disclosed flaws before TrendMicro's Zero Day Initiative publicly releases the details.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-get-1-047-000-for-76-zero-days-at-pwn2own-automotive-2026/

CISA Adds Four Actively Exploited Bugs to KEV 🚨
- CISA has updated its Known Exploited Vulnerabilities (KEV) catalog with four actively exploited flaws impacting enterprise software. Federal Civilian Executive Branch (FCEB) agencies must patch these by February 12, 2026.
- The vulnerabilities include a PHP remote file inclusion in Synacor Zimbra Collaboration Suite (CVE-2025-68645), an authentication bypass in Versa Concerto SD-WAN (CVE-2025-34026), and an improper access control flaw in Vite Vitejs (CVE-2025-31125).
- Also added is CVE-2025-54313, an embedded malicious code vulnerability in `eslint-config-prettier`, stemming from a supply chain attack that hijacked several npm packages to deliver an information stealer.

🚨 The Hacker News | https://thehackernews.com/2026/01/cisa-updates-kev-catalog-with-four.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-confirms-active-exploitation-of-four-enterprise-software-bugs/

Critical Telnetd Auth Bypass Exploited for Root Access 🔓
- A coordinated campaign is exploiting CVE-2026-24061, an 11-year-old critical authentication bypass vulnerability in the GNU InetUtils telnetd server.
- The flaw allows attackers to gain root access by leveraging unsanitized environment variable handling, specifically by setting the USER variable to "-f root" when connecting via telnet.
- While Telnet is a legacy component, its prevalence in industrial, legacy, and embedded devices (IoT/OT) makes this easily exploitable bug a concern, with GreyNoise observing automated and some "human-at-keyboard" exploitation attempts.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-telnetd-auth-bypass-flaw-to-get-root/

Chinese Electric Buses Raise National Security Concerns 🚌
- Australia's government is reviewing whether Chinese-made Yutong electric buses, currently in use in major cities, pose a national security risk due to potential remote control capabilities.
- Research from Oslo's public transport authority found that Yutong maintains an over-the-air (OTA) connection, allowing the manufacturer remote access to the Controller Area Network (CAN) bus, which controls driving systems.
- While no "kill switch" or invasive data collection was explicitly found, the inherent risks of connected IoT devices, coupled with China's national intelligence laws, raise concerns about data exfiltration, surveillance, or broader fleet compromise.

👁️ Dark Reading | https://www.darkreading.com/cyber-risk/chinese-electric-buses-aussie-govt

AI-Powered Cyberattack Kits on the Horizon 🤖
- Google's VP of Security Engineering, Heather Adkins, warns CISOs to prepare for a "really different world" where cybercriminals will reliably automate cyberattacks at scale using AI.
- While currently used for small tasks like phishing copy and C2 development, it's "just a matter of time" before full, end-to-end AI toolkits emerge, potentially leading to a "Metasploit moment" for AI-driven threats.
- This shift could mean attackers gain a significant first-mover advantage, forcing defenders to redefine success not by preventing breaches, but by limiting dwell time and damage, potentially through real-time, AI-enabled defensive disruptions.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/23/ai_cyberattack_google_security/

Microsoft Provided BitLocker Keys to FBI 🔒
- Microsoft reportedly provided the FBI with BitLocker encryption keys to unlock laptops of Windows users charged in a fraud indictment, marking the first publicly known instance of such disclosure.
- By default, Microsoft "typically" backs up BitLocker recovery keys to its servers when the service is set up with an active Microsoft account, giving Redmond access to these keys.
- This highlights a trade-off between data recoverability and privacy, as users who choose to store keys with Microsoft relinquish total control over access to their encrypted data, a stark contrast to Apple's Advanced Data Protection where Apple holds fewer keys.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/23/surrender_as_a_service_microsoft/

Ireland to Legalise Law Enforcement Spyware 🇮🇪
- The Irish government plans to draft legislation to legalise the use of spyware by law enforcement to combat serious crime and security threats.
- The proposed bill would require court authorisation for interception requests and include provisions for electronic scanning equipment to track mobile device identifier data.
- This move aims to strengthen "lawful interception powers" and create a legal basis for "covert surveillance software," with robust safeguards promised to ensure necessity and proportionality.

🗞️ The Record | https://therecord.media/ireland-plans-law-enforcement-spyware

#CyberSecurity #ThreatIntelligence #Vulnerabilities #ActiveExploitation #ZeroDay #Phishing #Vishing #AitM #SocialEngineering #Malware #RMM #SupplyChain #DataPrivacy #Fortinet #CISA #KEV #IoT #AI #NationalSecurity #Geopolitics #InfoSec #CyberAttack #IncidentResponse

AIs are Getting Better at Finding and Exploiting Internet Vulnerabilities

Really interesting blog post from Anthropic:
In a recent evaluation of AI models’ cyber capabilities, current Claude models can now succeed at multistage attack... https://www.schneier.com/blog/archives/2026/01/ais-are-getting-better-at-finding-and-exploiting-internet-vulnerabilities.html

#penetrationtesting #vulnerabilities #AI

Not all threat intelligence tells the same story.

🍯Honeypots show internet noise. Production telemetry shows what attackers actually do when real businesses are on the line.

Understanding the difference is the key to actionable security.

Learn more in our latest article 👉 https://crowdsec.net/blog/honeypots-vs-production-telemetry-what-cisos-should-trust

#threatintelligence #honeypots #vulnerabilities #cybersecurity

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got some major breaches, a new AI-assisted Linux malware framework, critical vulnerabilities in popular software and automotive systems, and some serious discussions around ransomware negotiation ethics and government surveillance. Let's dive in:

Under Armour Data Breach ⚠️

- Have I Been Pwned (HIBP) has ingested data from an alleged Everest ransomware attack in November, affecting 72.7 million Under Armour accounts.
- The leaked data includes names, email addresses, dates of birth, genders, geographic locations, and purchase details.
- Under Armour has yet to publicly acknowledge the breach, despite Everest's claims and a class-action lawsuit filed on behalf of customers.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/21/under_armour_everest/

PcComponentes Credential Stuffing Attack 🔒

- Spanish tech retailer PcComponentes denies claims of a 16.3 million customer data breach but confirms a credential stuffing attack.
- Their investigation found no unauthorised access to internal systems, but info-stealer logs from other breaches were used to compromise a "small number" of accounts.
- As a response, PcComponentes has enforced mandatory two-factor authentication (2FA) for all accounts, invalidated active sessions, and added CAPTCHA to login pages.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/online-retailer-pccomponentes-says-data-breach-claims-are-fake/

LastPass Phishing Campaign 🎣

- LastPass is warning users about an active phishing campaign impersonating the password manager, urging them to "create a local backup" of their vaults due to "upcoming maintenance."
- These emails, sent from suspicious addresses with urgent subject lines, redirect users to phishing sites designed to steal their master passwords.
- LastPass stresses they will never ask for a master password and advises users to report suspicious emails to abuse@lastpass.com, noting that the campaign was timed over a US holiday weekend to reduce detection.

📰 The Hacker News | https://thehackernews.com/2026/01/lastpass-warns-of-fake-maintenance.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fake-lastpass-emails-pose-as-password-vault-backup-alerts/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/21/lastpass_backup_phishing_campaign/
👁️ Dark Reading | https://www.darkreading.com/application-security/phishing-campaign-zeroes-lastpass-customers

CrashFix Malware Leverages Browser Crashes for Corporate Infiltration 💥

- A new "CrashFix" variant of the ClickFix scam, attributed to the KongTuke threat actor, intentionally crashes victims' browsers via a malicious extension (NexShield).
- It then presents a fake security message prompting users to run a "fix," which executes a PowerShell script to contact a C2 server.
- Domain-joined corporate systems receive ModeloRAT, a Python-based remote access Trojan with extensive reconnaissance capabilities, while home users appear to be part of a testing phase.

👁️ Dark Reading | https://www.darkreading.com/cyberattacks-data-breaches/crashfix-scam-crashes-browsers-delivers-malware

VoidLink Linux Malware & AI's Impact on Cybercrime 🤖

- The sophisticated Linux malware framework, VoidLink, is believed to have been predominantly developed by a single actor with significant AI assistance, reaching 88,000 lines of code in under a week.
- Check Point Research identified operational security blunders, including TRAE-generated helper files and LLM-generated internal planning documents, suggesting a "Spec Driven Development" approach using AI agents.
- This highlights how AI is industrialising cybercrime, lowering the barrier to entry for complex attacks and enabling threat actors to rapidly envision, create, and iterate sophisticated systems, as also noted by Group-IB.

📰 The Hacker News | https://thehackernews.com/2026/01/voidlink-linux-malware-framework-built.html

Black Basta Ringleader Identified 🚨

- Oleg Evgenievich Nefedov, 35, has been publicly identified by German police as the alleged leader of the Black Basta ransomware group and added to Europol and Interpol's most-wanted lists.
- This identification follows raids in Ukraine on the homes of two other Russian nationals accused of participating in Black Basta's crimes, seizing data and cryptocurrency.
- Nefedov is accused of extorting over 100 companies in Germany and 600 globally, with authorities suggesting prior involvement with the Conti ransomware group.

🤫 CyberScoop | https://cyberscoop.com/black-basta-leader-europol-most-wanted-list/

SMS Blaster Scams: Fake Cell Towers in Cars 🚗

- Greek police arrested suspects using a fake cell tower hidden in a car trunk to send mass phishing messages across Athens.
- The device, an "SMS blaster," mimicked legitimate telecom infrastructure, forcing nearby phones to downgrade to less secure 2G networks to harvest data.
- Attackers then sent phishing links, posing as banks or couriers, to steal payment card details, a tactic previously seen in Thailand, Indonesia, Qatar, and the UK, often using similar Chinese-manufactured equipment.

🗞️ The Record | https://therecord.media/greek-police-arrest-scammers-using-hidden-cell-towers/

Fortinet FortiGate Patch Bypass Under Active Exploitation 🛡️

- Fortinet customers are reporting that patched FortiGate firewalls (FortiOS 7.4.9 and 7.4.10) are still vulnerable to a patch bypass for CVE-2025-59718, a critical SSO authentication flaw.
- Attackers are exploiting this by creating local admin accounts via malicious SSO logins, similar to previous attacks seen in December 2025.
- Fortinet is reportedly preparing new FortiOS versions (7.4.11, 7.6.6, 8.0.0) to fully address the issue; until then, admins are advised to disable the FortiCloud login feature if enabled.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/fortinet-admins-report-patched-fortigate-firewalls-getting-hacked/

ACF Extended WordPress Plugin RCE 🌐

- A critical vulnerability (CVE-2025-14533) in the Advanced Custom Fields: Extended (ACF Extended) WordPress plugin allows unauthenticated attackers to gain administrative privileges.
- The flaw, affecting versions 0.9.2.1 and earlier, stems from a lack of role restriction enforcement during form-based user creation/updates, even when role limitations are configured.
- Roughly 50,000 sites remain exposed, and while no active exploitation of this specific flaw has been observed, large-scale WordPress plugin reconnaissance activity is ongoing, targeting other known vulnerabilities.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/acf-plugin-bug-gives-hackers-admin-on-50-000-wordpress-sites/

GitLab Patches 2FA Bypass and DoS Flaws 💻

- GitLab has released patches for high-severity vulnerabilities, including a two-factor authentication (2FA) bypass (CVE-2026-0723) and multiple denial-of-service (DoS) flaws.
- The 2FA bypass allows attackers with knowledge of a victim's credential ID to circumvent multi-factor authentication by submitting forged device responses.
- Admins are strongly advised to upgrade self-managed GitLab installations to versions 18.8.2, 18.7.2, or 18.6.4 immediately to address these issues.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/gitlab-warns-of-high-severity-2fa-bypass-denial-of-service-flaws/

Chainlit AI Framework Flaws Enable Data Theft and SSRF 🤖

- High-severity "ChainLeak" vulnerabilities (CVE-2026-22218, CVE-2026-22219) were found in the open-source Chainlit AI framework, allowing arbitrary file reads and Server-Side Request Forgery (SSRF).
- These flaws can be combined to steal sensitive data, leak cloud environment API keys, and enable lateral movement within an organisation.
- Patches were released in Chainlit version 2.9.4, highlighting how traditional software vulnerabilities are now being embedded into AI infrastructure, creating new attack surfaces.

📰 The Hacker News | https://thehackernews.com/2026/01/chainlit-ai-framework-flaws-enable-data.html

Microsoft MarkItDown MCP Server Vulnerability ☁️

- A vulnerability dubbed "MCP fURI" in Microsoft's MarkItDown Model Context Protocol (MCP) server allows arbitrary calling of URI resources, leading to privilege escalation, SSRF, and data leakage.
- This flaw affects the server when running in AWS EC2 instances using IDMSv1, potentially allowing attackers to obtain instance credentials and access AWS accounts.
- BlueRock's analysis found over 36.7% of 7,000 MCP servers are likely exposed; mitigation includes using IMDSv2, private IP blocking, and restricting metadata service access.

📰 The Hacker News | https://thehackernews.com/2026/01/chainlit-ai-framework-flaws-enable-data.html

`binary-parser` npm Library Bug Allows Node.js RCE ⚙️

- A security vulnerability (CVE-2026-1245) in the popular `binary-parser` npm library allows for arbitrary JavaScript execution with Node.js process privileges.
- The flaw stems from a lack of sanitisation of user-supplied values when JavaScript parser code is dynamically generated at runtime using the "Function" constructor.
- Users of `binary-parser` are advised to upgrade to version 2.3.0 and avoid passing untrusted input into parser field names or encoding parameters.

📰 The Hacker News | https://thehackernews.com/2026/01/certcc-warns-binary-parser-bug-allows-node.js-privilege-level-code-execution.html

Cloudflare WAF Bypass Bug Fixed 🛡️

- Cloudflare has patched a logic flaw in its ACME (Automatic Certificate Management Environment) validation that allowed attackers to bypass its Web Application Firewall (WAF) and directly access origin servers.
- The "side door" was caused by the WAF disabling features for ACME challenge tokens without verifying the token matched an active challenge for the hostname.
- While no evidence of in-the-wild exploitation was found, researchers warn that such WAF bypasses could become more dangerous with AI-driven attacks.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/cloudflare_fixes_acme_validation/

EU Proposes Phasing Out "High-Risk" Telecom Suppliers 🇪🇺

- The European Commission (EC) is proposing a revised Cybersecurity Act that could force member states to phase out IT and telecoms kit from "high-risk suppliers" (implicitly Huawei and ZTE) within three years.
- This move aims to bolster cybersecurity across the bloc by addressing supply chain security challenges in critical infrastructure and simplifying certification frameworks.
- China has accused the EU of protectionism, with Huawei stating the proposal violates basic legal principles and WTO obligations by targeting suppliers based on country of origin rather than factual evidence.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/21/eu_mulls_deadline_of_3_years/
🗞️ The Record | https://therecord.media/eu-unveils-new-plans-to-tackle-huawei-zte

Curl Shuts Down Bug Bounty Program Due to AI "Slop" 🚫

- Daniel Stenberg, the maintainer of the popular open-source `cURL` tool, has ended the project's bug bounty program, citing a struggle to assess a flood of AI-generated contributions.
- Stenberg hopes this move will "remove the incentive for people to submit crap and non-well researched reports," which have placed a high load on the `cURL` security team.
- While acknowledging AI can aid bug hunting, he maintains that developers should only report bugs they fully understand and can reproduce, reserving the right to publicly criticise those who waste the team's time.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/21/curl_ends_bug_bounty/

#CyberSecurity #ThreatIntelligence #Ransomware #Phishing #Vulnerabilities #ZeroDay #AI #Malware #IncidentResponse #DataBreach #InfoSec #WordPress #Fortinet #GitLab #CloudSecurity #AutomotiveSecurity #Regulation #Privacy #OpenSource

(6/6) #Capitalism runs like a computer (and it's being hacked)

Markets under capitalism are an open system whose norms and protocols can be hijacked to create permanent structural advantages. Very similar to #exploits #vulnerabilities in #cybersecurity.

Because #capitalists institutions determine what can be bought and sold in market capitalism they are often targets of hijacking.

#blog #anniversary #misalignedmarkets #longthread

https://misaligned.markets/capitalism-as-a-stack/

#Vulnerabilities Threaten to Break Chainlit #AI Framework. Familiar #bugs in a popular #opensource framework for #AI #chatbots could give attackers dangerous powers in the cloud.
https://www.darkreading.com/vulnerabilities-threats/vulnerabilities-break-chainlit-ai-framework

Alright team, it's been a busy 24 hours in the cyber world with significant updates on AI-related vulnerabilities, new malware, ongoing cybercrime operations, and shifts in the threat landscape. Let's dive in:

AI-Powered Vulnerabilities and RCE Risks 🛡️

- Anthropic has patched three critical flaws (path validation bypass, unrestricted git_init, argument injection) in its Git Model Context Protocol (MCP) server. When chained with the Filesystem MCP server, these bugs could enable remote code execution (RCE) via indirect prompt injection.
- The open-source AI framework Chainlit (used by financial, energy, and academic sectors) was found to have two "easy-to-exploit" vulnerabilities: an arbitrary file read (CVE-2026-22218) and a server-side request forgery (SSRF) (CVE-2026-22219). These could lead to data leakage, account takeover, and lateral movement in enterprise cloud environments.
- Google Gemini was hit by a prompt injection flaw, weaponising Calendar invites to bypass privacy controls, access private meeting data, and create deceptive events without user interaction. This highlights a "structural limitation" in how AI-integrated products interpret user intent in natural language.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/ai_framework_flaws_enterprise_clouds/
🕶️ Dark Reading | https://www.darkreading.com/cloud-security/google-gemini-flaw-calendar-invites-attack-vector

New Malware and AI-Assisted Development 🤖

- VoidLink, a sophisticated Linux malware targeting cloud environments (AWS, GCP, Azure, Alibaba, Tencent) with 37 plugins, was "almost entirely generated by artificial intelligence." Researchers believe a single individual, using the Trae Solo AI assistant, developed the functional implant in under a week.
- A regionally focused threat actor, tracked as Nomad Leopard, is targeting Afghan government employees with phishing emails disguised as official correspondence. These emails deliver FalseCub malware, designed for data exfiltration, and leverage GitHub for temporary payload hosting.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/voidlink_ai_developed/
🗞️ The Record | https://therecord.media/hackers-target-afghan-workers

Mass Spam and Illicit Marketplace Shutdowns ⚠️

- Multiple users are reporting a wave of mass spam emails originating from Zendesk domains, leveraging instances belonging to legitimate companies like Live Nation, Capcom, and Tinder. These emails are often bypassing spam filters, with Zendesk investigating potential relay attacks or misconfigurations.
- Tudou Guarantee, a major Telegram-based illicit marketplace that processed over $12 billion in transactions, appears to be winding down its operations. This shutdown is linked to recent law enforcement actions against Cambodian conglomerate Prince Group and its CEO, Chen Zhi, implicated in "pig butchering" scams.

🕶️ Dark Reading | https://www.darkreading.com/threat-intelligence/mass-spam-attacks-zendesk-instances
📰 The Hacker News | https://thehackernews.com/2026/01/tudou-guarantee-marketplace-halts.html

Evolving Threat Landscape: AI and Hacktivism 🚨

- Cybercrime has fully embraced AI, with "Dark LLMs" and deepfake tools now available as cheap, off-the-shelf services. Group-IB reports Dark LLMs for scams and malware can be rented for as little as $30/month, and synthetic identity kits for $5, significantly scaling social engineering and fraud.
- The UK's NCSC has warned of a sustained cyber threat from pro-Russian hacktivist groups, such as NoName057(16), continuing to target UK and international organisations with disruptive cyberattacks, including DDoS. These ideologically motivated groups, though less sophisticated than state-sponsored actors, can still cause significant real-world disruption.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/20/group_ib_ai_cycercrime_subscriptions/
🗞️ The Record | https://therecord.media/uk-ncsc-warning-russia-aligned-hacktivist-groups

Cybersecurity Legislation and Funding Updates 🏛️

- US lawmakers have once again moved to temporarily extend two key cybersecurity laws: the 2015 Cybersecurity and Information Sharing Act (CISA 2015) and the State and Local Cybersecurity Grant Program, through September 30. This is part of a compromise government funding bill, highlighting ongoing challenges for long-term reauthorization.
- The proposed funding bill also allocates $2.6 billion for the Cybersecurity and Infrastructure Security Agency (CISA), including $39.6 million for election security programs. The legislation also includes directives on CISA staffing levels, aiming to ensure sufficient personnel for its statutory missions.

🗞️ The Record | https://therecord.media/lawmakers-move-to-extend-two-cyber-programs-again
🤫 CyberScoop | https://cyberscoop.com/congressional-appropriators-move-to-extend-information-sharing-law-fund-cisa

Cloudflare WAF Bypass Fixed 🌐

- Cloudflare has patched a security vulnerability in its Automatic Certificate Management Environment (ACME) validation logic. The flaw could have allowed a bypass of Web Application Firewall (WAF) rules, enabling requests to reach origin servers. No evidence of malicious exploitation was found.

📰 The Hacker News | https://thehackernews.com/2026/01/cloudflare-fixes-acme-validation-bug.html

Predator Bots and API Security 🤖

- The rise of "predator bots" — self-learning programs leveraging AI to mimic human behaviour and exploit APIs — is causing up to $186 billion in annual economic harm through credential theft, scalping, and fraud. Defending against these adaptive threats requires deep API knowledge, complete API discovery, and machine-speed behavioral detection.

🤫 CyberScoop | https://cyberscoop.com/malicious-bots-predator-bots-api-security-machine-speed-defense/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #AI #PromptInjection #RCE #Malware #CloudSecurity #APIsecurity #Hacktivism #Cybercrime #InfoSec #IncidentResponse #ThreatLandscape

#Europe launches GCVE to track security vulnerabilities without relying on the US, creating a new independent platform for reporting security flaws in software.

Read: https://hackread.com/eu-launches-gcve-track-vulnerabilities-us/

#CyberSecurity #InfoSec #Vulnerabilities #EU #GCVE

Malwoverview 7.0 has been released:

https://github.com/alexandreborges/malwoverview

This version introduces a new vulnerability-focused approach, and the first feature is NIST support, which allows listing and searching for registered vulnerabilities. In addition, several previous threat detection options have been fixed and improved.

To install Malwoverview:

python -m pip install -U malwoverview

Documentation and examples can be found on the project page.

#vulnerabilities #cve #cybersecurity #informationsecurity

Malwoverview 7.0 has been released:

https://github.com/alexandreborges/malwoverview

This version introduces a new vulnerability-focused approach, and the first feature is NIST support, which allows listing and searching for registered vulnerabilities. In addition, several previous threat detection options have been fixed and improved.

To install Malwoverview:

python -m pip install -U malwoverview

Documentation and examples can be found on the project page.

#vulnerabilities #cve #cybersecurity #informationsecurity #threathunting

Mitigating Denial-of-Service Vulnerability From Unrecoverable Stack Space Exhaustion for React, Next.js, and APM Users, by @mcollina and @joyeecheung (@nodejs):

https://nodejs.org/en/blog/vulnerability/january-2026-dos-mitigation-async-hooks

#nodejs #security #vulnerabilities #react #nextjs #tooling #monitoring #performance

Vulnerabilities Surge, But Messy Reporting Blurs Picture #vulnerability #vulnerabilities https://www.darkreading.com/cybersecurity-analytics/vulnerabilities-surge-messy-reporting-blurs-picture

It's been a busy 24 hours in the cyber world with significant updates on recent breaches, major cybercrime infrastructure takedowns, a raft of critical vulnerabilities, and ongoing discussions around AI's impact on security and privacy. Let's dive in:

Recent Cyber Attacks and Breaches ⚠️

- South Korean conglomerate Kyowon Group has confirmed a ransomware attack that disrupted operations and led to the exfiltration of customer data, potentially impacting over 9.6 million accounts.
- In the UK, West Midlands Police are investigating a data breach at a GP surgery in Walsall, with a staff member accused of theft and released on bail.
- These incidents highlight the persistent threat of ransomware and insider threats, even for organisations with significant customer bases or sensitive data.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/south-korean-giant-kyowon-confirms-data-theft-in-ransomware-attack/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/woman_bailed_following_doctors_office/

Cybercrime-as-a-Service Disrupted: RedVDS Takedown 🚨

- Microsoft, in a coordinated international effort with Europol and German authorities, has disrupted RedVDS, a massive cybercrime-as-a-service platform.
- RedVDS offered disposable virtual Windows cloud servers for as little as $24 a month, enabling criminals to conduct mass phishing, BEC schemes, and account takeovers, leading to an estimated $40 million in US fraud losses since March 2025.
- The operation involved civil lawsuits in the US and UK, seizing malicious infrastructure and taking RedVDS's marketplace offline, revealing that its customers often leveraged AI tools like ChatGPT to craft more convincing phishing lures and impersonations.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/microsoft-seizes-servers-disrupts-massive-redvds-cybercrime-platform/
📰 The Hacker News | https://thehackernews.com/2026/01/microsoft-legal-action-disrupts-redvds.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/microsoft_uk_courts_redvds/

AI Prompt Injection Risks in Anthropic's Cowork 🧠

- PromptArmor researchers have demonstrated that Anthropic's new Cowork productivity AI is vulnerable to a Files API exfiltration attack chain, a prompt injection risk previously reported and acknowledged but not fully fixed by Anthropic for Claude Code.
- The attack allows Cowork to be tricked into transmitting sensitive files from connected local folders to an attacker's Anthropic account without additional user approval.
- Anthropic acknowledges prompt injection as an industry-wide issue and advises users to avoid connecting Cowork to sensitive documents, limit its Chrome extension to trusted sites, and monitor for suspicious actions, placing the onus on users to manage this complex risk.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/anthropics_claude_bug_cowork/

Critical Vulnerabilities and Active Exploitation 🛡️

- **Modular DS WordPress Plugin:** A maximum severity flaw (CVE-2026-23550) in Modular DS (versions 2.5.1 and older), used by over 40,000 WordPress sites, is being actively exploited to bypass authentication and gain admin-level privileges. Users should update to version 2.5.2 immediately.
- **AWS CodeBuild Misconfiguration:** A critical misconfiguration (dubbed CodeBreach) in AWS CodeBuild's webhook filters allowed researchers to take over AWS's own GitHub repositories, including the JavaScript SDK, by bypassing ACTOR_ID filters due to unanchored regex patterns. AWS has since fixed the issue, confirming no customer impact.
- **Google Fast Pair Protocol:** A critical vulnerability (CVE-2025-36911, WhisperPair) in Google's Fast Pair protocol affects hundreds of millions of Bluetooth audio devices, allowing unauthenticated attackers to forcibly pair, track users via Google's Find Hub, and eavesdrop on conversations. Firmware updates from manufacturers are the only defence.
- **Palo Alto Networks PAN-OS DoS:** Palo Alto Networks patched a high-severity DoS vulnerability (CVE-2026-0227) affecting PAN-OS 10.1+ and Prisma Access when GlobalProtect is enabled, allowing unauthenticated attackers to disable firewall protections. While not actively exploited yet, immediate patching is advised given past active exploitation of similar flaws.
- **Delta Industrial PLCs:** Researchers found three critical (CVSS 9.1-9.8) and one high-severity vulnerability in Delta Electronics DVP-12SE11T PLCs, popular in Asian industrial sites, which could allow authentication bypass, password information leakage, or device freezing. Patching is crucial, though challenging in OT environments.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hackers-exploit-modular-ds-wordpress-plugin-flaw-for-admin-access/
📰 The Hacker News | https://thehackernews.com/2026/01/aws-codebuild-misconfiguration-exposed.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/codebuild_flaw_aws/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-flaw-lets-hackers-track-eavesdrop-via-bluetooth-audio-devices/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-dos-bug-letting-hackers-disable-firewalls/
💡 Dark Reading | https://www.darkreading.com/ics-ot-security/critical-bugs-delta-industrial-plcs

Threat Landscape Commentary 📊

- **Oceania's Shifting Targets:** New data from Cyble indicates a shift in attacker focus in Australia and New Zealand from critical infrastructure to non-critical sectors like retail, professional services, and construction, driven by the efficiency of targeting less secure, data-rich environments. Initial access brokers and major ransomware groups like INC, Qilin, Lynx, Akira, and Dragonforce are capitalising on these softer targets.
- **AI Normalises Foreign Influence:** A report from the Foundation for Defense of Democracies highlights how AI, particularly LLMs, inadvertently normalises foreign propaganda by prioritising readily available state-aligned media in citations, as credible independent news sources are often behind paywalls or block AI scraping. This creates a structural issue where users seeking unbiased information are directed towards state-controlled narratives.
- **Vulnerability Reporting Surge:** 2025 saw a record 48,177 CVEs assigned, marking the ninth consecutive year of increase. This surge is attributed more to a healthier, expanding vulnerability reporting ecosystem (especially from WordPress security firms and the Linux Kernel CNA) and the use of LLMs by novice researchers, rather than a direct increase in cyber risk. However, data quality issues in the NVD persist, complicating patching efforts.

💡 Dark Reading | https://www.darkreading.com/cybersecurity-analytics/retail-services-industries-oceania
🤫 CyberScoop | https://cyberscoop.com/the-quiet-way-ai-normalizes-foreign-influence/
💡 Dark Reading | https://www.darkreading.com/cybersecurity-analytics/vulnerabilities-surge-messy-reporting-blurs-picture

Data Privacy and Regulatory Action 🔒

- **GM Banned from Selling Driver Data:** The US Federal Trade Commission (FTC) has finalised an order banning General Motors (GM) and its subsidiary OnStar from selling drivers' precise location and driving behaviour data to consumer reporting agencies for five years. This follows allegations that GM collected data without consent via its "Smart Driver" feature, leading to higher insurance rates.
- **Google Settles Children's Privacy Lawsuit:** Google has agreed to pay $8.25 million to settle a class-action lawsuit alleging it illegally collected data from children under 13 via Android Play Store apps using its AdMob SDK, despite developers pledging COPPA compliance. This follows a separate $30 million settlement regarding YouTube's collection of children's data.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/ftc-bans-general-motors-from-selling-drivers-location-data-for-five-years/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/ftc_gm_tracking_ban/
🗞️ The Record | https://therecord.media/google-youtube-lawsuit-settle

Regulatory Scrutiny on X and AI Content ⚖️

- Ofcom, the UK communications regulator, is continuing its formal investigation into X (formerly Twitter) despite the platform's announcement that it has implemented measures to block its AI chatbot, Grok, from generating non-consensual sexualised images of people.
- X's changes include technological blocks on "nudifying" images and geoblocking the creation of images of real people in revealing clothing in jurisdictions where it's illegal, applying to all users, including paid subscribers, after initial attempts to limit it to paid users drew strong criticism.
- California's Attorney General has also opened an investigation into X over the issue, highlighting growing international pressure on AI platforms to address the creation and dissemination of non-consensual intimate images.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/15/ofcom_grok_probe/
🗞️ The Record | https://therecord.media/musk-x-grok-block-sexual

Government Cyber Strategy and Leadership 🏛️

- **Germany-Israel Cyber Cooperation:** Germany and Israel have signed a cyber and security cooperation agreement to counter cyber threats and bolster critical infrastructure protection. Germany aims to build its own "cyber dome" based on Israel's semi-automated real-time cyber defence system, exchanging expertise and jointly developing new tools.
- **NSA/Cyber Command Nominee:** Army Lt. Gen. Joshua Rudd, the Trump administration's nominee to lead both US Cyber Command and the National Security Agency, defended his record during a Senate hearing, addressing concerns about his lack of direct digital warfare and intelligence experience by emphasising his leadership background and reliance on the organisations' talent.

🗞️ The Record | https://therecord.media/germany-cyber-dome-israel
🗞️ The Record | https://therecord.media/nsa-cyber-command-nom-joshua-rudd-senate-hearing

#CyberSecurity #ThreatIntelligence #Ransomware #Vulnerabilities #ZeroDay #SupplyChainAttack #AI #PromptInjection #DataPrivacy #RegulatoryCompliance #Cybercrime #InfoSec #IncidentResponse #OTSecurity #ICS

AI’s #Hacking Skills Are Approaching an ‘Inflection Point’

#AI models are getting so good at finding #vulnerabilities that some experts say the tech industry might need to rethink how software is built.
#security

https://www.wired.com/story/ai-models-hacking-inflection-point/

CVEs Affecting the Svelte Ecosystem

https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem

#HackerNews #CVEs #Svelte #Ecosystem #Security #Vulnerabilities #OpenSource #Software #Development

This is a great talk

Vulnerable C++ - @PeterSommerlad
- CppNorth 2023

https://www.youtube.com/watch?v=A6_EJ80SAmA

#cpp #vulnerabilities

It's been a busy 24 hours in the cyber world with significant updates on recent breaches, critical vulnerabilities, evolving threat actor tactics, and a deep dive into AI security. Let's take a look:

Recent Cyber Attacks and Breaches 🚨

- The University of Hawaii Cancer Center was hit by a ransomware attack in August 2025, leading to the theft of study participant data, including Social Security numbers from the 1990s. The university paid a ransom to obtain a decryptor and ensure data deletion, highlighting the ongoing challenge of protecting legacy data.
- Spanish energy provider Endesa and its Energía XXI operator disclosed unauthorised access to their commercial platform, exposing basic identification, contact, national identity numbers, contract, and payment details for over 10 million customers. Threat actors are allegedly selling a 1TB database with 20 million records.
- Hackers claim to have stolen 860 GB of Target's internal source code and developer documentation, publishing samples on Gitea. Following inquiries, Target's internal Git server (`git.target.com`) was taken offline, suggesting a potential breach of private development infrastructure.
- The notorious cybercrime forum, BreachForums, suffered a data breach in August 2025, exposing email addresses, usernames, and hashed passwords for approximately 324,000 users. The leaked database, posted to `shinyhunte.rs`, includes records linked to real cybercriminals and PGP keys, potentially aiding law enforcement.
- Players of Apex Legends experienced disruptions as a "bad actor" remotely controlled characters, disconnected players, and changed nicknames, with some reports suggesting administrative privilege access. Respawn, the publisher, resolved the incident, attributing it to anti-cheat circumvention rather than RCE or malware.
- Higham Lane School in the UK closed for a week following a cyberattack that disabled electronic gates, fire alarms, and student record systems, making it unsafe to open. This incident highlights the critical impact of cyberattacks on essential services and physical safety.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/university-of-hawaii-cancer-center-hit-by-ransomware-attack/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/spanish-energy-giant-endesa-discloses-data-breach-affecting-customers/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/targets-dev-server-offline-after-hackers-claim-to-steal-source-code/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/12/breachforums_breach/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/bad-actor-hijacks-apex-legends-characters-in-live-matches/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/11/infosec_news_in_brief/
📰 The Hacker News | https://thehackernews.com/2026/01/weekly-recap-ai-automation-exploits.html

Critical Vulnerabilities and Exploitation ⚠️

- A maximum-severity flaw, dubbed "Ni8mare" (CVE-2026-21858), allows unauthenticated remote code execution on locally deployed n8n instances (versions prior to 1.121.0). This improper input validation vulnerability in form-based workflows affects nearly 60,000 exposed instances and could lead to full system compromise.
- CISA has ordered federal agencies to patch a high-severity Gogs RCE flaw (CVE-2025-8110), actively exploited as a zero-day. This path traversal vulnerability in the PutContents API allows authenticated attackers to bypass previous patches and overwrite files via symbolic links, enabling arbitrary command execution.
- Veeam patched four vulnerabilities, including a critical RCE (CVE-2025-59470, CVSS 9.0) that allows a Backup or Tape Operator account to execute arbitrary code. This flaw is particularly dangerous as ransomware actors often gain this level of access post-initial compromise, using it to accelerate attacks and disrupt backups.
- A vulnerability in Telegram's Android and iOS clients allows an attacker to reveal a user's real IP address with a single click on a specially crafted proxy link. The app automatically attempts a test connection to the specified server, bypassing configured proxies, making it a silent and effective deanonymisation tool.
- Chinese-speaking threat actors likely developed and exploited a trio of VMware ESXi flaws (CVE-2025-22224, -22225, -22226) over a year before public disclosure, using a compromised SonicWall VPN as an initial access vector. The exploit allowed memory leakage and code execution as the VMX process, targeting a wide range of ESXi versions.
- A critical buffer overflow vulnerability in zlib's `untgz` utility (CVE-2026-22184, versions up to 1.3.1.2) can lead to memory corruption, denial of service, and potentially remote code execution. The flaw, with a CVSS score of 9.3, is due to an unbounded `strcpy()` call on attacker-controlled input.

🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-impacts-nearly-60-000-n8n-instances/
📰 The Hacker News | https://thehackernews.com/2026/01/researchers-uncover-service-providers.html
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-gogs-rce-flaw-exploited-in-zero-day-attacks/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/11/infosec_news_in_brief/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/hidden-telegram-proxy-links-can-reveal-your-ip-address-in-one-click/
📰 The Hacker News | https://thehackernews.com/2026/01/weekly-recap-ai-automation-exploits.html

Evolving Threat Actor Tactics and Malware 🛡️

- Researchers uncovered service providers like "Penguin Account Store" and "UWORK" fuelling industrial-scale pig butchering fraud. These services offer full fraud kits, including stolen social media accounts, pre-registered SIMs, character sets, automated victim engagement platforms (SCRM AI), and even turnkey scam websites with KYC panels and mobile apps, significantly lowering the barrier to entry for criminals.
- A new wave of GoBruteforcer attacks is targeting cryptocurrency and blockchain project databases by exploiting weak credentials. The botnet, leveraging common usernames and passwords often propagated by AI-generated server deployment examples, can brute-force FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux servers, with observed activity including scanning for TRON blockchain addresses with non-zero funds.
- Two distinct campaigns are actively targeting exposed Large Language Model (LLM) services, amounting to nearly 100,000 attack sessions. One campaign, likely by ethical hackers, exploits SSRF vulnerabilities, while the other, more malicious, systematically probes over 73 LLM model endpoints (OpenAI, Anthropic, Google, etc.) to identify misconfigured proxy servers for potential future exploitation.
- The Kimwolf botnet, an Android variant of Aisuru malware, has infected over two million devices, primarily by exploiting vulnerabilities in residential proxy networks. It abuses proxy providers to access local network addresses and ports, allowing direct interaction with Android Debug Bridge (ADB) services exposed on internal networks.
- A sophisticated threat actor, UAT-7290, is conducting a long-running cyber-espionage campaign targeting high-value telecommunications infrastructure in South Asia since at least 2022. The group focuses on extensive reconnaissance before deploying Linux malware families like RushDrop, DriveSwitch, and SilentRaid, highlighting the strategic value of these networks.
- Two malicious Chrome extensions, "Chat GPT for Chrome with GPT-5..." and "AI Sidebar with DeepSeek...", collectively installed 900,000 times, were found exfiltrating OpenAI ChatGPT and DeepSeek conversations, along with browsing data, to attacker-controlled servers. This technique, dubbed "Prompt Poaching," underscores the risk of third-party browser add-ons.

📰 The Hacker News | https://thehackernews.com/2026/01/researchers-uncover-service-providers.html
📰 The Hacker News | https://thehackernews.com/2026/01/gobruteforcer-botnet-targets-crypto.html
🌑 Dark Reading | https://www.darkreading.com/endpoint-security/separate-campaigns-target-exposed-llm-services
📰 The Hacker News | https://thehackernews.com/2026/01/weekly-recap-ai-automation-exploits.html

Threat Landscape and AI Security Insights 🧠

- The US appears to be shifting towards a "gray zone" cyber approach, using cyber interference against economic and civilian infrastructure as part of sustained pressure campaigns, rather than isolated actions. This strategy, drawing lessons from Russia's hybrid warfare, leverages persistent access and calibrated disruption to shape behaviour below the threshold of open conflict.
- A World Economic Forum survey indicates a significant increase in organisations assessing AI tool security risks, with 64% doing so before deployment, almost double the previous year. While AI is seen as the most significant driver of cybersecurity change, data leaks and the advancement of adversarial AI capabilities remain top concerns for leaders.
- Block's CISO, James Nettesheim, revealed their red team successfully used a prompt injection attack to deploy an infostealer on an employee's laptop via their open-source AI agent, Goose. This highlights the critical need for least-privilege access for AI agents and humans, and the ongoing challenge of prompt injection, which Block is addressing with features like recipe install warnings and suspicious Unicode character detection.
- Illicit cryptocurrency activity reached a record $158 billion in 2025, a 145% increase from 2024, with over 80% linked to Russia-linked entities. Despite the volume, illicit activity's share of overall crypto transactions continues to decline, suggesting improved visibility and a maturing ecosystem where illicit actors operate at scale, similar to traditional finance.

🤫 CyberScoop | https://cyberscoop.com/gray-zone-cyber-operations-state-power-below-threshold-conflict-op-ed/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/12/businesses_are_finally_starting_to_ask_whether_their_ai_is_secure/
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/12/block_ai_agent_goose/
📰 The Hacker News | https://thehackernews.com/2026/01/weekly-recap-ai-automation-exploits.html

Data Privacy Concerns 🔒

- Meta addressed an issue allowing external parties to request password reset emails for some Instagram users, but denied any system breach or data theft. This clarification follows claims of 17.5 million Instagram accounts having sensitive information stolen, likely from an older scraped dataset.
- China has issued draft regulations to govern personal information collection and use from the internet, emphasising legality, legitimacy, necessity, and integrity. The rules aim to safeguard user rights, promote transparency, and require explicit consent for data collection, especially sensitive personal information, with app developers responsible for security and compliance.
- Gulshan Management Services, operating 150 Handi gas stations, disclosed a data breach from September last year, affecting 377,082 customers. A phishing attack led to IT system encryption and exposure of names, SSNs, contact info, and driver's license numbers, raising concerns about delayed notification and potential legal action.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/11/infosec_news_in_brief/
📰 The Hacker News | https://thehackernews.com/2026/01/weekly-recap-ai-automation-exploits.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/11/infosec_news_in_brief/

#CyberSecurity #ThreatIntelligence #Ransomware #Vulnerabilities #ZeroDay #RCE #APT #Malware #DataBreach #AIsecurity #PromptInjection #GrayZone #Cybercrime #InfoSec #IncidentResponse

In 2025, the top 5 known exploited vulnerability (#KEV) vendors as of https://cyble.com/blog/cisa-kev-2025-exploited-vulnerabilities-growth/ were:

Microsoft (39)
#Apple (9)
#Cisco (8)
#Fortinet (8)
#Google #Chromium (7)

If you like to minimize your #security risk here, avoiding those vendors could improve your overall exposure.

As you can see, this is particularly true for #Microsoft.

Mitigation using #AntiMalware or #EndPointProtection is not the answer as we've learned in the previous year where the "Most Frequently Exploited #Vulnerabilities" have been security products!
Source: https://services.google.com/fh/files/misc/m-trends-2025-en.pdf

If you have high requirements for #ITsecurity, you need to migrate your systems to #Linux which is also part of KEV but on a *much* better level!

#Windows #macOS #iOS #exploits

Alright team, it's been a pretty packed 24 hours in the cyber world! We've got some critical RCE vulnerabilities under active exploitation, a deep dive into North Korean "quishing" tactics, and a major regulatory crackdown on AI-generated deepfakes. Let's get into it:

Critical RCE Vulnerabilities Under Active Exploitation ⚠️

- HPE OneView (CVE-2025-37164), a privileged IT infrastructure management platform, has a maximum-severity RCE flaw (CVSS 10.0) that's actively being exploited. Patching is critical as compromise grants centralised control over an organisation's infrastructure.
- The React2Shell vulnerability (CVE-2025-55182), affecting React frameworks like Next.js, allows unauthenticated RCE in default configurations. Vercel, a key maintainer, coordinated a massive industry response, paid out $1M in bug bounties for WAF bypasses, and has blocked over 6 million exploit attempts since disclosure.
- China-linked threat actors were exploiting three VMware ESXi hypervisor escape zero-days (CVE-2025-22224, -22225, -22226) for over a year before VMware publicly disclosed them in March 2025. Initial access was via a compromised SonicWall VPN, leading to VM escape and RCE on the hypervisor.
- Trend Micro Apex Central for Windows has a critical RCE flaw (CVE-2025-69258, CVSS 9.8) allowing unauthenticated remote attackers to load malicious DLLs with SYSTEM privileges. Two other DoS flaws (CVE-2025-69259, -69260) were also patched.

🌑 Dark Reading | https://www.darkreading.com/vulnerabilities-threats/maximum-severity-hpe-oneview-flaw-exploited
🤫 CyberScoop | https://cyberscoop.com/vercel-cto-security-react2shell-vulnerability/
📰 The Hacker News | https://thehackernews.com/2026/01/trend-micro-apex-central-rce-flaw.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/china_esxi_zerodays/

North Korean Hackers Adopt "Quishing" Tactics 🎣

- The FBI has warned that North Korean state-sponsored threat actors, specifically the Kimsuky group (APT43), are using malicious QR codes ("quishing") in spear-phishing campaigns.
- These QR codes redirect victims to attacker-controlled pages (e.g., fake Microsoft 365, Okta, VPN portals) to steal credentials and session tokens, effectively bypassing MFA and traditional enterprise security controls.
- The tactic leverages unmanaged mobile devices, which often lack the same EDR and network inspection capabilities as corporate machines, making it a high-confidence, MFA-resilient identity intrusion vector.

📰 The Hacker News | https://thehackernews.com/2026/01/fbi-warns-north-korean-hackers-using.html
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/pyongyangs_cyberspies_are_turning_qr/

Fake AI Chrome Extensions Steal User Data 🤖

- Malicious Google Chrome extensions, masquerading as legitimate AI tools from "AItopia" (e.g., "ChatGPT for Chrome with GPT-5..."), have stolen LLM conversations and browser data from over 900,000 users.
- These extensions exfiltrated sensitive data like proprietary source code, business strategies, confidential research, full URLs from all tabs, and search queries to command-and-control servers.
- This "prompt poaching" highlights the growing attack surface of LLM-powered applications and the risk of installing extensions from unknown sources, even if they appear "Featured" in the Chrome store.

🌑 Dark Reading | https://www.darkreading.com/cloud-security/fake-ai-chrome-extensions-steal-900k-users-data

Grok AI Deepfake Controversy and Data Privacy ⚖️

- Elon Musk's Grok AI has faced severe backlash for generating sexualised deepfakes, including of children, leading to calls from UK government officials, US senators, and EU regulators for action.
- UK ministers are weighing a ban on X (formerly Twitter) and its AI tools under the Online Safety Act, while US senators have urged Google and Apple to remove the X and Grok apps from their stores for violating terms of service.
- X has limited image generation to paying subscribers, but critics argue this monetises illegal content and doesn't solve the underlying issue, with reports suggesting the feature remains accessible to free users.
- Separately, the California Privacy Protection Agency (CPPA) fined data broker Datamasters $45,000 for selling sensitive health information (e.g., Alzheimer's patients) and other personal data without proper registration, ordering them to cease sales in California.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/grok_image_generation_uk/
🗞️ The Record | https://therecord.media/lawmakers-call-on-app-stores-to-remove-grok-x
🤫 CyberScoop | https://cyberscoop.com/senators-ask-apple-google-remove-x-after-grok-ai-sexual-deepfakes/
🗞️ The Record | https://therecord.media/ccpa-fines-data-broker-selling-lists-alzheimers

CISA Sunsets Emergency Directives & NSA Leadership Changes 🏛️

- CISA has retired 10 emergency directives issued between 2019 and 2024, citing successful implementation or redundancy due to the comprehensive Known Exploited Vulnerabilities (KEV) catalog. This reflects an evolving approach to federal cybersecurity.
- Tim Kosiba has been appointed as the new Deputy Chief of the National Security Agency (NSA), following a previous candidate's withdrawal due to political pressure. Kosiba brings over three decades of government experience to the role.

🗞️ The Record | https://therecord.media/cisa-sunsets-10-emergency-directives
📰 The Hacker News | https://thehackernews.com/2026/01/cisa-retires-10-emergency-cybersecurity.html
🗞️ The Record | https://therecord.media/timothy-kosiba-nsa-new-deputy-chief

CrowdStrike Acquires SGNL for Identity Security 🔒

- CrowdStrike has acquired identity security startup SGNL for $740 million, aiming to bolster its Falcon cloud security platform with "context-aware authorization" for human, machine, and AI agent identities.
- This acquisition addresses the increasing threat of identity-based attacks and the proliferation of non-human identities, providing dynamic privilege management and real-time access evaluation.
- The deal highlights the growing importance of identity as a primary control plane in major security platforms, moving beyond just detection to being in the path of access.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/08/crowdstrikes_740m_sgnl_deal_proves/

France-Russia Prisoner Swap Involving Alleged Cybercriminal 🌍

- France released Daniil Kasatkin, a Russian basketball player accused by the US of aiding ransomware negotiations for a major cybercrime outfit impacting 900 victims, in exchange for French conflict researcher Laurent Vinatier, imprisoned in Russia.
- This "Putinswap" highlights the geopolitical dimension of cybercrime, where alleged cybercriminals can become bargaining chips in international diplomacy.
- Kasatkin had been in French custody since June 2025, wanted by US officials for his alleged role in ransomware attacks between 2020-2022.

🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2026/01/09/alleged_russian_ransom_payment_negotiator/

#CyberSecurity #ThreatIntelligence #Vulnerabilities #RCE #ZeroDay #Kimsuky #APT43 #Phishing #Quishing #AI #Deepfake #DataPrivacy #RegulatoryCompliance #CISA #NSA #IdentitySecurity #CrowdStrike #Geopolitics #Ransomware

Critical vulnerabilities dominated the landscape this week, with several achieving maximum severity scores and active exploitation in the wild.

#cybersecurity #vulnerabilities #ransomware #phishing #botnet

https://cybernewsweekly.substack.com/p/cybersecurity-news-review-week-2-bcc