CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

News Summary

Hide ▲
Last updated: 17:15 15/01/2026 UTC
  • Microsoft Releases November and December 2025 Patch Tuesday Updates for Windows 11 Microsoft has released Windows 11 cumulative updates KB5074109 and KB5073455 for versions 25H2/24H2 and 23H2. These updates address security vulnerabilities and various issues, including fixes for compatibility, networking, power & battery, Secure Boot, Windows Deployment Services, and WinSqlite3.dll. New features introduced include various bug fixes and improvements. The updates are mandatory and include the January 2026 Patch Tuesday security patches. Microsoft has also resolved a known issue causing security applications to incorrectly flag WinSqlite3.dll as vulnerable to CVE-2025-6965. The issue affected various Windows platforms, including Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025. Microsoft updated WinSqlite3.dll in the January 13, 2026 updates to address false positive detections. Additionally, Microsoft has released the KB5072753 out-of-band cumulative update to fix a known issue causing the November 2025 KB5068966 hotpatch update to reinstall on Windows 11 systems repeatedly. This update is recommended for Windows 11, version 25H2 devices instead of the November 2025 hotpatch update (KB5068966). Microsoft has announced that it will not release optional updates in December, but Patch Tuesday updates will continue as scheduled. Nvidia has confirmed that the October 2025 Windows 11 updates (KB5066835) cause gaming performance issues on Windows 11 24H2 and 25H2 systems. Nvidia released the GeForce Hotfix Display Driver version 581.94 to address these issues. The October updates also caused other issues such as broken localhost HTTP connections, smart card authentication problems, and broken Windows Recovery Environment (WinRE) on systems with USB mice and keyboards. Read
  • Microsoft January 2026 Patch Tuesday Addresses 3 Zero-Days, 114 Flaws Microsoft's January 2026 Patch Tuesday addresses 114 vulnerabilities, including three zero-days: one actively exploited (CVE-2026-20805) and two publicly disclosed (CVE-2026-21265 and CVE-2023-31096). The updates cover a range of flaw types, with eight classified as 'Critical,' including remote code execution and elevation-of-privilege vulnerabilities. CVE-2026-20805 is an information disclosure vulnerability in the Desktop Window Manager that leaks sensitive memory details, allowing attackers to weaken system protections. CVE-2026-21265 affects nearly every Windows bootloader since Windows 8, with certificates set to expire in June and October 2026. CVE-2023-31096 is an elevation of privilege (EoP) in the Agere Modem driver, and Microsoft has removed agrsm64.sys and agrsm.sys from Windows. Microsoft has started automatically replacing expiring Secure Boot certificates on eligible Windows 11 24H2 and 25H2 systems to prevent potential security issues. Additionally, two critical Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) were patched, which can be triggered by viewing a booby-trapped message in the Preview Pane. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20805 to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to apply the latest fixes by February 3, 2026. CVE-2026-20876 is a critical-rated privilege escalation flaw in Windows Virtualization-Based Security (VBS) Enclave, enabling an attacker to obtain Virtual Trust Level 2 (VTL2) privileges. Read
  • Reprompt Attack Exploits Microsoft Copilot Session Hijacking Researchers discovered the Reprompt attack, which allows hackers to hijack Microsoft Copilot sessions by embedding malicious prompts in URLs. This attack bypasses Copilot's protections, enabling data exfiltration without user interaction beyond an initial click. The attack leverages three techniques: Parameter-to-Prompt (P2P) injection, double-request, and chain-request methods. The attack starts with the exploitation of the 'q' parameter, which is used on AI platforms to deliver a user's query or prompt via a URL. The attack resulted in one-click compromise and persisted after the chat was closed. Microsoft addressed the issue in January 2026's Patch Tuesday update, and the attack does not affect enterprise customers using Microsoft 365 Copilot. The Reprompt attack can exfiltrate sensitive data from AI chatbots like Microsoft Copilot in a single click, maintaining control even when the Copilot chat is closed. The attack uses the 'q' URL parameter in Copilot to inject a crafted instruction directly from a URL, instructs Copilot to bypass guardrails by repeating each action twice, and triggers an ongoing chain of requests through the initial prompt for continuous data exfiltration. The attack can exfiltrate data such as user-accessed files, location, and vacation plans, turning Copilot into an invisible channel for data exfiltration without requiring any user input prompts, plugins, or connectors. The root cause of Reprompt is the AI system's inability to delineate between instructions directly entered by a user and those sent in a request. The server can request information based on earlier responses, probing for even more sensitive details, with the real instructions hidden in the server's follow-up requests. Read
  • RedVDS Cybercrime-as-a-Service Disrupted by Microsoft Microsoft, in coordination with legal partners in the US and UK, has disrupted RedVDS, a cybercriminal subscription service that facilitated phishing and fraud campaigns. RedVDS offered cheap, effective, and disposable virtual computers running unlicensed software, enabling cybercriminals to operate anonymously. The service caused over $40 million in losses in the US alone since March 2025, with nearly 190,000 organizations worldwide affected. RedVDS utilized AI to tailor phishing and business email compromise (BEC) scams, including deepfake videos and voice cloning to impersonate individuals. The disruption involved legal action in the US and UK, supported by international law enforcement, including Europol. Microsoft emphasized the importance of reporting cybercrime to prevent future attacks and protect potential victims. RedVDS operated since 2019 and rented servers from third-party hosting providers across multiple countries. The service was used for various malicious activities, including credential theft, account takeovers, and real estate payment diversion scams. In one month, cybercriminals using RedVDS sent an average of 1 million phishing messages per day to Microsoft customers alone, compromising nearly 200,000 Microsoft accounts over the last four months. RedVDS was advertised as a way to 'increase your productivity and work from home with comfort and ease.' The service was first founded in 2017 and operated on Discord, ICQ, and Telegram. The website was launched in 2019. RedVDS provided a reseller panel to create sub-users and grant them access to manage the servers without having to share access to the main site. The service did not maintain activity logs, making it an attractive choice for illicit use. RedVDS was used to host a toolkit comprising both malicious and dual-use software, including mass spam/phishing email tools, email address harvesters, privacy and OPSEC tools, and remote access tools. RedVDS used a single Windows Server 2022 image to create cloned Windows instances, which were created on demand using Quick Emulator (QEMU) virtualization technology combined with VirtIO drivers. RedVDS's Terms of Service prohibited customers from using the service for sending phishing emails, distributing malware, transferring illegal content, scanning systems for security vulnerabilities, or engaging in denial-of-service (DoS) attacks. Read
  • PluggyApe Backdoor Targets Ukraine's Defense Forces in Charity-Themed Campaign Ukraine's Defense Forces were targeted in a charity-themed malware campaign between October and December 2025. The campaign delivered the PluggyApe backdoor, likely deployed by the Russian threat group Void Blizzard (Laundry Bear). The attacks began with instant messages over Signal or WhatsApp, directing recipients to malicious websites posing as charitable foundations. These sites distributed password-protected archives containing PluggyApe payloads. The malware profiles the host, sends victim information to attackers, and waits for further commands. The campaign highlights the increasing use of mobile devices as prime targets due to their poor protection and monitoring. Additionally, the Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025. The threat actor is believed to be active since at least April 2024. The malware is written in Python and establishes communication with a remote server over WebSocket or Message Queuing Telemetry Transport (MQTT). The command-and-control (C2) addresses are retrieved from external paste services such as rentry[.]co and pastebin[.]com, where they are stored in base64-encoded form. Read
  • Magecart Campaign Targets Six Major Card Networks Since 2022 A global Magecart campaign has been active since 2022, targeting six major payment networks: American Express, Diners Club, Discover, JCB, Mastercard, and UnionPay. The campaign uses malicious JavaScript injected into e-commerce websites and payment portals to intercept payment details during checkout. The client-side nature of the attacks makes them difficult to detect, allowing threat actors to steal sensitive information for fraud or dark web sales. Silent Push discovered the campaign by analyzing a suspicious domain linked to PQ.Hosting/Stark Industries, revealing a long-term web-skimming operation with ongoing infections dating back to 2022. The skimmer employs advanced techniques to evade detection, including checking for administrative interfaces and creating fake payment forms to trick victims into entering their credit card details. Read
  • High-Severity DoS Vulnerability in Palo Alto Networks Firewalls Palo Alto Networks has patched a high-severity DoS vulnerability (CVE-2026-0227) affecting PAN-OS firewalls (versions 10.1 and later) and Prisma Access configurations with GlobalProtect enabled. The flaw allows unauthenticated attackers to disable firewall protections through repeated DoS attacks, forcing the firewall into maintenance mode. A proof-of-concept (PoC) exploit exists, and the vulnerability arises from an improper check for exceptional conditions (CWE-754). Most cloud-based Prisma Access instances have been patched, but some remain in progress. No evidence of exploitation has been found yet. Palo Alto Networks has released security updates for all affected versions, advising admins to upgrade to the latest releases. The vulnerability highlights the ongoing targeting of Palo Alto firewalls, which have been frequently exploited in recent attacks. Read
Last updated: 15:30 15/01/2026 UTC
  • Windows Updates Cause RemoteApp Connection Failures in Azure Virtual Desktop Recent Windows updates, including the November 2025 KB5070311 non-security update and a recent Windows 365 update, are causing RemoteApp connection failures in Azure Virtual Desktop environments on Windows 11 24H2/25H2 and Windows Server 2025 devices. This issue primarily affects enterprise users, leaving full desktop sessions unaffected. The incident began on Tuesday at 19:00 UTC, with users experiencing sign-in failures and intermittent access issues to their Cloud PCs. Microsoft has provided temporary mitigations, including a registry key modification, a Known Issue Rollback (KIR) for Windows Pro and Enterprise devices, and workarounds such as accessing Cloud PCs through the Windows App Web Client or using the Remote Desktop client for Windows. Microsoft is working on a permanent fix but has not provided a timeline. Read
  • UNC5518 Access-as-a-Service Campaign via ClickFix and Fake CAPTCHA Pages The ClickFix malware campaign has evolved to include multi-OS support and video tutorials that guide victims through the self-infection process. The campaign, which uses fake Cloudflare CAPTCHA pages and malicious PowerShell scripts, has been observed deploying various payloads, including information stealers and backdoors. The FileFix attack, a variant of the ClickFix family, impersonates Meta account suspension warnings to trick users into installing the StealC infostealer malware. The campaign has evolved over two weeks with different payloads, domains, and lures, indicating an attacker testing and adapting their infrastructure. The FileFix technique, created by red team researcher mr. d0x, uses the address bar in File Explorer to execute malicious commands. The campaign employs steganography to hide a second-stage PowerShell script and encrypted executables inside a JPG image, which is believed to be AI-generated. The StealC malware targets credentials from various applications, cryptocurrency wallets, and cloud services, and can take screenshots of the active desktop. The FileFix attack uses a multilingual phishing site to trick users into executing a malicious command via the File Explorer address bar. The attack leverages Bitbucket to host the malicious components, abusing a legitimate source code hosting platform to bypass detection. The attack involves a multi-stage PowerShell script that downloads an image, decodes it into the next-stage payload, and runs a Go-based loader to launch StealC. The attack uses advanced obfuscation techniques, including junk code and fragmentation, to hinder analysis efforts. The FileFix attack is more likely to be detected by security products due to the payload being executed by the web browser used by the victim. The FileFix attack demonstrates significant investment in tradecraft, with carefully engineered phishing infrastructure, payload delivery, and supporting elements to maximize evasion and impact. The MetaStealer attack, a variant of the ClickFix family, uses a fake Cloudflare Turnstile lure and an MSI package disguised as a PDF to deploy the MetaStealer infostealer malware. The attack involves a multi-stage infection chain that includes a DLL sideloading technique using a legitimate SentinelOne executable. The MetaStealer attack targets crypto wallets and other sensitive information, using a combination of social engineering and technical evasion techniques to deploy malware. Recently, threat actors have been abusing the decades-old Finger protocol to retrieve and execute remote commands on Windows devices. The Finger protocol is used to deliver commands that create a random-named path, download a zip archive disguised as a PDF, and extract a Python malware package. The Python program is executed using pythonw.exe __init__.py, and a callback is made to the attacker's server to confirm execution. A related batch file indicates that the Python package is an infostealer. Another campaign uses the Finger protocol to retrieve and run commands that look for malware research tools and exit if found. If no malware analysis tools are found, the commands download a zip archive disguised as PDF files and extract the NetSupport Manager RAT package. The commands configure a scheduled task to launch the remote access malware when the user logs in. The Finger protocol abuse appears to be carried out by a single threat actor conducting ClickFix attacks. A new EVALUSION ClickFix campaign has been discovered, delivering Amatera Stealer and NetSupport RAT. Amatera Stealer, an evolution of ACR Stealer, is available under a malware-as-a-service (MaaS) model and targets crypto-wallets, browsers, messaging applications, FTP clients, and email services. It employs advanced evasion techniques such as WoW64 SysCalls and is packed using PureCrypter. The stealer is injected into the MSBuild.exe process to harvest sensitive data and contact an external server to execute a PowerShell command to fetch and run NetSupport RAT. The campaign also involves phishing attacks using various malware families and phishing kits named Cephas and Tycoon 2FA. Tycoon 2FA is a phishing kit that bypasses multi-factor authentication (MFA) and authentication apps by intercepting usernames, passwords, session cookies, and MFA flows in real-time. It has been used in over 64,000 attacks this year, primarily targeting Microsoft 365 and Gmail. Tycoon 2FA includes anti-detection layers and can lead to total session takeover, allowing attackers to move laterally into various enterprise systems. Legacy MFA methods are vulnerable to Tycoon 2FA, and phishing-proof MFA solutions like Token Ring and Token BioStick are recommended to prevent such attacks. A new operation embedding StealC V2 inside Blender project files has been observed targeting victims for at least six months. The attackers placed manipulated .blend files on platforms such as CGTrader, where users downloaded them as routine 3D assets. When opened with Blender’s Auto Run feature enabled, the files executed concealed Python scripts that launched a multistage infection. The infection chain began with a tampered Rig_Ui.py script embedded inside the .blend file. This script fetched a loader from a remote workers.dev domain, which then downloaded a PowerShell stage and two ZIP archives containing Python-based stealers. Once extracted into the Windows temp directory, the malware created LNK files to secure persistence, then used Pyramid C2 channels to retrieve encrypted payloads. StealC V2, promoted on underground forums since April 2025, has rapidly expanded its feature set. It now targets more than 23 browsers, over 100 plugins, more than 15 desktop wallets, and a range of messaging, VPN and mail clients. Its pricing, from $200 per month to $800 for 6 months, has made it accessible to low-tier cybercriminals seeking ready-to-use tools. ClickFix attack variants have been observed using a realistic-looking Windows Update animation in a full-screen browser page to trick users into executing malicious commands. The new ClickFix variants drop the LummaC2 and Rhadamanthys information stealers. The attack uses steganography to encode the final malware payload inside an image. The process involves multiple stages that use PowerShell code and a .NET assembly (the Stego Loader) responsible for reconstructing the final payload embedded inside a PNG file in an encrypted state. The shellcode holding the infostealer samples is packed using the Donut tool. The Rhadamanthys variant that used the Windows Update lure was first spotted by researchers back in October, before Operation Endgame took down parts of its infrastructure on November 13. A new campaign codenamed JackFix leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising. The JackFix campaign displays highly convincing fake Windows update screens in an attempt to get the victim to run malicious code. The attack heavily leans on obfuscation to conceal ClickFix-related code and blocks users from escaping the full-screen alert by disabling the Escape and F11 buttons, along with F5 and F12 keys. The initial command executed is an MSHTA payload that's launched using the legitimate mshta.exe binary, which contains JavaScript designed to run a PowerShell command to retrieve another PowerShell script from a remote server. The PowerShell script attempts to elevate privileges and creates Microsoft Defender Antivirus exclusions for command-and-control (C2) addresses and paths where the payloads are staged. The PowerShell script serves up to eight different payloads, including Rhadamanthys Stealer, Vidar Stealer 2.0, RedLine Stealer, Amadey, and other unspecified loaders and RATs. The threat actor often changes the URI used to host the first mshta.exe stage and has been observed moving from hosting the second stage on the domain securitysettings.live to xoiiasdpsdoasdpojas.com, although both point to the same IP address 141.98.80.175. An initial access broker tracked as Storm-0249 is abusing endpoint detection and response solutions and trusted Microsoft Windows utilities to load malware, establish communication, and persistence in preparation for ransomware attacks. The threat actor has moved beyond mass phishing and adopted stealthier, more advanced methods that prove effective and difficult for defenders to counter. In one attack analyzed by researchers at cybersecurity company ReliaQuest, Storm-0249 leveraged the SentinelOne EDR components to hide malicious activity. The attack started with ClickFix social engineering that tricked users into pasting and executing curl commands in the Windows Run dialog to download a malicious MSI package with SYSTEM privileges. A malicious PowerShell script is also fetched from a spoofed Microsoft domain, which is piped straight onto the system's memory, never touching the disk and thus evading antivirus detection. The MSI file drops a malicious DLL (SentinelAgentCore.dll), which is placed strategically alongside the pre-existing, legitimate SentinelAgentWorker.exe, which is already installed as part of the victim's SentinelOne EDR. Next, the attacker loads the DLL using the signed SentinelAgentWorker (DLL sideloading), executing the file within the trusted, privileged EDR process and obtaining stealthy persistence that survives operating system updates. Once the attacker gains access, they use the SentinelOne component to collect system identifiers through legitimate Windows utilities like reg.exe and findstr.exe, and to funnel encrypted HTTPS command-and-control (C2) traffic. The compromised systems are profiled using 'MachineGuid,' a unique hardware-based identifier that ransomware groups like LockBit and ALPHV use for binding encryption keys to specific victims. The abuse of trusted, signed EDR processes bypasses nearly all traditional monitoring. The researchers recommend that system administrators rely on behavior-based detection that identifies trusted processes loading unsigned DLLs from non-standard paths. Furthermore, it is helpful to set stricter controls for curl, PowerShell, and LoLBin execution. A new variation of the ClickFix attack dubbed 'ConsentFix' abuses the Azure CLI OAuth app to hijack Microsoft accounts without the need for a password or to bypass multi-factor authentication (MFA) verifications. ConsentFix tricks victims into completing the Azure CLI OAuth flow and steals the resulting authorization code, which is exchanged for full account access. The attack starts with victims landing on a compromised, legitimate website that ranks high on Google Search results. Victims are shown a fake Cloudflare Turnstile CAPTCHA widget that asks for a valid business email address, filtering out bots and non-targets. Victims are instructed to click a 'Sign in' button that opens a legitimate Microsoft URL in a new tab, leading to an Azure login page. The attack completes when victims paste the URL containing the Azure CLI OAuth authorization code into the malicious page, granting attackers access to the Microsoft account via Azure CLI. The attack triggers only once per victim IP address, preventing repeated phishing attempts on the same IP. Defenders are advised to monitor for unusual Azure CLI login activity, such as logins from new IP addresses, and to check for legacy Graph scopes used by attackers to evade detection. Over the past six months, hackers have increasingly relied on the browser-in-the-browser (BitB) method to trick users into providing Facebook account credentials. The BitB phishing technique was developed by security researcher mr.d0x in 2022. In a BitB attack, users who visit attacker-controlled webpages are presented with a fake browser pop-up containing a login form. The pop-up is implemented using an iframe that imitates the authentication interface of legitimate platforms and can be customized with a window title and URL that make the deception more difficult to detect. Recent phishing campaigns targeting Facebook users impersonate law firms claiming copyright infringement, threatening imminent account suspension, or Meta security notifications about unauthorized logins. To avoid detection and to increase the sense of legitimacy, cybercriminals added shortened URLs and fake Meta CAPTCHA pages. In the final stage of the attack, victims are prompted to log in by entering their Facebook credentials in a fake pop-up window. Trellix discovered a high number of phishing pages hosted on legitimate cloud platforms like Netlify and Vercel, which mimic Meta's Privacy Center portal, redirecting users to pages disguised as appeal forms that collected personal information. These campaigns constitute a significant evolution compared to standard Facebook phishing campaigns that security researchers typically observe. The key shift lies in the abuse of trusted infrastructure, utilizing legitimate cloud hosting services like Netlify and Vercel, and URL shorteners to bypass traditional security filters and lend a false sense of security to phishing pages. Most critically, the emergence of the Browser-in-the-Browser (BitB) technique represents a major escalation. By creating a custom-built, fake login pop-up window within the victim's browser, this method capitalizes on user familiarity with authentication flows, making credential theft nearly impossible to detect visually. Read
  • UK Introduces Cyber Security and Resilience Bill to Strengthen National Defenses The UK government has introduced the Cyber Security and Resilience Bill, aiming to upgrade the 2018 NIS Regulations and bolster national cyber defenses. The bill proposes stricter security requirements for essential services, expanded incident reporting, and enhanced regulatory powers. It also includes new regulations for managed service providers and critical suppliers, with tougher penalties for serious offenses. The legislation follows multiple high-profile breaches and aims to address growing cyber threats, including those from AI and unsupported equipment. The bill aims to address annual damages of nearly £15 billion ($19.6 billion) from cyberattacks, with the average significant cyberattack costing over £190,000, totaling roughly £14.7 billion each year. The National Cyber Security Centre (NCSC) reported a 130% increase in "nationally significant" cyber incidents in 2025 compared to 2024. The Technology Secretary will have the authority to direct regulators and organizations to take actions when national security is threatened. Additionally, the UK has announced a new cybersecurity strategy backed by over £210 million ($283 million) to boost cyber defenses across government departments and the wider public sector. This includes establishing a dedicated Government Cyber Unit to coordinate risk management and incident response, setting minimum security standards, improving visibility of cyber risks, and requiring departments to maintain robust incident response capabilities. A new Software Security Ambassador Scheme will promote best practices, with major firms such as Cisco, Palo Alto Networks, Sage, NCC Group, and Santander joining as ambassadors. The UK has also announced plans to ban public-sector and critical infrastructure organizations from paying ransoms following ransomware attacks. The Public Bill Committee is asking for written views from industry experts to scrutinize the Cyber Security and Resilience Bill (CSRB). The CSRB is the long-awaited successor to the NIS Regulations 2018 and promises a NIS2-style revamp of UK cyber regulation for critical infrastructure sectors. The bill has completed its second reading in parliament and has reached the committee stage, where it will be subject to further review. The committee is expected to report by March 5, after which the bill will receive its third reading in the House of Commons, before reaching the Lords in spring/summer. Royal Assent is scheduled for late 2026. The bill seeks to implement several key updates to the NIS Regulations 2018, including an expanded scope to include MSPs, datacenters, large load controllers, and other organizations yet to be defined by regulators. The bill includes stricter rules around incident reporting timelines and a wider scope for reportable incidents. The bill mandates in-scope organizations to manage supply chain risk more proactively and meet 'proportionate and up-to-date security requirements' drawn from the NCSC Cyber Assessment Framework (CAF). The bill provides stronger powers for regulators and potentially higher penalties. Trend Micro's UK cybersecurity director, Jonathan Lee, welcomed the consultation and emphasized the importance of involving frontline workers in making the legislation effective. Lee noted several areas where the bill needs revising, including clearer risk-based definitions for managed services and critical suppliers, streamlined incident-reporting thresholds, consistency across regulators, and transparent information-sharing mechanisms. Mark Bailey, partner at Charles Russell Speechlys, agreed that there are significant gaps in the legislation, particularly in secondary legislation covering areas like incident reporting thresholds, critical supplier definitions, and managed service provider obligations. Read
  • Texas Sues TV Manufacturers for Alleged Unauthorized Data Collection via ACR Technology Texas Attorney General Ken Paxton has filed lawsuits against Sony, Samsung, LG, Hisense, and TCL Technology Group Corporation for allegedly using Automated Content Recognition (ACR) technology to secretly capture screenshots of users' viewing activity every 500 milliseconds and sell the data without consent. The suits highlight concerns about data access by Chinese companies under China's National Security Law. A Texas court initially issued a temporary restraining order (TRO) against Samsung, prohibiting the company from collecting audio and visual data from Texas consumers' smart TVs. However, the court vacated the TRO the following day, allowing Samsung to continue its data collection practices. The TRO, which was set to extend until January 19, followed allegations that Samsung's ACR enrollment practices are deceptive and violate the Texas Deceptive Trade Practices Act (DTPA). The court also noted that users are pressured into consenting to data collection through dark patterns, making it difficult to fully opt out. The lawsuits allege that the collected data is sold to third parties for ad targeting, violating users' privacy rights. This follows a similar 2017 case against Vizio, which settled for $2.2 million for similar practices. Read
  • ShadowLeak: Undetectable Email Theft via AI Agents A new attack vector, dubbed ShadowLeak, allows hackers to invisibly steal emails from users who integrate AI agents like ChatGPT with their email inboxes. The attack exploits the lack of visibility into AI processing on cloud infrastructure, making it undetectable to the user. The vulnerability was discovered by Radware and reported to OpenAI, which addressed it in August 2025. The attack involves embedding malicious code in emails, which the AI agent processes and acts upon without user awareness. The attack leverages an indirect prompt injection hidden in email HTML, using techniques like tiny fonts, white-on-white text, and layout tricks to remain undetected by the user. The attack can be extended to any connector that ChatGPT supports, including Box, Dropbox, GitHub, Google Drive, HubSpot, Microsoft Outlook, Notion, or SharePoint. A new variant of this attack, dubbed ZombieAgent, was discovered by Zvika Babo at Radware. This technique exploits a weakness in OpenAI's URL-modification defenses by leveraging pre-constructed, static URLs to exfiltrate sensitive data from ChatGPT one character at a time. The attack flow involves extracting sensitive data, normalizing it, and exfiltrating it character by character by opening pre-defined URLs in sequence. The vulnerability was reported to OpenAI via BugCrowd in September 2025 and fixed in mid-December 2025. Read
  • ServiceNow Now Assist AI Agents Vulnerable to Second-Order Prompt Injection ServiceNow's Now Assist AI platform has been found vulnerable to second-order prompt injection attacks due to default configurations that allow agent-to-agent collaboration. Malicious actors can exploit these settings to perform unauthorized actions, such as data exfiltration, record modification, and privilege escalation, without user awareness. ServiceNow has acknowledged the behavior, emphasizing it is intended, and updated its documentation to clarify the risks. Additionally, ServiceNow has patched a critical security flaw (CVE-2025-12420) that could enable unauthenticated user impersonation, addressing the issue with security updates deployed to hosted instances and provided to partners and self-hosted customers on October 30, 2025. Read
  • Multiple Critical n8n Workflow Automation Vulnerabilities (CVE-2025-68613, CVE-2025-68668, CVE-2026-21877, CVE-2026-21858) Multiple critical vulnerabilities have been disclosed in the n8n workflow automation platform. The most recent flaw, tracked as CVE-2026-21858 (CVSS 10.0), allows unauthenticated remote attackers to gain complete control over susceptible instances. This vulnerability affects all versions prior to and including 1.65.0 and has been patched in version 1.121.0. Additionally, three other critical vulnerabilities (CVE-2025-68613, CVE-2025-68668, and CVE-2026-21877) have been disclosed, affecting various versions of n8n. Over 103,000 instances are potentially vulnerable, with a significant number located in the U.S., Germany, France, Brazil, and Singapore. Users are advised to upgrade to the latest patched versions or implement mitigations such as disabling the Git node and limiting access for untrusted users. The Ni8mare vulnerability (CVE-2026-21858) affects over 100,000 servers potentially exposed. The vulnerability could enable attackers to access API credentials, OAuth tokens, database connections, and cloud storage. The vulnerability is related to the webhooks that start workflows in n8n. The platform parses incoming data based on the 'content-type' header in a webhook. When a request is 'multipart/form-data', the platform uses a special file upload parser (Formidable) which stores the files in temporary locations. For all other content types, a regular parser is used. The file upload parser wraps Formidable's parse() function, populating req.body.files with the output from Formidable. If a threat actor changes the content type to something like application/json, the n8n middleware would call the regular parser instead of the special file upload parser. This means req.body.files wouldn't be populated, allowing attackers to control the file metadata and file path. The vulnerability was reported on November 9 and fixed nine days later. Over 105,753 unpatched instances of n8n were found exposed online, with 59,558 still exposed on Sunday. More than 28,000 IPs were found in the United States and over 21,000 in Europe. n8n is widely used in AI development to automate data ingestion and build AI agents and RAG pipelines. Read

Latest updates

Browse →

Global Agencies Release OT Network Security Guidance

Updated: · First: 15.01.2026 18:15 · 📰 1 src / 1 articles

The US Cybersecurity and Infrastructure Security Agency (CISA), the UK’s National Cyber Security Centre (NCSC), the Federal Bureau of Investigation (FBI), and international partners have released a new set of security principles aimed at securing operational technology (OT) environments. The guidance addresses the growing risks associated with insecure connectivity in systems that support essential services, providing a framework to help organizations design and manage secure connectivity in OT networks. The document emphasizes the importance of embedding security into network design from the outset to reduce exposure to both highly capable and opportunistic adversaries, including nation-state actors. It highlights the increased interconnection between industrial systems and enterprise networks, which has improved efficiency but expanded the attack surface for cyber threat actors.

Open in new tab

WhisperPair Vulnerability in Google's Fast Pair Protocol

Updated: · First: 15.01.2026 18:13 · 📰 1 src / 1 articles

A critical flaw (CVE-2025-36911, WhisperPair) in Google's Fast Pair protocol allows attackers to hijack Bluetooth audio devices, track users, and eavesdrop on conversations. The vulnerability affects hundreds of millions of devices from multiple manufacturers, regardless of the user's smartphone operating system. The flaw stems from improper implementation of the Fast Pair protocol in audio accessories, enabling unauthorized pairing and control. Attackers can exploit this using any Bluetooth-capable device within 14 meters. Google awarded a $15,000 bounty and worked with manufacturers to release patches, but updates may not be available for all devices.

Open in new tab

Rise in Encryptionless Ransomware Attacks

Updated: · First: 15.01.2026 17:45 · 📰 1 src / 1 articles

Cybercriminals are increasingly shifting from traditional ransomware attacks involving encryption to extortion-only attacks that rely solely on data theft. This trend has seen a significant rise, with nearly 1500 incidents in 2025 compared to just 28 in 2024. These attacks exploit unpatched zero-day vulnerabilities and supply chain weaknesses, targeting organizations through methods like social engineering and voice phishing. The shift poses new challenges for enterprises, requiring them to enhance their security posture and focus on supply chain security.

Open in new tab

Unauthenticated Privilege Escalation in WordPress Modular DS Plugin Exploited in the Wild

Updated: · First: 15.01.2026 17:31 · 📰 1 src / 1 articles

A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin, affecting versions up to 2.5.1, is being actively exploited to gain admin access. The flaw allows unauthenticated attackers to bypass authentication and escalate privileges, potentially leading to full site compromise. The issue stems from a combination of design choices, including permissive direct request handling and weak authentication mechanisms. The vulnerability was patched in version 2.5.2, and attacks were first detected on January 13, 2026, originating from specific IP addresses. Users are urged to update immediately to mitigate the risk.

Open in new tab

Reprompt Attack Exploits Microsoft Copilot Session Hijacking

Updated: 15.01.2026 17:09 · First: 14.01.2026 16:00 · 📰 3 src / 3 articles

Researchers discovered the Reprompt attack, which allows hackers to hijack Microsoft Copilot sessions by embedding malicious prompts in URLs. This attack bypasses Copilot's protections, enabling data exfiltration without user interaction beyond an initial click. The attack leverages three techniques: Parameter-to-Prompt (P2P) injection, double-request, and chain-request methods. The attack starts with the exploitation of the 'q' parameter, which is used on AI platforms to deliver a user's query or prompt via a URL. The attack resulted in one-click compromise and persisted after the chat was closed. Microsoft addressed the issue in January 2026's Patch Tuesday update, and the attack does not affect enterprise customers using Microsoft 365 Copilot. The Reprompt attack can exfiltrate sensitive data from AI chatbots like Microsoft Copilot in a single click, maintaining control even when the Copilot chat is closed. The attack uses the 'q' URL parameter in Copilot to inject a crafted instruction directly from a URL, instructs Copilot to bypass guardrails by repeating each action twice, and triggers an ongoing chain of requests through the initial prompt for continuous data exfiltration. The attack can exfiltrate data such as user-accessed files, location, and vacation plans, turning Copilot into an invisible channel for data exfiltration without requiring any user input prompts, plugins, or connectors. The root cause of Reprompt is the AI system's inability to delineate between instructions directly entered by a user and those sent in a request. The server can request information based on earlier responses, probing for even more sensitive details, with the real instructions hidden in the server's follow-up requests.

Open in new tab

Tines Workflow Automates Just-In-Time Application Access

Updated: · First: 15.01.2026 17:01 · 📰 1 src / 1 articles

Tines has introduced a pre-built workflow to automate Just-In-Time (JIT) access to applications, addressing the challenge of balancing speed and security in Identity and Access Management (IAM). The workflow automates the entire lifecycle of JIT access requests, ensuring access is granted, approved, and revoked automatically. This solution helps prevent privilege creep, improves audit compliance, and enhances user experience by reducing manual intervention. The workflow integrates with tools like Jira Software, Okta, and Slack to streamline the process, from self-service requests to automated revocation. Organizations can import the pre-built workflow, configure it to their needs, and deploy it to manage temporary access efficiently.

Open in new tab

AWS CodeBuild Misconfiguration Enables Supply Chain Attack Path

Updated: · First: 15.01.2026 17:00 · 📰 1 src / 1 articles

A critical misconfiguration in AWS CodeBuild, dubbed CodeBreach, allowed attackers to exploit continuous integration pipelines and potentially inject malicious code into core AWS GitHub repositories, including the JavaScript SDK used by the AWS Console. The flaw stemmed from an unanchored regular expression filter in pull request triggers, enabling unauthenticated attackers to bypass security restrictions and escalate access to repository control. The vulnerability was disclosed by Wiz Research and addressed by AWS within 48 hours.

Open in new tab

Increased ICS Vulnerability Exploits and Hacktivist Activity in 2025

Updated: · First: 15.01.2026 17:00 · 📰 1 src / 1 articles

In 2025, cyber threat actors, including both cybercriminals and hacktivists, significantly increased their attacks on industrial control systems (ICS) and operational technology (OT) environments. The number of ICS vulnerability disclosures nearly doubled compared to 2024, with Siemens and Schneider Electric being the most affected vendors. Ransomware attacks also surged, particularly targeting manufacturing and healthcare sectors, while hacktivist groups focused on energy, utilities, and transportation sectors. The report predicts continued targeting of exposed HMI and SCADA systems in 2026.

Open in new tab

CISO Role Evolution to Executive-Level Positions

Updated: · First: 15.01.2026 16:00 · 📰 1 src / 1 articles

The role of the chief information security officer (CISO) is increasingly recognized as an executive-level position, reflecting its growing importance in business strategy. According to IANS' 2026 State of the CISO Report, 46% of CISOs now hold executive titles, while 27% are VPs and 27% are directors. This shift signifies a structural change in security leadership, with CISOs expected to act as enterprise-wide strategists rather than just technical leaders. However, this elevation comes with greater demands, including wider accountability and intensified oversight from senior leadership and boards. The report highlights that over half of CISOs have seen their roles expand over the past year, taking on responsibilities such as SecOps, security architecture, GRC, app security, IAM, compliance, supplier risk management, BC/DR, and product security. Despite this, 52% of CISOs feel their scope is no longer fully manageable, particularly in smaller organizations, which could delay strategic initiatives and increase reactive security measures. Additionally, the report notes a split in security models, with 64% of CISOs still reporting to IT (typically the CTO or CIO), while 36% report to business functions like the CEO, CFO, COO, CRO, or general counsel. This split is more pronounced in larger firms ($1bn+ revenue) and smaller organizations (under $1bn revenue).

Open in new tab

ThreatsDay Bulletin: AI Voice Cloning, Wi-Fi Kill Switch, and PLC Vulnerabilities

Updated: · First: 15.01.2026 15:56 · 📰 1 src / 1 articles

The ThreatsDay Bulletin highlights several emerging cybersecurity threats and trends. These include AI voice cloning exploits, the discovery of a Wi-Fi kill switch vulnerability, and vulnerabilities in programmable logic controllers (PLCs). The report emphasizes the rapid evolution of attack methods and the importance of vigilance in cybersecurity practices.

Open in new tab

Data Privacy Teams Report Understaffing and Budget Constraints Amid Rising Threats

Updated: · First: 15.01.2026 14:15 · 📰 1 src / 1 articles

Data privacy teams are experiencing significant understaffing and budget constraints, with the median privacy staff size decreasing from eight to five. The stress levels among privacy professionals have increased, driven by rapid technological evolution, compliance challenges, and resource shortages. The report highlights a correlation between underfunding and higher stress levels, with 46% of underfunded teams reporting significantly more stress. Additionally, 44% of respondents face obstacles in their privacy programs, and 52% cite managing risks from new technologies as a top difficulty. Despite these challenges, 38% plan to use AI for privacy tasks in the next year.

Open in new tab

AI Workflow Security Risks Highlighted by Recent Attacks

Updated: · First: 15.01.2026 13:55 · 📰 1 src / 1 articles

Recent incidents demonstrate that the primary risk in AI systems lies not in the models themselves but in the workflows that integrate them. Two Chrome extensions stole ChatGPT and DeepSeek chat data from over 900,000 users, while prompt injections tricked IBM's AI coding assistant into executing malware. These attacks exploit the context and integrations of AI systems, highlighting the need for comprehensive workflow security. AI models are increasingly embedded in business processes, automating tasks and connecting applications. This integration creates new attack surfaces, as AI systems rely on probabilistic decision-making and lack native trust boundaries. Traditional security controls are inadequate for these dynamic and context-dependent workflows. To mitigate these risks, organizations should treat the entire workflow as the security perimeter, implementing guardrails and monitoring for anomalies. Dynamic SaaS security platforms like Reco can help by providing real-time visibility and control over AI usage.

Open in new tab

DDoS Attack Targets ICE Agent Doxxing Site

Updated: · First: 15.01.2026 13:15 · 📰 1 src / 1 articles

A website, ICE List, which publishes personal details of ICE and Border Patrol agents, was taken offline by a prolonged DDoS attack originating from Russian servers. The site, hosted in the Netherlands, was launched following an insider breach at the Department of Homeland Security (DHS). The attack began on Tuesday evening and is still ongoing, preventing access to the site's controversial content.

Open in new tab

Outdated SOC Practices Hindering Incident Response in 2026

Updated: · First: 15.01.2026 13:00 · 📰 1 src / 1 articles

Many Security Operations Centers (SOCs) in 2026 continue to rely on outdated practices that slow down incident response. These practices include manual review of suspicious samples, reliance on static scans, disconnected tools, and over-escalation of alerts. Modern SOCs are adopting automation, dynamic analysis, and integrated workflows to improve Mean Time to Respond (MTTR). The shift towards automation and dynamic analysis helps SOCs detect threats faster and reduce the time taken to respond to incidents. Integration of tools and streamlined workflows enhance productivity and decision-making. Over 15,000 SOC teams globally have improved their metrics by adopting these advanced practices.

Open in new tab

FTC Bans GM from Selling Drivers' Location Data for Five Years

Updated: · First: 15.01.2026 11:59 · 📰 1 src / 1 articles

The U.S. Federal Trade Commission (FTC) has finalized an order with General Motors (GM) and its subsidiary, OnStar, banning the company from selling drivers' geolocation and driving behavior data for five years. The order follows allegations that GM collected and sold this data without consumer consent through OnStar's 'Smart Driver' feature. The FTC's action requires GM to obtain express consent before collecting or sharing such data and provides consumers with more control over their information.

Open in new tab

RedVDS Cybercrime-as-a-Service Disrupted by Microsoft

Updated: 15.01.2026 11:37 · First: 14.01.2026 18:32 · 📰 3 src / 3 articles

Microsoft, in coordination with legal partners in the US and UK, has disrupted RedVDS, a cybercriminal subscription service that facilitated phishing and fraud campaigns. RedVDS offered cheap, effective, and disposable virtual computers running unlicensed software, enabling cybercriminals to operate anonymously. The service caused over $40 million in losses in the US alone since March 2025, with nearly 190,000 organizations worldwide affected. RedVDS utilized AI to tailor phishing and business email compromise (BEC) scams, including deepfake videos and voice cloning to impersonate individuals. The disruption involved legal action in the US and UK, supported by international law enforcement, including Europol. Microsoft emphasized the importance of reporting cybercrime to prevent future attacks and protect potential victims. RedVDS operated since 2019 and rented servers from third-party hosting providers across multiple countries. The service was used for various malicious activities, including credential theft, account takeovers, and real estate payment diversion scams. In one month, cybercriminals using RedVDS sent an average of 1 million phishing messages per day to Microsoft customers alone, compromising nearly 200,000 Microsoft accounts over the last four months. RedVDS was advertised as a way to 'increase your productivity and work from home with comfort and ease.' The service was first founded in 2017 and operated on Discord, ICQ, and Telegram. The website was launched in 2019. RedVDS provided a reseller panel to create sub-users and grant them access to manage the servers without having to share access to the main site. The service did not maintain activity logs, making it an attractive choice for illicit use. RedVDS was used to host a toolkit comprising both malicious and dual-use software, including mass spam/phishing email tools, email address harvesters, privacy and OPSEC tools, and remote access tools. RedVDS used a single Windows Server 2022 image to create cloned Windows instances, which were created on demand using Quick Emulator (QEMU) virtualization technology combined with VirtIO drivers. RedVDS's Terms of Service prohibited customers from using the service for sending phishing emails, distributing malware, transferring illegal content, scanning systems for security vulnerabilities, or engaging in denial-of-service (DoS) attacks.

Open in new tab

High-Severity DoS Vulnerability in Palo Alto Networks Firewalls

Updated: 15.01.2026 10:18 · First: 15.01.2026 11:02 · 📰 2 src / 2 articles

Palo Alto Networks has patched a high-severity DoS vulnerability (CVE-2026-0227) affecting PAN-OS firewalls (versions 10.1 and later) and Prisma Access configurations with GlobalProtect enabled. The flaw allows unauthenticated attackers to disable firewall protections through repeated DoS attacks, forcing the firewall into maintenance mode. A proof-of-concept (PoC) exploit exists, and the vulnerability arises from an improper check for exceptional conditions (CWE-754). Most cloud-based Prisma Access instances have been patched, but some remain in progress. No evidence of exploitation has been found yet. Palo Alto Networks has released security updates for all affected versions, advising admins to upgrade to the latest releases. The vulnerability highlights the ongoing targeting of Palo Alto firewalls, which have been frequently exploited in recent attacks.

Open in new tab

OpenAI Testing Cross-Platform Feature Codenamed 'Agora'

Updated: · First: 15.01.2026 05:00 · 📰 1 src / 1 articles

OpenAI is internally testing a new feature called 'Agora,' which appears to be a cross-platform feature. The feature is mentioned in updates to web, Android, and iOS apps, suggesting it may involve real-time interactions or a new product. The name 'Agora' could hint at social, community, or communication features. Additionally, OpenAI has improved dictation capabilities in ChatGPT, reducing empty transcriptions and improving accuracy.

Open in new tab

Google Integrates Gemini AI into Chrome for Android

Updated: · First: 15.01.2026 03:30 · 📰 1 src / 1 articles

Google is testing the integration of Gemini AI into Chrome for Android, enabling agentic browser capabilities. This integration, referred to as 'Glic' in Chromium code, will allow users to leverage AI-driven features directly within the mobile browser. The exact implementation details are not yet disclosed, but it is expected to function similarly to Copilot in Edge for Android, providing features like summarizing web content and answering follow-up questions. The integration is confirmed through references in the Chromium source code, indicating a significant increase in binary size due to the new AI capabilities. While Gemini is already available in Chrome for desktop, its rollout on Android is anticipated soon.

Open in new tab

Google's Personal Intelligence integrates Gemini with user data across services

Updated: · First: 15.01.2026 02:00 · 📰 1 src / 1 articles

Google's new 'Personal Intelligence' feature for Gemini integrates user data from Gmail, Photos, Search, and other services to provide personalized responses. The feature is currently in beta and available to eligible subscribers in the U.S. Users can control which apps are linked and can disable the feature at any time. Google acknowledges potential inaccuracies and encourages user feedback to improve the system.

Open in new tab

OpenAI Introduces ChatGPT Translate Feature

Updated: · First: 15.01.2026 00:52 · 📰 1 src / 1 articles

OpenAI has quietly launched a new feature called ChatGPT Translate, which offers advanced translation capabilities similar to Google Translate but with additional interactive features. The tool allows users to translate text, images, and audio, and supports customization of the output style. This feature is available to all users without requiring a paid account, though it has not been officially announced by OpenAI.

Open in new tab

Ransomware Attack on Kyowon Group Leads to Data Exfiltration

Updated: · First: 14.01.2026 23:49 · 📰 1 src / 1 articles

South Korean conglomerate Kyowon Group confirmed a ransomware attack that occurred on January 2026, resulting in the exfiltration of customer data. The attack impacted approximately 600 out of 800 servers, potentially exposing information from over 9.6 million accounts (5.5 million individuals). The company is investigating the extent of the data leak and working to restore services.

Open in new tab

CNIL fines Free Mobile €42 million for 2024 data breach

Updated: · First: 14.01.2026 21:50 · 📰 1 src / 1 articles

The French data protection authority (CNIL) has fined Free Mobile and its parent company, Free, a total of €42 million for inadequate protection of customer data during a 2024 breach. The incident exposed data of nearly 23 million subscribers, including IBANs for 25% of affected individuals. The breach stemmed from weak VPN authentication and ineffective activity monitoring, violating GDPR rules on data security, breach notification, and data retention. The CNIL investigation revealed that the companies failed to implement adequate security measures, notify affected individuals properly, and retain personal data only as long as necessary. Both companies must now complete their security improvements and data cleanup within specified deadlines.

Open in new tab

Aisuru botnet conducts record-breaking DDoS attacks, targeting U.S. ISPs and Microsoft Azure

Updated: 14.01.2026 21:03 · First: 02.09.2025 18:52 · 📰 14 src / 26 articles

The **Aisuru botnet** and its **Android-focused sibling, Kimwolf**, now represent a **multi-botnet threat ecosystem** with **over 4 million compromised devices** (1–4M IoT for Aisuru; **>2M Android TVs/boxes** for Kimwolf). Together, they have executed **record-breaking DDoS campaigns** (e.g., Aisuru’s **29.7 Tbps** in Q3 2025; Kimwolf’s **1.7 billion attack commands** in three days) while evolving into **large-scale residential proxy networks** for cybercrime monetization. Since October 2025, **over 550 C2 nodes** tied to both botnets were **null-routed** by Black Lotus Labs, disrupting operations but revealing their resilience. Kimwolf’s infrastructure—hosted on providers like **Resi Rack LLC** (linked to a **Discord-based proxy marketplace**)—exploited **exposed ADB services** and **proxy service flaws** to hijack devices, while Aisuru’s IoT army targeted **telecom, financial services, AI firms, and automotive sectors**. Both botnets share **operators (Snow, Tom, Forky)**, **code-signing certificates**, and **EtherHiding (ENS domains)** for C2 resilience, with Kimwolf’s **96% of commands** dedicated to proxy services. Collateral damage includes **disruptions to U.S. ISPs, critical infrastructure, and global DNS services**, with **Cloudflare and Microsoft** mitigating thousands of hyper-volumetric attacks. The botnets’ **rapid tactical shifts**—from DDoS to proxy monetization—underscore their systemic risk to internet stability, now compounded by **automated router exploitation** (e.g., 832 KeeneticOS devices in Russia) and **cross-botnet collaboration**.

Open in new tab

Critical OS Command Injection Vulnerability in FortiSIEM (CVE-2025-64155) Exploited in the Wild

Updated: 14.01.2026 20:51 · First: 13.08.2025 14:37 · 📰 5 src / 7 articles

Fortinet has disclosed a critical OS command injection vulnerability in FortiSIEM, identified as CVE-2025-64155. The flaw, with a CVSS score of 9.4, allows unauthenticated attackers to execute unauthorized code or commands via crafted TCP requests. The vulnerability affects Super and Worker nodes in FortiSIEM versions 6.7.0 through 6.7.10, 7.0.0 through 7.0.4, 7.1.0 through 7.1.8, 7.2.0 through 7.2.6, 7.3.0 through 7.3.4, and 7.4.0. The flaw involves an unauthenticated argument injection vulnerability leading to arbitrary file write and a file overwrite privilege escalation vulnerability leading to root access. Fortinet advises upgrading to the latest versions and limiting access to the phMonitor port (7900) as a workaround. Additionally, a Fortinet FortiWeb path traversal vulnerability is being actively exploited to create new administrative users on exposed devices without requiring authentication. The vulnerability was silently patched in FortiWeb version 8.0.2. The exploitation activity was first detected early last month, and Fortinet has not assigned a CVE identifier or published an advisory on its PSIRT feed. Rapid7 observed an alleged zero-day exploit targeting FortiWeb was published for sale on a popular black hat forum on November 6, 2025. The watchTowr team has released an artifact generator tool for the authentication bypass to help identify susceptible devices.

Open in new tab

Verizon Wireless Outage Disrupts Cellular Service Nationwide

Updated: · First: 14.01.2026 20:27 · 📰 1 src / 1 articles

Verizon Wireless experienced a widespread outage in the US, causing phones to enter SOS mode and lose cellular service. The outage began around 12 PM ET and affected customers across the country. Affected users could only make emergency calls, and attempts to contact them resulted in an 'unavailable' message.

Open in new tab

Aikido Security Secures $60M in Series B Funding

Updated: · First: 14.01.2026 20:01 · 📰 1 src / 1 articles

Aikido Security, a Belgium-based startup focused on developer-centric security solutions, has raised $60 million in a Series B funding round, achieving a $1 billion valuation. The funding was led by DST Global, with additional participation from PSG Equity, Notion Capital, and Singular. The capital will be used to enhance and expand Aikido's security platform, which integrates scanning, code-to-cloud visibility, offensive security testing, and runtime defense capabilities. The platform is reportedly used by over 100,000 teams. The company emphasizes the need for continuous, adaptive, and autonomous security measures to keep pace with modern software development cycles, which have significantly shortened from months to minutes.

Open in new tab

Microsoft Releases November and December 2025 Patch Tuesday Updates for Windows 11

Updated: 14.01.2026 18:44 · First: 14.10.2025 20:46 · 📰 7 src / 10 articles

Microsoft has released Windows 11 cumulative updates KB5074109 and KB5073455 for versions 25H2/24H2 and 23H2. These updates address security vulnerabilities and various issues, including fixes for compatibility, networking, power & battery, Secure Boot, Windows Deployment Services, and WinSqlite3.dll. New features introduced include various bug fixes and improvements. The updates are mandatory and include the January 2026 Patch Tuesday security patches. Microsoft has also resolved a known issue causing security applications to incorrectly flag WinSqlite3.dll as vulnerable to CVE-2025-6965. The issue affected various Windows platforms, including Windows 10, Windows 11, and Windows Server 2012 through Windows Server 2025. Microsoft updated WinSqlite3.dll in the January 13, 2026 updates to address false positive detections. Additionally, Microsoft has released the KB5072753 out-of-band cumulative update to fix a known issue causing the November 2025 KB5068966 hotpatch update to reinstall on Windows 11 systems repeatedly. This update is recommended for Windows 11, version 25H2 devices instead of the November 2025 hotpatch update (KB5068966). Microsoft has announced that it will not release optional updates in December, but Patch Tuesday updates will continue as scheduled. Nvidia has confirmed that the October 2025 Windows 11 updates (KB5066835) cause gaming performance issues on Windows 11 24H2 and 25H2 systems. Nvidia released the GeForce Hotfix Display Driver version 581.94 to address these issues. The October updates also caused other issues such as broken localhost HTTP connections, smart card authentication problems, and broken Windows Recovery Environment (WinRE) on systems with USB mice and keyboards.

Open in new tab

AI Agents as Privilege Escalation Paths in Enterprise Environments

Updated: · First: 14.01.2026 17:07 · 📰 1 src / 1 articles

AI agents, now integral to enterprise workflows, are becoming powerful intermediaries that can bypass traditional access controls, leading to unintended privilege escalation. These agents, designed for broad access across multiple systems, operate under shared credentials and execute actions on behalf of users, often with permissions exceeding individual user authorizations. This creates security blind spots and complicates accountability and audit trails.

Open in new tab

DeadLock Ransomware Campaign Uses BYOVD to Evade Security Tools

Updated: 14.01.2026 16:20 · First: 09.12.2025 18:00 · 📰 2 src / 3 articles

A financially motivated threat actor has been observed deploying DeadLock ransomware using a Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint detection tools and achieve full system compromise. The attack involved privilege-escalation scripts, registry modifications, remote access tools (RATs), and a custom encryption routine. The ransomware targeted various applications and services while avoiding critical system files to maintain system functionality for ransom negotiations. Victims were instructed to pay ransom in Bitcoin or Monero via Session Messenger. The latest DeadLock samples observed by Group-IB include an HTML file used to communicate with victims through the Session encrypted messaging platform. Instead of relying on hard-coded servers, the malware retrieves proxy addresses stored inside a Polygon smart contract. This approach uses read-only calls that do not generate transactions or incur network fees, complicating traditional blocking approaches. The JavaScript code within the calls queries a specific Polygon smart contract to obtain the current proxy URL, which then relays encrypted messages between the victim and the attacker’s Session ID.

Open in new tab