TLDR INFORMATION SECURITY 2026-01-23

HIBP ADDS ALLEGED UNDER ARMOUR DATA BREACH IMPACTING 72 MILLION EMAILS

Have I Been Pwned added an alleged Under Armour breach attributed to the Everest ransomware group that exposed 72.7 million unique email addresses along with names, dates of birth, physical addresses, and purchase history from a 343GB exfiltration in November. The data was published after Under Armour reportedly did not pay the ransom, with the dataset now circulating on underground forums and indexed by DeHashed. Affected users should monitor for targeted phishing impersonating order-related communications and change reused passwords.

CISCO FIXES UNIFIED COMMUNICATIONS RCE ZERO-DAY EXPLOITED IN ATTACKS

Cisco has announced a new vulnerability impacting United Communications, Cisco Unity Connection, and Webex Calling Dedicated Instance. The vulnerability is due to improper validation of user-supplied input in HTTP requests that could allow an attacker to obtain access to the underlying system via a sequence of specially crafted HTTP requests. The patches are version-specific, so admins should check the README before applying patches.

HACKERS EXPLOIT SECURITY TESTING APPS TO BREACH FORTUNE 500 FIRMS

Automated pentest company Pentera discovered nearly 2K instances of exposed security testing apps, such as OWASP Juice Shop and DVWA, publicly exposed in the networks of Fortune 500 companies. Many of these web apps are used for security training and are deployed in cloud environments with overly permissive IAM roles and default credentials. Pentera found evidence that 20% of exposed DVWA apps had malicious artifacts such as webshells and cryptominers deployed.

IS THAT ALLOWED? AUTHENTICATION AND AUTHORIZATION IN MODEL CONTEXT PROTOCOL

Remote MCP servers should implement the OAuth 2.1 Authorization Code grant with PKCE for client authentication, leveraging protected resource metadata (RFC 9728) and authorization server discovery (RFC 8414) for the handshake. The 2025-11-25 MCP specification introduces step-up authorization for scope negotiation and recommends Token Exchange for downstream service authentication, while explicitly prohibiting token passthrough. Organizations deploying MCP servers should design granular scopes with clear read/write/delete separation, ensure short-lived access tokens, and implement proper validation, including checks for issuer, audience, and expiration.

VULNERABILITY PRIORITIZATION BEYOND THE CVSS NUMBER

CVSS scores alone fail to capture how vulnerabilities propagate through interconnected systems. Log4Shell is an example in which widespread nested dependencies, not just technical severity-driven impact, are at play. The Unified Linkage Model (ULM) framework evaluates vulnerabilities based on adjacency, inheritance, and trust relationships to identify "blast radius multipliers," such as SSO services or CI/CD pipelines. Security teams should map system dependencies and prioritize patching vulnerabilities near identity systems and shared services that can amplify downstream risk.

KEEPING SECRETS OUT OF LOGS

Secrets often end up in logs from a variety of sources, such as forgotten debugging lines, excessive error logging, and telemetry. Some fixes include architecting to reduce logging sinks, using domain primitives to abstract secrets, using read-once objects, using log preprocessors, adding unit tests, and implementing taint tracking. To prepare for a logging overhaul, teams should first lay the foundations of the initiative, understand the data flow, protect data at choke points, apply defense-in-depth, and plan for response and recovery in the event of leaked secrets.

of cloud orgs. Join the live discussion + Q&A

MITRE LAUNCHES NEW SECURITY FRAMEWORK FOR EMBEDDED SYSTEMS

The Embedded Systems Threat Matrix (ESTM) 3.0 is an ATT&CK-inspired framework that categorizes attack tactics and techniques specific to hardware and firmware environments. The framework supports cyber threat modeling and attack path analysis for industries including energy, robotics, industrial controls, transportation, and healthcare, and integrates with the EMB3D Threat Model. Security teams protecting embedded systems should evaluate ESTM to identify vulnerabilities in their embedded architectures.

PATHFINDING.CLOUD (WEB APP)

Pathfinding.cloud is a web app from DataDog that collects tools and guides to detect IAM-based privilege-escalation attacks in AWS.

APPCONTROL MANAGER

AppControl Manager provides a GUI to manage App Control and Code Integrity on your local or remote devices.

DON'T TRIP[WIRE] YOURSELF: TESTING ERROR RECOVERY IN ZIG

Tripwire is a Zig library for injecting failures at named points in code to test `errdefer` error handling paths, which are typically untested and a consistent source of resource leaks and memory corruption. The library uses comptime to completely optimize away in non-test builds, producing zero runtime cost in production. Integration into Ghostty immediately uncovered approximately six `errdefer` bugs that had never manifested in production.

VULNCHECK STATE OF EXPLOITATION 2026

VulnCheck identified 884 Known Exploited Vulnerabilities in 2025, with 28.96% exploited on or before CVE publication, up from 23.6% in 2024, highlighting the continued prevalence of zero-day and rapid n-day exploitation. Network edge devices such as firewalls, VPNs, and proxies were the most targeted technologies, followed by content management systems and open source software. Organizations should prioritize the timely remediation of newly disclosed vulnerabilities affecting internet-facing infrastructure while maintaining visibility beyond CISA KEV through additional exploitation intelligence sources.

THE PSYCHOLOGY OF BAD CODE

This post is the first part of a series that applies behavioral economics to developer processes. Developers want to write secure code but are often overwhelmed by competing priorities. Security teams should design technical nudges, shift incentives, and push for cultural changes to help developers write secure code.

GOOGLE ROLLS OUT AI DETECTION AND RANSOMWARE DEFENSES FOR SCHOOLS

Google expanded its SecOps data connector to Education Plus and Education Standard tiers, adding AI detection tools and ransomware defenses amid reports that 82% of K-12 organizations experienced cyber threats in the past 18 months.

CLAUDE FINDS 353 ZERO-DAYS ON PACKAGIST

Sansec's AI-powered security pipeline using Claude Opus 4.5 discovered 353 confirmed zero-day vulnerabilities across 5,000 Magento extensions on Packagist, including RCE, SQL injection, and authentication bypass flaws affecting packages with 5.9 million total downloads.

PWN2OWN AUTOMOTIVE 2026 - DAY TWO RESULTS

Day Two of Pwn2Own Automotive 2026 awarded $439,250 for 29 unique zero-day vulnerabilities across EV chargers and in-vehicle infotainment systems, bringing the event total to $955,750 and 66 vulnerabilities.