TLDR INFORMATION SECURITY 2026-01-28

you one less thing to lose sleep over. Try Bitwarden free today

KUBERNETES REMOTE CODE EXECUTION VIA NODES/PROXY GET PERMISSION

An authorization bypass in Kubernetes allows service accounts with nodes/proxy GET permissions to execute commands in any Pod across the cluster, potentially leading to full cluster compromise. The vulnerability stems from the Kubelet authorizing WebSocket connections based on the initial HTTP GET handshake rather than verifying CREATE permissions for the /exec endpoint, affecting 69 Helm charts, including Prometheus, Datadog, Grafana, and Cilium. Kubernetes Security Team closed this as "Won't Fix (Working as Intended)," recommending migration to KEP-2862's fine-grained authorization when it reaches GA in April.

NETSUPPORT MANAGER 0-DAY VULNERABILITIES ENABLE REMOTE CODE EXECUTION

Two critical vulnerabilities in NetSupport Manager (CVE-2025-34164 and CVE-2025-34165) can be chained to achieve unauthenticated remote code execution through the software's undocumented broadcast feature, which operates on TCP port 5405 without requiring authentication. The flaws—a heap-based out-of-bounds write and a stack-based out-of-bounds read—enable attackers to bypass ASLR, perform arbitrary memory writes, and gain remote shell access, posing a significant risk to Operational Technology (OT) environments where the software is commonly deployed. Organizations should upgrade to version 14.12.0000 or later and restrict access to port 5405 as an interim mitigation.

CANVA AMONG ~100 TARGETS OF SHINYHUNTERS OKTA IDENTITY-THEFT CAMPAIGN

ShinyHunters is running an Okta single sign-on credential-stealing campaign against roughly 100 high-value organizations, including Canva, Atlassian, RingCentral, and others. The group uses evolved voice phishing to capture SSO logins, enroll its own devices in MFA, pivot into SaaS apps, exfiltrate data, and then extort victims. There is no confirmation of which named firms were successfully breached.

WHO OPERATES THE BADBOX 2.0 BOTNET?

A leaked screenshot from Kimwolf botnet operators revealed they had compromised the Badbox 2.0 control panel, exposing seven authorized user email addresses that OSINT investigation traced to Chen Daihai and Zhu Zhiyu of Beijing Astrolink Wireless Digital Technology—individuals whose domains were previously flagged in HUMAN Security's Badbox 2.0 report. The investigation used password reuse across breach databases, domain registration records, and social media pivots to connect qq.com email addresses to multiple Chinese technology companies distributing pre-infected Android TV boxes. This unauthorized access allows Kimwolf to bypass residential proxy mitigations by loading malware directly onto Badbox 2.0's 10+ million compromised devices.

HOW TO ENCRYPT YOUR PC'S DISK WITHOUT GIVING THE KEYS TO MICROSOFT

BitLocker encrypts Windows PCs to protect data, but many systems automatically store recovery keys with Microsoft when users sign in with a Microsoft account, creating a potential privacy risk if authorities obtain those keys. By upgrading to Windows 11 Pro, users can fully control BitLocker, decrypt any existing Microsoft-managed setup, and re-encrypt the drive while saving the recovery key locally, such as on paper or an external drive, rather than in the cloud.

LLM KEY SERVER: PROVIDING SECURE AND CONVENIENT ACCESS TO INTERNAL LLM APIS

Mercari's AI Security team developed a key server to address the challenge of managing API key-based access to LLMs. The key server uses Google Workspace and Google Cloud for OIDC authentication to LiteLLM, which provides time-limited API access to various models through a unified API. The team also developed an internal CLI, GitHub Action, and Google Apps Script template to support adoption of the LLM key server.

AGENT OS

Agent OS applies operating system concepts to AI agent governance, providing kernel-level policy enforcement that intercepts and blocks actions before execution rather than relying on prompt-based safety. The framework includes POSIX-inspired primitives such as signals, a virtual filesystem for agent memory, cross-model verification, inter-agent trust protocols with cryptographic signing, and integrations with LangChain, CrewAI, and OpenAI Assistants. An MCP server enables integration between Claude Desktop and tools for verification and kernel execution.

AWESOME HACKING

Awesome hacking is a curated list of hacking tools for hackers, pentesters, and security researchers. Its goal is to collect, classify, and make awesome tools easy to find by humans, creating a toolset you can checkout and update with one command.

ZEROPULSE

ZeroPulse is a comprehensive C2 platform that utilizes CloudFlare Tunnel technology. It is designed for secure remote management and monitoring.

WHY HAS MICROSOFT BEEN ROUTING EXAMPLE.COM TRAFFIC TO A COMPANY IN JAPAN?

Microsoft's autodiscover service was found routing email traffic for example.com—a domain reserved for testing under RFC2606—to subdomains belonging to Sumitomo Electric in Japan, potentially causing test credentials to be sent outside Microsoft's network. The misconfiguration, which may have persisted for five years, has been suppressed, but Microsoft has not explained how the Japanese company's servers were added to its network configuration. The incident raises concerns about other potential misconfigurations following Microsoft's 2024 breach, where forgotten test account privileges enabled Russian state hackers to monitor executive emails.

BROWSER-BASED ATTACKS HIT 95% OF ENTERPRISES — AND TRADITIONAL SECURITY TOOLS NEVER SAW THEM COMING

95% of organizations experienced browser-based attacks last year that evaded traditional security tools. Attackers operated inside trusted sessions where web gateways, cloud access brokers, and endpoint protection lose visibility after login. Recent incidents, including ShadyPanda's weaponized extensions and Cyberhaven's supply chain compromise, demonstrate how attackers exploit browser auto-updates and session tokens rather than zero-days. Security leaders recommend inventorying extensions, implementing 48-72 hour auto-update delays, and moving data protection to the browser layer, where 64% of encrypted traffic currently goes uninspected.

NOYB WIN: MICROSOFT ORDERED TO STOP TRACKING SCHOOL CHILDREN

Austria's data protection authority ruled that Microsoft illegally placed tracking cookies on a pupil's device through Microsoft 365 Education, using them to analyse behaviour, collect browser data, and support advertising. The authority ordered Microsoft to stop tracking the child within four weeks and rejected Microsoft's attempt to shift responsibility to its Irish subsidiary.

HACKERS CAN BYPASS NPM'S SHAI-HULUD DEFENSES VIA GIT DEPENDENCIES

Researchers discovered "PackageGate" vulnerabilities in JavaScript package managers that allow bypassing npm's '--ignore-scripts' defense via malicious .npmrc files in Git dependencies, with pnpm, vlt, and Bun issuing patches while npm rejected the report as expected behavior.

GOOGLE WILL SETTLE ITS ASSISTANT SPYING LAWSUIT FOR $68 MILLION

Google has agreed to pay $68 million to resolve a class action lawsuit over “false accepts,” when Google Assistant devices recorded audio without users intentionally saying “Ok Google.”

'STANLEY' TOOLKIT TURNS CHROME INTO UNDETECTABLE PHISHING VECTOR

A new malware-as-a-service kit called Stanley generates malicious Chrome extensions that overlay convincing phishing pages on top of real sites while keeping the legitimate URL visible through a fake productivity extension.