TLDR INFORMATION SECURITY 2026-01-30

OPENSSL ISSUED SECURITY UPDATES TO FIX 12 FLAWS, INCLUDING REMOTE CODE EXECUTION

OpenSSL patched 12 vulnerabilities in its widely used cryptographic library, most of which involve memory safety and parsing weaknesses that can cause denial-of-service or data-integrity issues. Two critical stack-overflow bugs in CMS/PKCS#7 and PKCS#12 parsing can potentially enable remote code execution when handling untrusted data, making timely updates essential for organizations relying on OpenSSL 3.x.

FORTINET CONFIRMS NEW ZERO-DAY BEHIND MALICIOUS SSO LOGINS

CVE-2026-24858 is a critical authentication-bypass vulnerability (CVSS 9.8) that affects FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. It allows attackers to log in to devices via FortiCloud SSO. The zero-day, added to CISA's KEV catalog, emerged after reports that the December CVE-2025-59718 patch was being bypassed, prompting Fortinet to temporarily disable FortiCloud SSO globally on January 26. Organizations should immediately upgrade affected products. FortiCloud SSO now blocks login attempts from vulnerable device versions.

MATCH GROUP BREACH EXPOSES DATA FROM HINGE, TINDER, OKCUPID, AND MATCH

Match Group has confirmed that a “limited amount of user data” was stolen after ShinyHunters claimed a breach of 1.7GB of stolen files allegedly containing 10M records. The attackers stole data after compromising an Okta SSO account, which gave them access to the company's AppsFlyer marketing analytics platform and to Google Drive and Dropbox accounts. The hackers stated that while the data contains some PII, it's mostly tracking data.

CORRUPTING THE HIVE MIND: PERSISTENCE THROUGH FORGOTTEN WINDOWS INTERNALS

Swarmer is a low‑privilege tool that quietly edits Windows user registry hives without triggering common EDR hooks on standard registry APIs. Swarmer builds offline registry hives with Offreg.dll by abusing legacy mandatory user profiles and the NTUSER.MAN mechanism, enabling per‑user persistence that survives reboots while largely evading traditional monitoring. This post walks through the workflow, implementation quirks, operational caveats, and both defensive detection opportunities and attacker takeaways around this forgotten Windows feature set.

HOW REP+ HELPED ME IDENTIFY A CRITICAL SUPABASE JWT EXPOSURE

A security researcher discovered a critical Supabase misconfiguration in which an anonymous JWT embedded in client-side JavaScript granted read access to password_reset_tokens and 34 other tables due to missing Row Level Security (RLS) policies. The exposure of 272 password reset tokens and plaintext passwords enabled a full account takeover, demonstrating how publicly intended anonymous keys become dangerous when RLS is improperly configured. Security teams should audit Supabase deployments by enumerating REST endpoints with anon tokens and validating RLS enforcement across all exposed tables.

BUILDING CRYPTOGRAPHIC AGILITY INTO SIGSTORE

Trail of Bits collaborated with the Sigstore community to implement controlled cryptographic flexibility through predefined algorithm suites, avoiding the in-band signaling vulnerabilities that plagued systems like JWT while enabling organizations to select signing algorithms beyond the original hard-coded ECDSA P-256. The implementation includes a centralized algorithm registry in Protobuf specifications, configurable algorithm restrictions via --client-signing-algorithms flags in Rekor and Fulcio, and a new --signing-algorithm option in Cosign for ephemeral key generation. Go implementations of post-quantum algorithms, LMS, and ML-DSA were developed to validate that the architecture can accommodate future cryptographic standards.

REIN SECURITY (PRODUCT LAUNCH)

Rein Security provides in-app runtime protection that baselines normal application behavior and blocks anomalous actions in real time, closing the production visibility gap for modern and AI-driven applications.

CYBERSECURITY-PROJECTS

60 cybersecurity projects, certification roadmaps, and everything you need to build your cybersecurity portfolio

FRIDAC2MCP

FridaC2MCP is an MCP server that exposes Frida's dynamic instrumentation capabilities as a remote server.

US SENTENCES CHINESE NATIONAL FOR ROLE IN $36.9 MILLION CRYPTO SCAM

Jingliang Su, a Chinese national, was sentenced to 46 months in prison for his role in a Cambodia-based cryptocurrency investment scam that defrauded 174 Americans of $36.9 million through fake trading platforms and romance-based social engineering. The operation laundered stolen funds through US shell companies and offshore accounts before converting them to Tether cryptocurrency via Deltec Bank in the Bahamas. Su is one of nine defendants who pleaded guilty, and he was ordered to pay $26.8 million in restitution.

WHY THE MITRE ATT&CK FRAMEWORK ACTUALLY WORKS

The MITRE ATT&CK framework can help SOC teams understand behaviors as opposed to isolated data points from alerts. SOC teams can also utilize SIEM tools that map detection rules to ATT&CK tactics to understand their detection coverage. This enables SOC teams to shift from chasing alerts to observing narratives.

FINTECH FIRM MARQUIS BLAMES HACK AT FIREWALL PROVIDER SONICWALL FOR ITS DATA BREACH

Fintech data broker Marquis has pinned a major 2025 ransomware breach on firewall supplier SonicWall, claiming a SonicWall cloud backup hack exposed its firewall configurations and credentials. Hackers allegedly used this data to bypass defenses and steal sensitive US banking customer information, including Social Security numbers. Marquis is weighing legal and financial recoupment options, while SonicWall publicly disputes any proven link to broader ransomware campaigns.

instantly. See how it works.

NOTORIOUS RUSSIA-BASED RAMP CYBERCRIME FORUM APPARENTLY SEIZED BY FBI

The FBI has seized RAMP, a notorious Russian cybercrime forum used by ransomware groups and initial access brokers.

INTRODUCING THE 2025 WIN PARTNER INDEX

Wiz's new annual WIN Partner Index is a data-driven benchmark that analyzes adoption patterns across 240+ integrations to identify which cloud security integrations organizations rely on most, which are gaining traction fastest, and where teams see consistent value.

RESEARCHERS FIND 175,000 PUBLICLY EXPOSED OLLAMA AI SERVERS ACROSS 130 COUNTRIES

Researchers uncovered 175,000 exposed Ollama AI servers worldwide.