Search the archive

SECURING DIGITAL ASSETS IN AN EVOLVING THREAT LANDSCAPE: THE FIREBLOCKS DEFENSE-IN-DEPTH APPROACH TO SECURITY

HACKERS OFFER TO SELL MILLIONS OF EURAIL USER RECORDS

Hackers claim to have stolen 1.3 TB of data from Eurail's AWS S3, Zendesk, and GitLab, including source code, support tickets, and database backups with personal data on potentially millions of Eurail and Interrail customers. Exposed fields range from contact and passport details to health and bank data for DiscoverEU travelers.

INFOSTEALER STEALS OPENCLAW AI AGENT CONFIGURATION FILES AND GATEWAY TOKENS

An infostealer, likely a Vidar variant, exfiltrated OpenClaw config files containing gateway tokens, device keys, and an AI agent “soul,” enabling remote access and identity hijacking. Meanwhile, malicious ClawHub skills, exposed OpenClaw instances with RCE potential, and persistent Moltbook accounts are growing attacker interest as OpenClaw's ecosystem rapidly scales.

MICROSOFT ALERTS ON DNS-BASED CLICKFIX VARIANT DELIVERING MALWARE VIA NSLOOKUP

There is a new ClickFix variant that uses nslookup commands via the Windows Run dialog to retrieve and execute second-stage payloads through DNS, ultimately deploying the Python-based ModeloRAT remote access trojan.

CISA GIVES FEDS 3 DAYS TO PATCH ACTIVELY EXPLOITED BEYONDTRUST FLAW

CISA added BeyondTrust's actively exploited OS command-injection flaw (CVE-2026-1731) to its KEV catalog, ordering federal agencies to patch Remote Support and Privileged Remote Access instances by February 16, as approximately 8,500 on-premises deployments remain exposed.

SPAIN ORDERS NORDVPN AND PROTONVPN TO BLOCK LALIGA STREAM PIRACY

A Spanish court ordered NordVPN and ProtonVPN to block 16 piracy websites under the EU Digital Services Regulation, with both providers contesting the ruling as procedurally invalid since neither was notified or given the opportunity to defend themselves.

Try Bitwarden Free Today

RESEARCHERS UNEARTH 30-YEAR-OLD VULNERABILITY IN LIBPNG LIBRARY

A heap buffer overflow (CVE-2026-25646, CVSS 8.3) in the libpng library, present since its inception nearly 30 years ago, has been patched in version 1.6.55. The flaw lies in the png_set_quantize function, which is used to reduce color in PNG images. Exploitation requires careful heap grooming and crafted-but-valid PNG files, potentially leading to crashes, information leakage, or remote code execution on unpatched systems that use the widely bundled Linux/Unix library. Although the rarely used vulnerable function lowers practical severity, security experts warn that AI-powered bug-hunting tools are accelerating the discovery of similar dormant vulnerabilities across open-source libraries, increasing the risk of threat-actor exploitation before coordinated disclosure.

LIGHTLLM: UNAUTHENTICATED RCE VIA PICKLE DESERIALIZATION IN WEBSOCKET ENDPOINTS

A critical unauthenticated RCE vulnerability (CVE-2026-26220, CVSS 9.3) has been revealed in LightLLM, a widely used LLM inference engine with 3,890 GitHub stars. The flaw involves WebSocket endpoints in the prefill-decode disaggregation system calling pickle.loads() on unauthenticated binary frames, and the server code explicitly disallows binding to localhost, exposing the server to network threats by design. This vulnerability mirrors CVE-2025-32444 (CVSS 10.0) in vLLM and underscores a broader issue of insecure deserialization across ML inference frameworks, as disaggregated serving architectures create additional attack surfaces between nodes. Organizations using LightLLM in PD mode should immediately restrict network access to WebSocket endpoints, as the maintainers have largely ignored security reports for nearly a year without providing a fix.

NEW CHROME ZERO-DAY (CVE-2026-2441) UNDER ACTIVE ATTACK — PATCH RELEASED

Google patched CVE-2026-2441 (CVSS 8.8), a use-after-free vulnerability in Chrome's CSS engine actively exploited in the wild, marking the first Chrome zero-day of 2026. The flaw allowed remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages in versions prior to 145.0.7632.75. Users should immediately update Chrome on all platforms, and organizations using Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi should apply fixes as they become available.

TRACKING DIGITSTEALER: HOW OPERATOR PATTERNS EXPOSED C2 INFRASTRUCTURE

An infrastructure analysis of DigitStealer, a macOS infostealer targeting 18 cryptocurrency wallets and Apple M2 devices, revealed that the operator's consistent use of a single Swedish ASN (ab stract ltd), Tucows domain registration, Njalla nameservers, and identical OpenSSH versions created a fingerprint that enabled clustering of previously unreported C2 domains. The malware operates as a persistent backdoor via Launch Agent, polling C2 endpoints every 10 seconds and using a cryptographic challenge-response mechanism for anti-analysis, while communicating over four distinct API endpoints for credential theft, file exfiltration, and command execution. The infrastructure uniformity strongly suggests a closed, single-operator campaign rather than a MaaS model — a reminder that when threat actors prioritize efficiency over operational security, defenders can exploit these patterns to proactively identify and burn C2 assets.

THE CISO'S CRAFT: WATCHMAKER OR GARDENER?

This post examines two distinct models of CISO leadership: the Watchmaker, which focuses on precision, strict controls, and auditability, and the Gardener, which promotes an adaptable security culture, team empowerment, and organizational resilience. The Watchmaker style works well in regulated settings but can lead to rigidity and burnout. In contrast, the Gardener encourages shared responsibility but depends on high organizational trust and long-term cultural commitment. The most successful CISOs combine elements of both—building strong foundational controls while fostering an adaptable security environment that evolves with emerging threats.

KEY OPENCLAW RISKS, CLAWDBOT, MOLTBOT

OpenClaw, previously known as Clawdbot, is a viral open-source AI assistant flagged as a major insider threat due to security flaws such as CVE-2026-25253 (CVSS score 8.8), insecure defaults (e.g., disabled authentication), plaintext secret storage, and a malicious skills ecosystem targeted by infostealers such as RedLine and AMOS. Its design includes privileged host access, exposure to untrusted data, and external communication capabilities. Organizations should detect OpenClaw through specific file paths, network signatures, and unusual OAuth activity, while reducing shadow AI risks with application allowlisting, least-privilege policies, isolated deployments, and transparent usage policies with staff training.

SEE HOW HAPROXY PROTECTED CUSTOMERS FROM REACT2SHELL.

AWS-CONFIG-D

aws-config-d splits the monolithic ~/.aws/config file into per-organization files under a config.d/ directory, automatically concatenating them via a shell hook on session start — useful for security teams and consultants managing SSO profiles across multiple AWS organizations. The tool includes SHA-256 drift detection that warns when external changes (such as aws configure sso) modify the config outside the managed workflow, preventing silent overwrites of carefully scoped access configurations. It supports bash, zsh, and fish with zero dependencies and ships with 42 containerized tests covering rebuild triggers, migration, and idempotency.

KASADA (PRODUCT LAUNCH)

Kasada is a cloud-based anti-bot security platform that protects websites, APIs, and mobile apps from malicious automated traffic such as scraping, credential stuffing, account takeover, and online fraud using adaptive, invisible bot detection instead of CAPTCHAs.

SANDBOXEXEC

A lightweight command sandbox for Linux, secure-by-default, built on Landlock. Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling.

AMAZON SCRAPS PARTNERSHIP WITH SURVEILLANCE COMPANY AFTER SUPER BOWL AD BACKLASH

Ring has canceled a planned integration with Flock Safety after public backlash over a Super Bowl ad featuring AI-powered neighborhood tracking and broader concerns about a “dystopian” surveillance ecosystem. The integration never launched, so no customer footage was shared. The controversy amplified scrutiny of Ring's facial recognition features and Flock's vast license-plate tracking network amid mounting privacy and civil liberties criticism.

DUTCH COPS ARREST MAN AFTER SENDING HIM CONFIDENTIAL FILES BY MISTAKE

Dutch police accidentally gave a Ridderkerk man access to confidential documents by sending a download instead of an upload link, then arrested him for refusing to delete them without compensation. Officers seized his devices, reported a data breach, and charged him with unauthorized access.

260K+ CHROME USERS DUPED BY FAKE AI BROWSER EXTENSIONS

More than 30 lookalike Chrome extensions posing as AI assistants have siphoned email, browser data, and sensitive inputs from over 260,000 users, including corporate environments. Attackers embed a full-screen iframe that proxies real LLM APIs while exfiltrating content and API keys, evading Chrome Web Store review due to minimal local permissions and off-platform malicious logic.

MICROSOFT BLOCKS CREDENTIAL AUTOFILL TO FIX WINDOWS HELLO FLAW

Microsoft's February 2026 Patch Tuesday blocked credential autofill in Windows 11 remote desktop and screen-sharing tools to address CVE-2026-20804, a Windows Hello tampering flaw demonstrated at Black Hat 2025 that allowed attackers to inject biometric data and bypass authentication without detection.

SKILLAUDIT (WEB APP)

Paste a repo, and get an instant report on the vulnerabilities of the skill files.

OPERATION DOPPELBRAND WEAPONIZES TRUSTED BRANDS FOR CREDENTIAL THEFT

Operation DoppelBrand is a GS7-run phishing operation that abuses lookalike domains and cloned portals of major US banks, insurers, and tech firms to steal credentials and device data, then pipe them into Telegram for triage.

Get the guide

OVER 300 MALICIOUS CHROME EXTENSIONS CAUGHT LEAKING OR STEALING USER DATA

Researchers discovered more than 300 malicious Chrome extensions with 37.4 million combined downloads that leaked browsing history, injected iframes, and stole user data. 153 extensions were confirmed to exfiltrate browser history immediately upon installation. A separate LayerX report identified 30 extensions disguised as AI tools that share identical internal structures and backend infrastructure, with 15 specifically targeting Gmail to extract email content and transmit it to third-party servers. Organizations should audit installed browser extensions against published indicators, enforce extension allowlisting policies, and monitor for anomalous network traffic originating from browser processes.

TOP DUTCH TELCO ODIDO ADMITS 6.2M CUSTOMERS CAUGHT IN CONTACT SYSTEM CAPER

Dutch mobile operator Odido has reported a breach of its customer contact system that exposed data on about 6.2 million people, including names, contact details, bank account information, and ID information, but not passwords, call, or billing data. Odido is notifying victims with tailored messages, warning about likely phishing, impersonation, and fake invoices.

ALL US SOCIAL SECURITY NUMBERS MAY NEED TO BE CHANGED FOLLOWING A MASSIVE BREACH THAT IS ALREADY BEING INVESTIGATED AS A NATIONAL THREAT

A whistleblower alleges a federal tech team improperly cloned the master Social Security database into a poorly governed cloud, potentially exposing rich identity data on 300+ million Americans and enabling long‑term fraud. Lawmakers have demanded criminal investigations. Officials insist that core systems remain secure.

THE FOUNDATION PROBLEM: HOW A LACK OF ACCOUNTABILITY IS DESTROYING CYBERSECURITY

Cybersecurity's perceived talent shortage is actually a leadership accountability gap. The Navy trains 18-year-olds to operate nuclear reactors in 18 months through structured programs, while the security industry demands unrealistic experience requirements and refuses to invest in developing junior talent. There are three compounding failures: superficial root-cause analysis that never addresses underlying issues, unchecked technical debt that leaders fail to translate into business risk, and the promotion of technical staff to management roles without leadership training. Security leaders should build structured development paths, conduct rigorous post-incident analysis, and advocate for addressing technical debt as a core business risk rather than accepting recurring failures as inevitable.

PRODUCT ENGINEERING TEAMS MUST OWN SUPPLY CHAIN RISK

Modern software is assembled from third-party services, open-source packages, and CI/CD tooling, turning the supply chain into a primary attack surface rather than a background detail. Attacks like malicious dependency updates exploit implicit trust in external code and can silently compromise products, credentials, and customer data at scale. Product teams must treat supply chain integrity as a top priority, using provenance, cryptographic attestations, and the SLSA framework to verify where software comes from and how it was built.

CONSUMER PROTECTION TUESDAY: HOW COINBASE SAFEGUARDS PII USING MPC ENCRYPTION

Coinbase's CoreKMS Encryption Service uses Multi-Party Computation (MPC) to protect PII by deriving ephemeral encryption keys on demand through Distributed Key Generation, ensuring no single party ever holds the complete master key. The system employs AES-GCM-SIV for deterministic, authenticated, field-level encryption of sensitive data such as SSNs, enabling secure querying and indexing of encrypted records in Snowflake without decrypting the underlying data. The approach demonstrates a practical architecture for organizations that need to balance regulatory compliance requirements, such as state data-match reporting, with strong cryptographic guarantees against key compromise.

AUTHID ANNOUNCES OUT OF THE BOX, BIOMETRIC SECURITY SOLUTION ALIGNED WITH PIV SECURITY FRAMEWORK FOR ENERGY AND OTHER CRITICAL INFRASTRUCTURE

authID has launched a biometric security platform aligned with the federal Personal Identity Verification (PIV) framework, targeting energy utilities and critical infrastructure by replacing passwords and physical tokens with biometric authentication for SCADA consoles, privileged accounts, and contractor access. The platform includes IDX for centralized identity management across employees and third parties, PrivacyKey for cryptographic biometric verification without storing biometric data, and authID Mandate for locking down agentic AI with user-bound audit trails. The release comes amid a 70% year-over-year increase in utility cyberattacks in the US and growing concerns over state-sponsored actors like Volt Typhoon pre-positioning within critical infrastructure networks.

1PASSWORD OPEN SOURCES A BENCHMARK TO STOP AI AGENTS FROM LEAKING CREDENTIALS

SCAM (Security Comprehension and Awareness Measure) is an open-source benchmark from 1Password that tests whether AI agents behave safely in real workflows, such as opening emails, retrieving credentials, and filling out login forms. It addresses the gap where models that can identify phishing when prompted still fall for attacks when operating autonomously. Testing across eight frontier models revealed safety scores ranging from 35% to 92%, with every model exhibiting critical failures, such as entering credentials on phishing pages or forwarding passwords to external parties. However, applying a short security "skill file" dramatically reduced failures across all models. Released under the MIT License, the benchmark includes 30 workplace scenarios, a scoring framework, and video replay tooling to support enterprise AI agent safety evaluation.

MERCATOR

Mercator is an open-source web application designed to manage the mapping of information systems.

SNAIL MAIL LETTERS TARGET TREZOR AND LEDGER USERS IN CRYPTO-THEFT ATTACKS

Threat actors are sending physical letters impersonating Trezor and Ledger security teams, urging hardware wallet users to complete fake "Authentication Check" or "Transaction Check" processes by scanning QR codes that lead to phishing sites designed to steal recovery phrases. The campaign likely leverages customer data exposed in prior Trezor and Ledger data breaches, with phishing domains such as trezor.authentication-check[.]io exfiltrating submitted seed phrases via a backend API endpoint. Hardware wallet manufacturers will never request recovery phrases through mail, email, or websites — seed phrases should only ever be entered directly on the hardware device itself.

GOOGLE LINKS CHINA, IRAN, RUSSIA, NORTH KOREA TO COORDINATED DEFENSE SECTOR CYBER OPERATIONS

Google Threat Intelligence Group (GTIG) has published findings detailing coordinated cyber operations by state-sponsored actors from China, Iran, North Korea, and Russia targeting the defense industrial base (DIB) sector across four key themes: battlefield technology theft tied to the Russia-Ukraine war, employee targeting and hiring process exploitation, edge device compromise by China-nexus groups, and supply chain attacks through manufacturing breaches. Notable activity includes APT44 exfiltrating Signal and Telegram data from devices captured in Ukraine, Lazarus Group's continued Operation Dream Job campaigns against aerospace and defense targets, and Volt Typhoon conducting reconnaissance against North American military contractor login portals. DIB organizations should prioritize secure messaging hygiene, EDR evasion-aware detection strategies, and supply chain integrity monitoring, given the persistent multi-vector nature of these campaigns.

SENEGALESE DATA BREACHES EXPOSE LACK OF SECURITY MATURITY

Ransomware gang Green Blood Group breached Senegal's national biometric ID infrastructure, stealing highly sensitive data, including birth records and ID card details for most of the country's 20 million residents. The incident disrupted ID issuance, exposed weak cyber governance, and sparked fears of long-term fraud and public mistrust in digital government.

OPENSSH POST-QUANTUM CRYPTOGRAPHY

OpenSSH 10.1 now warns users when connections use non-post-quantum key exchange algorithms, encouraging migration to mlkem768x25519-sha256 (default since 10.0) or sntrup761x25519-sha512 to defend against "store now, decrypt later" attacks.

GOOGLE FEARS MASSIVE ATTEMPT TO CLONE GEMINI AI THROUGH MODEL EXTRACTION

Google detected and blocked over 100,000 prompts designed to extract Gemini's proprietary reasoning capabilities for model distillation.

FINTECH LENDING GIANT FIGURE CONFIRMS DATA BREACH

Figure Technology has confirmed a breach after an employee fell for a social engineering attack.

APPLE FIXES ZERO-DAY FLAW USED IN 'EXTREMELY SOPHISTICATED' ATTACKS

Apple patched CVE-2026-20700, an arbitrary code execution vulnerability in dyld (the Dynamic Link Editor) discovered by Google's Threat Analysis Group, which was exploited in targeted attacks against specific individuals running iOS versions before iOS 26, marking the first Apple zero-day patched in 2026. The flaw, chained with two previously patched vulnerabilities (CVE-2025-14174 and CVE-2025-43529), affects iPhone 11 and later, iPad, Mac, Apple TV, Apple Watch, and Vision Pro devices. Fixes are available in iOS 18.7.5, iPadOS 18.7.5, macOS Tahoe 26.3, tvOS 26.3, watchOS 26.3, and visionOS 26.3.

MICROSOFT'S NOTEPAD GOT PWNED (THEY ADDED AI TO IT, SO...)

CVE-2026-20841 (CVSS 8.8) is a command injection flaw in Microsoft's updated Notepad (versions 11.0.0 to 11.2509). The vulnerability arises because the Markdown handler does not validate link content before execution, allowing attackers to execute remote code when users open a malicious .md file and click an embedded link. Public proof-of-concept exploits exist, and the vulnerability is actively being exploited, granting attackers full permission to execute code. Microsoft addressed this issue in Notepad build 11.2510+ on February 10. Users are advised to disable Markdown and link previews when unnecessary.

APOLLOMD DATA BREACH IMPACTS 626,000 INDIVIDUALS

A May 2025 cyberattack on ApolloMD exposed PII and PHI for 626,540 people associated with affiliated physicians and practices, including diagnoses, treatment details, insurance data, and, in some cases, Social Security numbers. Notifications began in September 2025, with free credit monitoring offered, and Qilin ransomware actors later claimed responsibility on their leak site.

FROM PATCH TUESDAY TO PENTEST WEDNESDAY: CONTINUOUS VALIDATION IN A REGULATED ENVIRONMENT

A financial services organization transitioned from annual compliance-driven pentesting to weekly continuous validation, revealing that a single read-only AWS credential enabled 39 distinct attack paths, including full account compromise in under 10 minutes and access to over 100,000 sensitive files. The shift to frequent automated testing reduced mean time to remediate from months to days, with the team completing roughly 40 pentests in eight months and uncovering previously invisible risks, including overly permissive SMB shares, IAM privilege escalation paths, and a critical PAN-OS vulnerability (CVE-2025-0108). The case study demonstrates how continuous validation transforms security programs from point-in-time compliance exercises into operational exposure management, where findings are prioritized by proven exploitability and mapped to real threat actor TTPs like Scattered Spider.

NATION-STATE ACTORS EXPLOIT NOTEPAD++ SUPPLY CHAIN

Lotus Blossom compromised the Notepad++ hosting infrastructure between June and December 2025, hijacking the update server to selectively serve malicious installers to targets across government, telecom, and critical infrastructure sectors in Southeast Asia, South America, the US, and Europe. The attack delivered two infection chains — a Lua script injection variant deploying Cobalt Strike beacons and a DLL sideloading variant using a renamed Bitdefender component to load the Chrysalis backdoor with Warbird-protected evasion techniques. Users should manually update to Notepad++ v8.9.1 or later, which includes certificate and signature verification for downloaded installers.