A former House Committee on Transportation and Infrastructure sysadmin was indicted for allegedly ordering 240 government cell phones, shipping them to his home, and selling over 200 to a pawn shop in a scheme that cost taxpayers $150,000. The scheme unraveled when one phone, which was instructed to be sold only "in parts" to bypass MDM controls, ended up intact on eBay. The buyer called the House IT help desk number displayed on boot. The case highlights the importance of asset management controls and segregation of duties for personnel with procurement authority.
Microsoft coordinated civil actions in the US and UK to take down RedVDS, a cybercrime-as-a-service provider that rents cheap virtual servers, fueling large-scale phishing and fraud campaigns worldwide and causing at least $40 million in reported US losses. The operation involves domain seizures, infrastructure disruption, and collaboration with Europol, German authorities, and victim organizations like H2-Pharma and a Florida condo association.
France's CNIL fined Free SAS and Free Mobile, subsidiaries of Groupe Iliad, a combined €42 million after a 2024 breach exposed bank and other personal data of 24 million subscribers. Regulators cited weak VPN authentication, poor anomaly detection, and inadequate breach notifications, and criticized the firms' basic security lapses. The companies, which have since upgraded controls, plan to appeal, calling the sanctions unprecedented and disproportionate.
Microsoft's updates on January 13 patched the WinSqlite3.dll component across Windows 10/11 and Server 2012-2025 after third-party security tools flagged it as vulnerable to CVE-2025-6965, a memory corruption flaw.
Hackers accessed Central Maine Healthcare's network between March and June 2025, exposing names, dates of birth, Social Security numbers, treatment details, provider information, service dates, and insurance data for 145,381 people.
As 2026 begins, businesses are contending with a fragmented threat landscape. Identities, applications, devices, and AI-driven tools are multiplying, often outside of IT or security's control.
Scammers are flooding LinkedIn posts with fake reply comments from company pages impersonating LinkedIn (e.g., "Linked Very"), warning users about bogus policy violations and directing them to credential-harvesting sites. The campaign gains credibility by using LinkedIn's official lnkd.in URL shortener to mask phishing domains, making malicious links harder to identify without clicking. LinkedIn confirmed awareness and emphasized that it never communicates policy violations through public comments.
A ransomware attack on AZ Monica hospital in Antwerp severely disrupted IT systems, forcing servers offline and halting most surgeries and many treatments, including imaging and chemotherapy. Critical patients were moved with Red Cross help, while other hospitals, including Amsterdam UMC, took over urgent chemotherapy.
Sensitive data belonging to around 4,500 ICE and Border Patrol employees has been released by a Department of Homeland Security whistleblower. The leaked data includes names, work emails, phone numbers, roles, and some resume data. The data was leaked to the ICE List website, which stated that it would conduct a manual review to filter out certain roles before releasing the data.
VoidLink is a sophisticated Zig-based Linux malware framework from Chinese-affiliated developers. It features a cloud-first design that detects AWS, GCP, Azure, Alibaba, and Tencent environments and adapts its behavior based on detected EDRs and security controls. The framework includes 37+ plugins inspired by Cobalt Strike's BOF architecture, environment-adaptive rootkit deployment (LD_PRELOAD, eBPF, or LKM-based on the kernel version), and multiple C2 channels, including HTTP, DNS tunneling, ICMP, and P2P mesh networking. VoidLink's credential-harvesting targets cloud environments, Git repositories, and SSH keys, suggesting that software engineers and cloud infrastructure are primary targets for espionage or supply chain attacks.
A series of vulnerabilities in Fortinet's FortiSIEM platform allows a remote, unauthenticated attacker to gain full control of the appliance, from admin access to root. The weakness lies in how the phMonitor service processes certain storage-related requests, ultimately enabling crafted data to reach a curl-based health-check script and inject extra arguments. By abusing curl's features, an attacker can write arbitrary files as the FortiSIEM admin user and then leverage a writable script executed by root via cron to escalate privileges. Combined, these flaws permit long-term, stealthy compromise of FortiSIEM deployments.
The UK's NCSC released a guide and checklist for small- to medium-sized enterprises (SMEs) seeking to choose a Managed Service Provider (MSP) for IT and security services. Organizations should request any certifications the MSP has, customer testimonials, and ensure the MSP communicates clearly and transparently. Organizations should also ask the MSP about their policies on patching, backups, data access, logging, and incident response.
With enterprise usage, LLM governance is a pain. Pydantic AI Gateway [11] (PAIG) provides one key for all major providers (OpenAI, Anthropic, Google, AWS Bedrock, Groq, etc.), zero schema translation, and granular spend caps. Get a full audit trail and SSO while enjoying single-digit millisecond overhead via Cloudflare's global edge. Start
ai-knowledge-graph is a Python tool that extracts Subject-Predicate-Object triplets from unstructured text using any OpenAI-compatible LLM endpoint and generates interactive knowledge graph visualizations. It features automatic text chunking, entity standardization across document segments, and relationship inference to connect disconnected graph components. The tool outputs interactive HTML visualizations with community detection, centrality-based node sizing, and filtering controls.
Aura-inspector is a Swiss Army knife of Salesforce Experience Cloud testing. It facilitates in discovering misconfigured Salesforce Experience Cloud applications as well as automates much of the testing process.
Novee offers a continuous, AI-driven penetration testing platform that simulates sophisticated real-world attackers to uncover novel vulnerabilities, including complex business logic flaws. It also provides exploit validation, automated retesting, and remediation guidance.
France has experienced a surge in violent "wrench attacks" targeting cryptocurrency holders and their relatives between 2024 and 2026, exploiting self-custody's fundamental weakness: anyone with the key or seed phrase can irreversibly transfer funds without bank intervention. Attackers identify targets through public displays of wealth on social media, data leaks from crypto firms like Ledger, and potentially compromised access to government databases, including new EU crypto-asset reporting systems under DAC8. Recommended mitigations include operational security measures, time-locked transactions, and multisignature wallet schemes requiring geographically distributed keys.
Black Lotus Labs null-routed over 550 C2 nodes associated with the AISURU/Kimwolf botnet, which has infected more than 2 million Android devices—primarily unsanctioned TV streaming boxes with exposed Android Debug Bridge (ADB) services. The botnet exploits vulnerabilities in residential proxy services to propagate, turning compromised devices into proxy nodes for DDoS attacks and malicious traffic relay. Security teams should monitor for ADB exposure on network devices and block traffic to the identified C2 infrastructure.
A security-conscious user received several 2FA prompts and SMS verification codes for their Apple account one afternoon, followed by an automated call warning them that their account was under attack. After receiving this call, a second call came from a very professional-sounding employee who created a support case for the user, verified that it was from Apple to build trust, and walked the user through resetting their password. The phish then had the user “close the case” via an SMS link, which directed them to a sophisticated phishing site where they could steal the user's credentials.
CERT-UA reported that the suspected Russian threat group Void Blizzard targeted Ukrainian Defense Forces officials via Signal and WhatsApp with charity-themed lures delivering the PluggyApe backdoor, which now features MQTT-based C2 communication and dynamic address retrieval from paste sites.
The WEF's fifth annual cybersecurity report shows 94% see AI as the main cyber driver, 87% cite AI vulnerabilities as the fastest-growing risk, and 91% of large organizations are revising cybersecurity strategies due to geopolitical volatility.
Anthropic is donating $1.5 million to the Python Software Foundation to enhance security in CPython and PyPI, thereby lowering supply chain risks for millions of Python developers and possibly other open source ecosystems too.
Most "AI for security" tools don't actually make your workflows faster or easier. Sumo Logic's Dojo AI [4] is a different beast, deploying specialized agents that work together to triage alerts, explain what triggered them, and write queries for you.
The Everest ransomware group claimed to have breached Nissan Motor Corporation, posting screenshots on their dark web leak site showing directory structures with 900GB of allegedly stolen data, including dealership information, financial records, and operational documentation in .csv, .txt, .pgp, and .xls formats. The group issued a five-day deadline before public release, continuing their aggressive 2025-2026 campaign that has targeted ASUS, Chrysler, AT&T, and other major organizations. This marks Nissan's third significant security incident in recent years, following the Qilin ransomware attack on its design subsidiary and the 2023 breach affecting over 100,000 individuals.
Hackers broke into Spanish utility Endesa's commercial systems and accessed customer data of over 20 million customers, including identification details, national ID numbers, contract information, and IBAN payment data. The company says passwords were not exposed, operations remain normal, and extra security measures and monitoring are in place.
An unknown threat actor has claimed to have stolen a trove of Target's internal source code and documentation and is selling it on dark web marketplaces. After BleepingComputer contacted Target for comment, the files were taken offline, and Target's Git server became inaccessible from the internet. Multiple Target employees have confirmed that the source code samples are legitimate.
OAuth in Microsoft Entra creates complex webs of apps, permissions, and identities that are hard to reason about with tables alone, so modelling everything as a graph reveals abuse paths such as impersonation and long‑lived access that would otherwise stay hidden. OID-See uses Microsoft Graph to map service principals, delegated scopes, app roles, ownership, assignments, and reply URLs into a graph-backed analysis. It then layers scoring and enrichment to highlight risky apps, misleading Microsoft-shaped metadata, and dangerous patterns like broad reachability, wildcard redirects, and stale credentials.
EventBridge JSONs can become very complex quickly. AWS provides very little documentation to help parse them. Fields at the same level of the JSON are ANDed together, whereas values in an array are ORed together. If a user wants to apply an OR to two fields, they can use the $or operator. However, users should be careful when nesting $ors, as each branch gets expanded into additional sub-patterns that can become contradictory or complex to debug. This post also covers other operators and how to combine them to develop complex Boolean logic.
Claude for Healthcare enables Pro and Max subscribers in the US to connect health records via HealthEx, Function, and upcoming Apple Health/Android Health Connect integrations for medical history summarization and test result explanations. The implementation features privacy-by-design controls allowing users to manage data sharing permissions, with health data explicitly excluded from model training. Anthropic's Acceptable Use Policy requires qualified professional review of outputs for high-risk healthcare decisions, acknowledging AI limitations in medical contexts.
This GitHub repository contains a collection of 150+ tools and resources that can be useful for red teaming activities. Some of the tools may be specifically designed for red teaming, while others are more general-purpose and can be adapted for use in a red teaming context.
Check Point Research identified an upgraded GoBruteforcer campaign targeting cryptocurrency and blockchain project databases, exploiting weak credentials spread via AI-generated server-deployment tutorials and legacy XAMPP stacks that expose FTP and phpMyAdmin interfaces. The Golang-based botnet features an obfuscated IRC bot, dynamic credential lists that include crypto-focused usernames, and a module that queries TRON blockchain addresses for non-zero balances. Separately, GreyNoise observed 80,469 sessions over 11 days from threat actors systematically probing 73+ LLM endpoints across major AI providers, hunting for misconfigured proxy servers that leak API access.
A Dutch man was sentenced to seven years in prison for hacking port logistics systems in the Netherlands and Belgium to support cocaine smuggling operations. He used malware delivered via USB sticks, with help from an insider, to gain remote access, steal data, and intercept communications.
Dutch authorities have arrested a 33-year-old Dutch suspect at Schiphol Airport, accusing him and two linked companies of running AVCheck, a major counter-antivirus platform that lets criminals test and fine-tune malware against multiple security products. AVCheck, dismantled in May 2025 during Operation Endgame, allegedly helped attackers perfect campaigns by identifying which targets and defenses were easiest to evade.
CalPrivacy fined Datamasters $45,000 and banned the unregistered data broker from selling Californians' personal information after it traded hundreds of millions of records containing sensitive health data.
A 24-year-old Tennessee man, Nicholas Moore, repeatedly accessed the US Supreme Court's electronic filing system without authorization over 25 days between August and October 2023, obtaining unspecified information from a protected computer.
Microsoft's January 2026 Patch Tuesday addressed 112 vulnerabilities, including CVE-2026-20805, an actively exploited information disclosure zero-day in Desktop Window Manager (CVSS 5.5) that CISA added to its KEV catalog.
Bitwarden surveyed IT managers and enterprise users to find out what actually drives password manager adoption. The biggest factor? Leadership directives.
Trend Micro patched three vulnerabilities in Apex Central on-premise, including a critical RCE flaw in LoadLibraryEX (CVE-2025-69258, CVSS 9.8) that allows unauthenticated attackers to execute code as SYSTEM by loading malicious DLLs. Tenable disclosed the vulnerabilities along with PoC exploit code after discovering them in August. Organizations running Apex Central below Build 7190 should apply the critical patch immediately and restrict remote access to management consoles.
CISA has ordered government agencies to secure their systems against a high-severity vulnerability in the Gogs alternative for GitHub. The remote code execution (RCE) vulnerability is caused by a path traversal weakness in the PutContents API that allows attackers to bypass protections implemented for a previous RCE bug. Attackers can exploit the vulnerability by creating symbolic links that point to system files and then using the PutContents API to write data to those files via the symbolic links.
Apex Legends players experienced disruptions during live matches over the weekend as threat actors hijacked their characters, removed them from matches, and changed their nicknames. Players theorized that a threat actor obtained access to an administrative panel for the game. Apex Legends publisher Respawn stated that it had remediated the security incident and that the attackers were unable to access sensitive files or execute code on victims' devices.
Claude Code was found to execute arbitrary system commands without explicit user approval through eight distinct techniques that bypassed its command-safety mechanisms. These issues stemmed from fragile regex-based blocklists on “safe” commands like man, sort, sed, git, xargs, and rg, plus subtle Bash variable expansion tricks that hid real payloads. An attacker could turn supposedly read‑only operations into command execution paths by abusing lesser-known flags and prompt-like variable expansion. The problems were ultimately fixed by moving from a blocklist-first design to a stricter allowlist model in Claude Code v1.0.93.
Modern AI agents often treat model outputs as fully trusted inputs to tools, creating a dangerous gap between text strings (the map) and what the underlying system actually does (the territory). Attackers exploit this by encoding malicious behavior in paths, URLs, or shell commands that pass superficial checks but resolve to sensitive files, internal services, or injected commands at execution time. Robust defenses require layered, deterministic guards: semantic validation that interprets arguments as the system will, and execution-time checks that verify real filesystem and network behavior rather than relying on regexes or human confirmation alone.
AWS privilege escalation has evolved from classic IAM misconfigurations to service-based execution paths and now AI-driven orchestration via Bedrock Agents and AgentCore Code Interpreters. New attack vectors include creating code interpreters that execute Python under privileged agent roles and hijacking Lambda functions backing Bedrock agent tools, both of which enable multi-stage privilege chains to sensitive resources. Testing across 16 scenarios showed that all were exploitable in unrestricted environments but preventable with properly configured SCP-based guardrails, highlighting that native AWS controls often cannot granularly constrain high-risk actions that lack ARNs or condition keys.