🐛 COMMON VULNERABILITIES AND EXPOSURES 35[−]
8 JanHoles in Veeam Backup suite allow remote code execution, creation of malicious backup config filesVeeam says that four vulnerabilities could allow a person with certain oversight roles for its flagship Backup & Replication suite to do serious damage to – but not destroy – a backup database. The company has already issued a patch for the bugs, which, it says, should be app…CSOONLINE.COM
8 Jan KEVCISA Flags Microsoft Office and HPE OneView Bugs as Actively ExploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added two security flaws impacting Microsoft Office and Hewlett Packard Enterprise (HPE) OneView to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnera…THEHACKERNEWS.COM
8 JanCVE-2025-38480 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()Information published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38483 comedi: das16m1: Fix bit shift out of boundsInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38495 HID: core: ensure the allocated report buffer can contain the reserved report IDInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38481 comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too largeInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38487 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabledInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38485 iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flushInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38482 comedi: das6402: Fix bit shift out of boundsInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38497 usb: gadget: configfs: Fix OOB read on empty string writeInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38491 mptcp: make fallback action and fallback decision atomicInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38488 smb: client: fix use-after-free in crypt_message when using async cryptoInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-68753 ALSA: firewire-motu: add bounds check in put_user loop for DSP eventsInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-68766 irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()Information published.MSRC.MICROSOFT.COM
8 JanCVE-2025-68303 platform/x86: intel: punit_ipc: fix memory corruptionInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-68301 net: atlantic: fix fragment overflow handling in RX pathInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-68311 tty: serial: ip22zilog: Use platform device for probingInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38644 wifi: mac80211: reject TDLS operations when station is not associatedInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38630 fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-derefInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38639 netfilter: xt_nfacct: don't assume acct name is null-terminatedInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38499 clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right usernsInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38635 clk: davinci: Add NULL check in davinci_lpsc_clk_register()Information published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38624 PCI: pnv_php: Clean up allocated IRQs on unplugInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38634 power: supply: cpcap-charger: Fix null check for power_supply_get_by_nameInformation published.MSRC.MICROSOFT.COM
8 JanCVE-2025-38502 bpf: Fix oob access in cgroup local storageInformation published.MSRC.MICROSOFT.COM
8 JanCisco Patches ISE Security Vulnerability After Public PoC Exploit ReleaseCisco has released updates to address a medium-severity security flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) with a public proof-of-concept (PoC) exploit. The vulnerability, tracked as CVE-2026-20029 (CVSS score: 4.9), resides in the licens…THEHACKERNEWS.COM
8 JanCoolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted InstancesCybersecurity researchers have disclosed details of multiple critical-severity security flaws affecting Coolify, an open-source, self-hosting platform, that could result in authentication bypass and remote code execution. The list of vulnerabilities is as follows - CVE-2025-66209…THEHACKERNEWS.COM
8 JanCritical jsPDF vulnerability enables arbitrary file read in Node.js deploymentsA now-fixed critical flaw in the jsPDF library could enable attackers to extract sensitive files from enterprise servers and embed them directly into generated PDF documents. Tracked as CVE-2025-68428 , the flaw affects unpatched Node.js deployments of jsPDF, where untrusted inpu…CSOONLINE.COM
8 JanCritical Vulnerability Exposes n8n Instances to Takeover AttacksTracked as CVE-2026-21858 (CVSS score 10), the bug enables remote code execution without authentication. The post Critical Vulnerability Exposes n8n Instances to Takeover Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanNi8mare - Unauthenticated Remote Code Execution in n8n (CVE-2026-21858) | Cyera Research Labssubmitted by cm0002 to cybersecurity 1 points | 0 comments https://www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858 A critical vulnerability (CVE-2026-21858) dubbed “Ni8mare” allows unauthenticated attackers to gain complete control …INFOSEC.PUB
8 JanCisco ISE Vulnerability Enables Access to Sensitive DataCisco has disclosed a new XML External Entity (XXE) vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) that could allow authenticated attackers with administrative access to read sensitive data from the underlying operating sy…GBHACKERS.COM
8 JanCisco Snort 3 Vulnerability Leading to Sensitive Data DisclosureCisco has disclosed two critical vulnerabilities in the Snort 3 detection engine affecting multiple enterprise security products, including firewalls, threat defense systems, and edge platforms. The vulnerabilities, tracked as CVE-2026-20026 and CVE-2026-20027 under advisory cisc…GBHACKERS.COM
8 JanReact2Shell Vulnerability Hit by 8.1 Million Attack AttemptsThe React Server Components (RSC) “Flight” protocol remote code execution vulnerability, tracked as CVE-2025-55182 and publicly referred to as “React2Shell,” has become the target of a massive exploitation campaign that shows no signs of slowing. Since the…GBHACKERS.COM
8 JanCVE-2025-9901 Libsoup: improper handling of http vary header in libsoup cachingInformation published.MSRC.MICROSOFT.COM
⚠️ VULNERABILITY DISCLOSURE 29[−]
8 JanAnalysis using Gephi with DShield Sensor Data, (Wed, Jan 7th)I&#;x26;#;39;m always looking for new ways of manipulating the data captured by my DShield sensor [ 1 ]. This time I used Gephi [ 2 ] and Graphiz [ 3 ] a popular and powerful tool for visualizing and exploring relationship…ISC.SANS.EDU
8 JanDie wichtigsten CISO-Trends für 2026Lesen Sie, vor welchen Herausforderungen CISOs mit Blick auf das Jahr 2026 stehen. SuPatMaN – shutterstock.com Das Jahr 2025 war für viele CISOs herausfordernd. Anfang des Jahres wurden mit dem Digital Operational Resilience Act ( DORA ) alle Finanzunternehmen dazu verpflichtet, …CSOONLINE.COM
8 JanTop cyber threats to your AI systems and infrastructureAttacks against AI systems and infrastructure are beginning to take shape in real-world instances, and security experts expect the number of these attack types will rise in coming years. In a rush to realize the benefits of AI, most organizations have played it fast and loose on …CSOONLINE.COM
8 Jan KEVCISA tags max severity HPE OneView flaw as actively exploitedThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a maximum-severity HPE OneView vulnerability as actively exploited in attacks. [...]BLEEPINGCOMPUTER.COM
8 JanThree Malicious NPM Packages Target Developers’ Login CredentialsSecurity researchers at Zscaler ThreatLabz have uncovered three malicious npm packages designed to install a sophisticated remote access trojan (RAT) targeting JavaScript developers. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, collectively registered over 3,4…GBHACKERS.COM
8 JanLinux Battery Utility Vulnerability Allows Authentication Bypass and System TamperingLinux laptop users are being urged to update after a flaw in a popular battery optimisation tool was found to allow authentication bypass and system tampering. The vulnerability affects the TLP power profiles daemon introduced in version 1.9.0, which exposes a D-Bus API …GBHACKERS.COM
8 JanownCloud Warns Users to Enable MFA After Credential Theft IncidentownCloud has issued an urgent security advisory urging users to enable Multi-Factor Authentication (MFA) following a credential theft incident reported by threat intelligence firm Hudson Rock. The incident, discovered in January 2026, affected organizations using self-hosted file…GBHACKERS.COM
8 JanGlobal GoBruteforcer Botnet Campaign Threatens 50,000 Linux ServersA sophisticated modular botnet known as GoBruteforcer is actively targeting Linux servers worldwide, with researchers estimating that more than 50,000 internet-facing servers remain vulnerable to these coordinated attacks. The threat, which has evolved significantly since its ini…GBHACKERS.COM
8 JanCybercriminals Exploit VMware ESXi Vulnerabilities Using Zero-Day ToolsetHuntress security researchers have uncovered a sophisticated VMware ESXi exploitation campaign using a zero-day toolkit that remained undetected for over a year before VMware’s public disclosure. The December 2025 intrusion, which began through a compromised SonicWall VPN, …GBHACKERS.COM
8 JanCisco warns of Identity Service Engine flaw with exploit codeCisco has patched an ISE vulnerability with public proof-of-concept exploit code that can be abused by attackers with admin privileges. [...]BLEEPINGCOMPUTER.COM
8 JanCritical HPE OneView Vulnerability Exploited in AttacksThe maximum-severity code injection flaw can be exploited without authentication for remote code execution. The post Critical HPE OneView Vulnerability Exploited in Attacks appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanNIS2-Umsetzung: Neues BSI-Portal geht an den Startsrcset="https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock_2691920437.jpg?quality=50&strip=all 7500w, https://b2b-contenthub.com/wp-content/uploads/2026/01/shutterstock_2691920437.jpg?resize=300%2C168&quality=50&strip=all 300w, https://b2b-contenthub.c…CSOONLINE.COM
8 JanThe State of Trusted Open SourceChainguard, the trusted source for open source, has a unique view into how modern organizations actually consume open source software and where they run into risk and operational burdens. Across a growing customer base and an extensive catalog of over 1800 container image project…THEHACKERNEWS.COM
8 JanAI & Humans: Making the Relationship WorkLeaders of many organizations are urging their teams to adopt agentic AI to improve efficiency, but are finding it hard to achieve any benefit. Managers attempting to add AI agents to existing human teams may find that bots fail to faithfully follow their instructions, return poi…SCHNEIER.COM
8 JanMicrosoft to enforce MFA for Microsoft 365 admin center sign-insMicrosoft will start enforcing multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month. [...]BLEEPINGCOMPUTER.COM
8 JanMicrosoft warns of a surge in phishing attacks exploiting email routing gaps | CSO Onlinesubmitted by kid to cybersecurity 1 points | 0 comments https://www.csoonline.com/article/4113746/microsoft-warns-of-a-surge-in-phishing-attacks-exploiting-email-routing-gaps.htmlSH.ITJUST.WORKS
8 JanThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More StoriesThe internet never stays quiet. Every week, new hacks, scams, and security problems show up somewhere. This week’s stories show how fast attackers change their tricks, how small mistakes turn into big risks, and how the same old tools keep finding new ways to break in. Read on to…THEHACKERNEWS.COM
8 JanCritical Vulnerability Patched in jsPDFThe bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials. The post Critical Vulnerability Patched in jsPDF appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanRethinking Security for Agentic AIWhen software can think and act on its own, security strategies must shift from static policy enforcement to real-time behavioral governance. The post Rethinking Security for Agentic AI appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanPhishing-Angreifer setzen vermehrt auf E-Mail-Routing-LückenAngreifer missbrauchen falsch konfigurierte Richtlinien, um Phishing-E-Mails wie interne E-Mails aussehen zu lassen, Filter zu umgehen und Anmeldedaten zu stehlen. batjaket – shutterstock.com Das Threat Intelligence Team von Microsoft hat kürzlich festgestellt, dass Angreifer zun…CSOONLINE.COM
8 JanCybersecurity at the edge: Securing rugged IoT in mission-critical environmentsEdge computing is no longer a futuristic concept; it’s a reality shaping mission-critical operations across defense, utilities and public safety. Rugged IoT devices, engineered to withstand extreme conditions, are the backbone of this transformation. They enable real-time decisio…CSOONLINE.COM
8 JanPhishing Campaign Targets WhatsApp AccountsResearchers at Gen warn that a phishing campaign is attempting to trick users into linking malicious devices to their WhatsApp accounts.KNOWBE4.COM
8 JanCisco warns of Identity Service Engine flaw with exploit codesubmitted by kid to cybersecurity 2 points | 0 comments https://www.bleepingcomputer.com/news/security/cisco-warns-of-identity-service-engine-flaw-with-exploit-code/SH.ITJUST.WORKS
8 JanReport: China Breached Email Systems Used by U.S. Congressional StaffBeijing dismissed accusations of Chinese involvement in a significant cyberattack against United States congressional staff email systems on Thursday, characterizing the allegations as “politically motivated disinformation.” The denial comes after the Financial Times …GBHACKERS.COM
8 JanWhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-MessagingCybersecurity researchers have disclosed details of a new campaign that uses WhatsApp as a distribution vector for a Windows banking trojan called Astaroth in attacks targeting Brazil. The campaign has been codenamed Boto Cor-de-Rosa by Acronis Threat Research Unit. "The malware …THEHACKERNEWS.COM
8 JanInside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns - Check Point Researchsubmitted by kid to cybersecurity 1 points | 0 comments https://research.checkpoint.com/2026/inside-gobruteforcer-ai-generated-server-defaults-weak-passwords-and-crypto-focused-campaigns/SH.ITJUST.WORKS
8 JanThe 2 faces of AI: How emerging models empower and endanger cybersecurityIn my long career of safeguarding digital assets, I’ve seen technology shifts come and go, but nothing compares to the disruptive force of AI and large language models (LLMs). AI is quite literally a double-edged sword when it comes to cybersecurity. The same capabilities that al…CSOONLINE.COM
8 JanVMware ESXi zero-days likely exploited a year before disclosureChinese-speaking threat actors used a compromised SonicWall VPN appliance to deliver a VMware ESXi exploit toolkit that seems to have been developed more than a year before the targeted vulnerabilities became publicly known. [...]BLEEPINGCOMPUTER.COM
8 JanNew China-linked hackers breach telcos using edge device exploitsA sophisticated threat actor that uses Linux-based malware to target telecommunications providers has recently broadened its operations to include organizations in Southeastern Europe. [...]BLEEPINGCOMPUTER.COM
📢 SECURITY ADVISORIES 9[−]
8 JanGitLab Patches Multiple Flaws Allowing Arbitrary Code ExecutionLinux administrators are being urged to update promptly after disclosures of multiple vulnerabilities in GitLab, including flaws that could enable cross-site scripting, authorization bypass, and denial of service in selfmanaged instances. The latest pat…GBHACKERS.COM
8 JanResearchers Expose WHILL Wheelchair Safety Risks via Remote HackingCISA advisory warns that unauthenticated Bluetooth access in WHILL devices allows for unauthorized movement. The post Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanNo FlipperZeros Allowed - PSW #908This week in the security news: - Supply chain attacks and XSS - PS5 leaked keys - Claude tips for security pros - No Flipper Zeros allowed, or Raspberry PIs for that matter - Kimwolf and your local network - Linux is good now - Removing unremovable apps without root - Detecting …YOUTUBE.COM
8 JanCISA retires 10 emergency cyber orders in rare bulk closureThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired 10 Emergency Directives issued between 2019 and 2024, saying that the required actions have been completed or are now covered by Binding Operational Directive 22-01. [...]BLEEPINGCOMPUTER.COM
🔥 INCIDENT REPORTING 8[−]
8 JanSmashing Security podcast #449: How to scam someone in seven daysRomance scammers have apparently discovered astrology... and Taurus is their secret weapon. In episode 449 of "Smashing Security", we take a look inside an actual romance-fraud handbook - complete with scripts, personality “types”, corporate jargon, and a seven-day plan to get vi…GRAHAMCLULEY.COM
8 JanChina hacked email systems of US congressional committee staffsubmitted by cm0002 to cybersecurity 3 points | 0 comments https://www.ft.com/content/44f730c4-7de3-4a09-88dd-41ea9c373dcb archive.ph/wxcBVINFOSEC.PUB
8 JanResearchers Poison Stolen Data to Sabotage AI Model AccuracyA groundbreaking cybersecurity research team has developed a novel defensive technique that renders stolen artificial intelligence databases virtually useless to attackers by deliberately poisoning proprietary knowledge graphs with plausible yet false information. The research, …GBHACKERS.COM
8 JanDozens of Global Companies Hacked via Cloud Credentials from Infostealer Infections & More at Risksubmitted by cm0002 to cybersecurity 1 points | 0 comments https://www.infostealers.com/article/dozens-of-global-companies-hacked-via-cloud-credentials-from-infostealer-infections-more-at-risk/ A major cybersecurity breach has exposed dozens of global companies through stolen clo…INFOSEC.PUB
8 JanSpanish airline Iberia attributes recent data breach claims to November incident | The Record from Recorded Future Newssubmitted by kid to cybersecurity 2 points | 0 comments https://therecord.media/spanish-airline-attributes-recent-breach-allegation-to-nov-incidentSH.ITJUST.WORKS
8 JanEuropean Space Agency initiates criminal probe into breach • The Registersubmitted by kid to cybersecurity 3 points | 0 comments https://www.theregister.com/2026/01/07/european_space_agency_breach_criminal_probe/SH.ITJUST.WORKS
8 JanUK Government Launches Cyber Action Plan to Bolster Public Sector SecurityThe UK government has unveiled an ambitious £210 million cyber security initiative designed to fortify digital defenses across public sector departments and restore confidence in online government services. The centerpiece of the initiative is the newly formed Government Cyber Un…GBHACKERS.COM
8 JanCredential stuffing: What it is and how to protect yourselfReusing passwords may feel like a harmless shortcut – until a single breach opens the door to multiple accountsWELIVESECURITY.COM
🕵️ THREAT INTELLIGENCE 25[−]
8 JanISC Stormcast For Thursday, January 8th, 2026 https://isc.sans.edu/podcastdetail/9758, (Thu, Jan 8th)(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.ISC.SANS.EDU
8 JanBlueDelta Hackers Target Microsoft OWA, Google, and Sophos VPN to Steal CredentialsA sophisticated credential-harvesting operation conducted by BlueDelta, a Russian state-sponsored threat group linked to the GRU’s Main Directorate, targeted critical infrastructure organizations and research institutions throughout 2025, according to a comprehensive invest…GBHACKERS.COM
8 JanThe AI Security Shakedownsubmitted by codeinabox to security 1 points | 0 comments https://blog.jim-nielsen.com/2026/ai-security-shakedown/PROGRAMMING.DEV
8 JanPrisma AIRS Secures the Power of Factory’s Software Development AgentsProtect Factory.ai's Droids with Prisma AIRS. Prevent prompt injection and data leaks for confident, accelerated agent-native development. The post Prisma AIRS Secures the Power of Factory’s Software Development Agents appeared first on Palo Alto Networks Blog .PALOALTONETWORKS.COM
8 JanGen AI data violations more than double - Help Net Securitysubmitted by kid to cybersecurity 1 points | 0 comments https://www.helpnetsecurity.com/2026/01/07/gen-ai-data-violations-2026/SH.ITJUST.WORKS
8 JanDefending Against Modern Email Threats With Layered, AI-Driven SecurityEmail has been the backbone of business communication for decades and as such, it remains the attacker’s favorite doorway into an organization.KNOWBE4.COM
8 JanCyera Raises $400 Million at $9 Billion ValuationThe New York-based data security company has tripled its valuation in just one year. The post Cyera Raises $400 Million at $9 Billion Valuation appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanBlackbird.AI Raises $28 Million for Narrative Intelligence PlatformThe company will use the funds to enhance its AI-based narrative intelligence technology platform and accelerate go-to-market efforts. The post Blackbird.AI Raises $28 Million for Narrative Intelligence Platform appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanChina-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB NodesA China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe. The activity cluster, which has been active since at least 2022, primarily focuses on extensive technical reconnaissance of tar…THEHACKERNEWS.COM
8 JanClang Hardening Cheat Sheet - Ten Years LaterTen years ago, we published a Clang Hardening Cheat Sheet . Since then, both the threat landscape and the Clang toolchain have evolved significantly. This blog post presents the new mitigations available in Clang to improve the security of your applications.QUARKSLAB.COM
8 JanCrowdStrike to Buy Identity Security Firm SGNL for $740 Million in CashThe deal is valued at $740 million, which will be paid predominantly in cash. The post CrowdStrike to Buy Identity Security Firm SGNL for $740 Million in Cash appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanAutomated data poisoning proposed as a solution for AI theft threatsubmitted by kid to cybersecurity 6 points | 0 comments https://www.csoonline.com/article/4113463/automated-data-poisoning-proposed-as-a-solution-for-ai-theft-threat.htmlSH.ITJUST.WORKS
8 JanUK Government Unveils New Cyber Action PlanThe UK government’s cyber action plan is by the government for the government, and has no advice for the private sector nor CNI. The post UK Government Unveils New Cyber Action Plan appeared first on SecurityWeek .SECURITYWEEK.COM
8 JanResearches Detailed AuraStealer Obfuscation, Anti-Analysis and Data Theft Capabilitiessubmitted by kid to cybersecurity 2 points | 0 comments https://cybersecuritynews.com/researches-detailed-aurastealer-obfuscation/SH.ITJUST.WORKS
8 JanNew OAuth Attack Lets Hackers Bypass Microsoft Entra Authentication and Steal KeysIn a year-end tradition that has become all too familiar for cybersecurity defenders, researchers have uncovered a novel attack vector targeting Microsoft Entra ID that weaponizes legitimate OAuth 2.0 authentication flows to harvest privileged access tokens. The technique, dubbed…GBHACKERS.COM
8 JanNew DocuSign-Themed Phishing Scam Delivers Stealth Malware to Windows DevicesNew research has uncovered a sophisticated phishing campaign that abuses DocuSign’s brand to deliver Vidar malware and infect Windows systems. The operation uses a realistic phishing site, a fake signed installer, access-code checks, and timeb…GBHACKERS.COM
8 JanTrump Signals Possible Cyber Involvement in Caracas Power Loss During Maduro ExtractionPresident Donald Trump has strongly hinted that the United States used offensive cyber capabilities to help plunge Caracas into darkness during the operation to capture Venezuelan leader Nicolás Maduro an unusually public nod to U.S. cyber power. The bl…GBHACKERS.COM
8 JanChatGPT Health: A New Secure Space for Trusted Health and Medical ConversationsChatGPT Health is launching as a dedicated health-focused version of ChatGPT that combines personalized health data with stronger privacy and security controls to support not replace conversations with clinicians. The new experience isolates h…GBHACKERS.COM
8 JanHow Attackers Hide Processes by Abusing Kernel Patch ProtectionSecurity researchers have identified a sophisticated technique that allows attackers to hide malicious processes from Windows Task Manager and system monitoring tools, even on systems with Microsoft’s most advanced kernel protections enabled. The bypass leverages legitimate…GBHACKERS.COM
8 JanBlack Cat Behind SEO Poisoning Malware Campaign Targeting Popular Software Searchessubmitted by kid to cybersecurity 3 points | 0 comments https://thehackernews.com/2026/01/black-cat-behind-seo-poisoning-malware.htmlSH.ITJUST.WORKS
8 JanCoolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instancessubmitted by kid to cybersecurity 1 points | 0 comments https://thehackernews.com/2026/01/coolify-discloses-11-critical-flaws.htmlSH.ITJUST.WORKS
8 JanMalicious NPM Packages Deliver NodeCordRATsubmitted by kid to cybersecurity 1 points | 0 comments https://www.zscaler.com/blogs/security-research/malicious-npm-packages-deliver-nodecordratSH.ITJUST.WORKS
8 JanHappy 23rd Birthday TaoSecurity Blog Happy birthday TaoSecurity Blog, born on this day in 2003! The best way to digest the key lessons from this site is to browse my four volume Best of TaoSecurity Blog book series , published in 2020. It's available in print as seen here, or as a properly formatted HTML-base…TAOSECURITY.BLOGSPOT.COM
8 JanFBI warns about Kimsuky hackers using QR codes to phish U.S. orgsThe North Korean state-sponsored hacker group Kimsuki is using malicious QR codes in spearphishing campaigns that target U.S. organizations, the Federal Bureau of Investigation warns in a flash alert. [...]BLEEPINGCOMPUTER.COM
8 JanCaught by Keystroke LagAmazon's IT department detected an anomaly in keystroke data, revealing a North Korean infiltrator. This highlights the hidden risks in remote work monitoring and cybersecurity. How can companies better protect against such sophisticated threats? Subscribe to our podcasts: https:…YOUTUBE.COM
🌐 CYBER THREAT LANDSCAPE 4[−]
8 JanResearchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed PackagesCybersecurity researchers have discovered three malicious npm packages that are designed to deliver a previously undocumented malware called NodeCordRAT. The names of the packages, all of which were taken down as of November 2025, are listed below. They were uploaded by a user na…THEHACKERNEWS.COM
8 JanSix for 2026: The cyber threats you can’t ignoreCybersecurity threats in 2026 are accelerating, driven by AI, automation, and more effective social engineering. Corelight outlines six emerging attack trends and explains how network visibility can help defenders respond faster. [...]BLEEPINGCOMPUTER.COM
8 JanCritics pan spyware maker NSO’s transparency claims amid its push to enter US marketThe infamous spyware maker released a new transparency report claiming to be a responsible spyware maker, without providing insight into how the company dealt with problematic customers in the past.TECHCRUNCH.COM
8 JanWho Benefited from the Aisuru and Kimwolf Botnets?Our first story of 2026 revealed how a destructive new botnet called Kimwolf rapidly grew to infect more than two million devices by mass-compromising a vast number of unofficial Android TV streaming boxes. Today, we'll dig through digital clues left behind by the hackers, networ…KREBSONSECURITY.COM
📡 INFOSEC NEWS 9[−]
8 JanOpenAI Launches ChatGPT Health with Isolated, Encrypted Health Data ControlsArtificial intelligence (AI) company OpenAI on Wednesday announced the launch of ChatGPT Health, a dedicated space that allows users to have conversations with the chatbot about their health. To that end, the sandboxed experience offers users the optional ability to securely conn…THEHACKERNEWS.COM
8 JanMicrosoft Exchange Online outage blocks access to mailboxes via IMAP4Microsoft is working to fix an Exchange Online service outage that intermittently prevents users from accessing their mailboxes via the Internet Mailbox Access Protocol 4 (IMAP4). [...]BLEEPINGCOMPUTER.COM
8 JanTexas court blocks Samsung from collecting smart TV viewing dataThe State of Texas has obtained a temporary restraining order (TRO) against Samsung that prohibits the South Korean company from collecting audio and visual data about what Texas consumers are watching on their TVs. [...]BLEEPINGCOMPUTER.COM
8 JanIllinois health department exposed over 700,000 residents’ personal data for yearsThe security lapse exposed personal information belonging to residents who received state benefits.TECHCRUNCH.COM
8 JanInternet collapses in Iran amid protests over economic crisisInternet monitoring firms and experts say Iran’s internet has almost completely shut down, as protests spread through major cities.TECHCRUNCH.COM
8 JanCisco switches hit by reboot loops due to DNS client bugMultiple Cisco switch models are suddenly experiencing reboot loops after logging fatal DNS client errors, according to reports seen by BleepingComputer. [...]BLEEPINGCOMPUTER.COM
8 JanTexas court blocks Samsung from tracking TV viewing, then vacates orderThe State of Texas obtained a short-lived, temporary restraining order (TRO) against Samsung that prohibited the South Korean company from collecting audio and visual data about what Texas consumers are watching on their TVs. [...]BLEEPINGCOMPUTER.COM
8 JanxAI teases major Grok upgrade, hints at Grok Code CLIElon Musk-backed xAI has been missing in action for a while now, but today, Musk teased a major upgrade for Grok alongside new products. [...]BLEEPINGCOMPUTER.COM
8 JanGmail's new AI Inbox uses Gemini, but Google says it won’t train AI on user emailsGoogle says it's rolling out a new feature called 'AI Inbox,' which summarizes all your emails, but the company promises it won't train its models on your emails. [...]BLEEPINGCOMPUTER.COM