The Mad Hacker

Third-party identity verification provider breach exposes government ID images (Total Wireless / Veriff)

(Wednesday January 21, 2026)

ENTITY INFORMATION SUBMITTED BY COUNSEL BREACH INFORMATION reporting agencies been notified: combination with: NOTIFICATION AND PROTECTION SERVICES EXPERIAN_JOB48255D18_VER_L01_DBM-5461_SAS_1.PDF [/cgi-bin/agviewerad/ret?loc=3504] and a brief description of the service: TOTAL WIRELESS HAS ARRANGED WITH EXPERIAN TO OFFER AFFECTED INDIVIDUALS WITH COMPLIMENTARY CREDIT MONITORING AND IDENTITY RESTORATION SERVICES FOR 12 MONTHS. Excel) CREDITS Copyright © 2014 All rights...

When the Lab Door Stays Open: Exposed Training Apps Exploited for Fortune 500 Cloud Breaches

(Wednesday January 21, 2026)

Pentera reveals attackers exploiting exposed cloud training apps with crypto miners in Fortune 500 environments, risking full cloud compromise.

North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews

(Wednesday January 21, 2026)

As many as 3,136 individual IP addresses linked to likely targets of the Contagious Interview activity have been identified, with the campaign claiming 20 potential victim organizations spanning artificial intelligence (AI), cryptocurrency, financial services, IT services, marketing, and software development sectors in Europe, South Asia, the Middle East, and Central America. The new findings

Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws

(Wednesday January 21, 2026)

Zoom and GitLab have released security updates to resolve a number of security vulnerabilities that could result in denial-of-service (DoS) and remote code execution. The most severe of the lot is a critical security flaw impacting Zoom Node Multimedia Routers (MMRs) that could permit a meeting participant to conduct remote code execution attacks. The vulnerability, tracked as CVE-2026-22844

Infostealers are being used to create legitimate samples resembling a full blown data breach, resulting in a PR nightmare for companies

(Wednesday January 21, 2026)

Break LLM Workflows with Claude's Refusal Magic String

(Wednesday January 21, 2026)

How Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.

A new era of agents, a new era of posture

(Wednesday January 21, 2026)

AI agents are transforming how organizations operate, but their autonomy also expands the attack surface. The post .

Webinar: How Smart MSSPs Using AI to Boost Margins with Half the Staff

(Wednesday January 21, 2026)

Every managed security provider is chasing the same problem in 2026 — too many alerts, too few analysts, and clients demanding “CISO-level protection” at SMB budgets. The truth? Most MSSPs are running harder, not smarter. And it’s breaking their margins. That’s where the quiet revolution is happening: AI isn’t just writing reports or surfacing risks — it’s rebuilding how security services are

Pro-Russian denial-of-service attacks target UK, NCSC warns

(Wednesday January 21, 2026)

The UK's National Cyber Security Centre (NCSC) has issued a warning about the threat posed by distributed denial-of-service (DDoS) attacks from Russia-linked hacking groups who are reported to be continuing to target British organisations. Are you prepared? Read more in my article on the Hot for Security blog.

Exposure Assessment Platforms Signal a Shift in Focus

(Wednesday January 21, 2026)

Gartner® doesn’t create new categories lightly. Generally speaking, a new acronym only emerges when the industry's collective "to-do list" has become mathematically impossible to complete. And so it seems that the introduction of the Exposure Assessment Platforms (EAP) category is a formal admission that traditional Vulnerability Management (VM) is no longer a viable way to secure a modern

Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs

(Wednesday January 21, 2026)

Security vulnerabilities were uncovered in the popular open-source artificial intelligence (AI) framework Chainlit that could allow attackers to steal sensitive data, which may allow for lateral movement within a susceptible organization. Zafran Security said the high-severity flaws, collectively dubbed ChainLeak, could be abused to leak cloud environment API keys and steal sensitive files, or

VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

(Wednesday January 21, 2026)

The recently discovered sophisticated Linux malware framework known as VoidLink is assessed to have been developed by a single person with assistance from an artificial intelligence (AI) model. That's according to new findings from Check Point Research, which identified operational security blunders by malware's author that provided clues to its developmental origins. The latest insight makes

Fake PNB MetLife payment pages abusing UPI & Telegram bots

(Wednesday January 21, 2026)

Overview While actively hunting for phishing site, I came across multiple web pages impersonating PNB MetLife Insurance and presenting themselves as official policy premium payment gateways. This activity highlights how scammers deliberately target reputed and widely trusted brands to exploit existing customer trust and increase the likelihood of successful financial fraud. Although the pages claim…

Universal News Scraper

(Wednesday January 21, 2026)

A robust CLI news scraper and aggregator. Features topic auto-discovery (via Bing RSS), anti-blocking logic, keyword/date filtering, and JSON/CSV export. Built with Python & Rich. - Ilias1988/Universal-News-Scraper

oss-sec: GNU InetUtils Security Advisory: remote authentication by-pass in telnetd

(Wednesday January 21, 2026)

_Date_: Tue, 20 Jan 2026 15:00:07 +0100 If you are tired of modern age vulnerabilities, and remember the good old times on bugtraq, I hope you will appreciate this one. If someone can allocated a CVE, we will add it in future release notes. /Simon # GNU InetUtils Security Advisory: remote authentication by-pass in telnetd The telnetd server invokes /usr/bin/login (normally running as root) passing the value of the USER environ

LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords

(Wednesday January 21, 2026)

LastPass is alerting users to a new active phishing campaign that's impersonating the password management service, which aims to trick users into giving up their master passwords. The campaign, which began on or around January 19, 2026, involves sending phishing emails claiming upcoming maintenance and urging them to create a local backup of their password vaults in the next 24 hours. The

When The Gateway Becomes The Doorway: Pre-Auth RCE in API Management

(Wednesday January 21, 2026)

Discover how a decade-old vulnerability class leads to pre-authentication Remote Code Execution (RCE) in an enterprise API management platform. This article details the end-to-end compromise of an API Gateway, from initial subdomain reconnaissance and API fuzzing to achieving an interactive reverse shell via unsafe Java deserialization in unauthenticated cluster sync endpoints.

CERT/CC Warns binary-parser Bug Allows Node.js Privilege-Level Code Execution

(Wednesday January 21, 2026)

A security vulnerability has been disclosed in the popular binary-parser npm library that, if successfully exploited, could result in the execution of arbitrary JavaScript. The vulnerability, tracked as CVE-2026-1245 (CVSS score: N/A), affects all versions of the module prior to version 2.3.0, which addresses the issue. Patches for the flaw were released on November 26, 2025. Binary-parser is a

North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

(Tuesday January 20, 2026)

The North Korean threat actors associated with the long-running Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code (VS Code) projects as lures to deliver a backdoor on compromised endpoints. The latest finding demonstrates continued evolution of the new tactic that was first discovered in December 2025, Jamf Threat Labs said. "This activity involved

Billion-Dollar Bait & Switch: Exploiting a Race Condition in Blockchain Infrastructure

(Tuesday January 20, 2026)

My 3 am realization exposed a vulnerability in blockchain infrastructure handling billions in cryptocurrency transactions. This vulnerability writeup details a critical race condition I found in the Flashbots Ethereum MEV-Boost relay that allowed attackers to hijack MEV auctions and trick validators.

Four priorities for AI-powered identity and network access security in 2026

(Tuesday January 20, 2026)

Discover four key identity and access priorities for the new year to strengthen your organization's identity security baseline. The post .

The AI Fix #84: A hungry ghost trapped in a jar gains access to the Pentagon’s network

(Tuesday January 20, 2026)

In episode 84 of The AI Fix, Graham and Mark stare straight into the digital abyss and ask the most important question of our age: "Is AI just a hungry ghost trapped in a jar?" Also this week, we explore how a shadowy group of disgruntled insiders trying to destroy AI by poisoning its training data, how "vibe-coding" has stopped being a joke with even Linus Torvalds joining in, how Google’s AI health advice could have endangered lives, and why simply asking an AI the same question twice can turn it from clueless to near-omniscient. Oh, and AI has managed to crack some famously unsolved...

Three Flaws in Anthropic MCP Git Server Enable File Access and Code Execution

(Tuesday January 20, 2026)

A set of three security vulnerabilities has been disclosed in mcp-server-git, the official Git Model Context Protocol (MCP) server maintained by Anthropic, that could be exploited to read or delete arbitrary files and execute code under certain conditions. "These flaws can be exploited through prompt injection, meaning an attacker who can influence what an AI assistant reads (a malicious README,

Hackers Use LinkedIn Messages to Spread RAT Malware Through DLL Sideloading

(Tuesday January 20, 2026)

Cybersecurity researchers have uncovered a new phishing campaign that exploits social media private messages to propagate malicious payloads, likely with the intent to deploy a remote access trojan (RAT). The activity delivers "weaponized files via Dynamic Link Library (DLL) sideloading, combined with a legitimate, open-source Python pen-testing script," ReliaQuest said in a report shared with

Building Trust in AI Agent Ecosystems

(Tuesday January 20, 2026)

Explore how enterprises build secure AI agent ecosystems using frameworks and tools like Project CodeGuard and MCP Scanner to ensure trust and accountability.

The Hidden Risk of Orphan Accounts

(Tuesday January 20, 2026)

The Problem: The Identities Left Behind As organizations grow and evolve, employees, contractors, services, and systems come and go - but their accounts often remain. These abandoned or “orphan” accounts sit dormant across applications, platforms, assets, and cloud consoles. The reason they persist isn’t negligence - it’s fragmentation. Traditional IAM and IGA systems are designed

Evelyn Stealer Malware Abuses VS Code Extensions to Steal Developer Credentials and Crypto

(Tuesday January 20, 2026)

Cybersecurity researchers have disclosed details of a malware campaign that's targeting software developers with a new information stealer called Evelyn Stealer by weaponizing the Microsoft Visual Studio Code (VS Code) extension ecosystem. "The malware is designed to exfiltrate sensitive information, including developer credentials and cryptocurrency-related data. Compromised developer

Cloudflare Zero-day: Accessing Any Host Globally

(Tuesday January 20, 2026)

Discover how a Cloudflare WAF bypass in /.well-known/acme-challenge/ exposed origins, its impact, and the fix. A must-read for security pros.

Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers

(Tuesday January 20, 2026)

Cloudflare has addressed a security vulnerability impacting its Automatic Certificate Management Environment (ACME) validation logic that made it possible to bypass security controls and access origin servers. "The vulnerability was rooted in how our edge network processed requests destined for the ACME HTTP-01 challenge path (/.well-known/acme-challenge/*)," the web infrastructure

Why Secrets in JavaScript Bundles are Still Being Missed

(Tuesday January 20, 2026)

Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily exposed? To find out, Intruder’s research team looked at what traditional vulnerability scanners actually cover and built a new secrets detection method to address gaps in existing approaches. Applying this at scale by scanning 5 million applications revealed over

Tudou Guarantee Marketplace Halts Telegram Transactions After Processing Over $12 Billion

(Tuesday January 20, 2026)

A Telegram-based guarantee marketplace known for advertising a broad range of illicit services appears to be winding down its operations, according to new findings from Elliptic. The blockchain intelligence company said Tudou Guarantee has effectively ceased transactions through its public Telegram groups following a period of significant growth. The marketplace is estimated to have processed

Hackers disrupt Iranian state TV to support exiled prince

(Tuesday January 20, 2026)

Hackers break into Iranian state television satellite transmissions to air footage supporting the country's exiled former prince and calling on security forces to lay down their weapons.

Google Gemini Prompt Injection Flaw Exposed Private Calendar Data via Malicious Invites

(Monday January 19, 2026)

Cybersecurity researchers have disclosed details of a security flaw that leverages indirect prompt injection targeting Google Gemini as a way to bypass authorization guardrails and use Google Calendar as a data extraction mechanism. The vulnerability, Miggo Security's Head of Research, Liad Eliyahu, said, made it possible to circumvent Google Calendar's privacy controls by hiding a dormant

Frida 17.6.0 released – major Android stability improvements, Android 16 support

(Monday January 19, 2026)

Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX

⚡ Weekly Recap: Fortinet Exploits, RedLine Clipjack, NTLM Crack, Copilot Attack & More

(Monday January 19, 2026)

In cybersecurity, the line between a normal update and a serious incident keeps getting thinner. Systems that once felt reliable are now under pressure from constant change. New AI tools, connected devices, and automated systems quietly create more ways in, often faster than security teams can react. This week’s stories show how easily a small mistake or hidden service can turn into a real

DevOps & SaaS Downtime: The High (and Hidden) Costs for Cloud-First Businesses

(Monday January 19, 2026)

Just a few years ago, the cloud was touted as the “magic pill” for any cyber threat or performance issue. Many were lured by the “always-on” dream, trading granular control for the convenience of managed services. In recent years, many of us have learned (often the hard way) that public cloud service providers are not immune to attacks and SaaS downtime, hiding behind the Shared Responsibility

New StackWarp Hardware Flaw Breaks AMD SEV-SNP Protections on Zen 1–5 CPUs

(Monday January 19, 2026)

A team of academics from the CISPA Helmholtz Center for Information Security in Germany has disclosed the details of a new hardware vulnerability affecting AMD processors. The security flaw, codenamed StackWarp, can allow bad actors with privileged control over a host server to run malicious code within confidential virtual machines (CVMs), undermining the integrity guarantees provided by AMD

CrashFix Chrome Extension Delivers ModeloRAT Using ClickFix-Style Browser Crash Lures

(Monday January 19, 2026)

Cybersecurity researchers have disclosed details of an ongoing campaign dubbed KongTuke that used a malicious Google Chrome extension masquerading as an ad blocker to deliberately crash the web browser and trick victims into running arbitrary commands using ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) dubbed ModeloRAT. This new escalation of ClickFix,

Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

(Monday January 19, 2026)

Cybersecurity researchers have disclosed a cross-site scripting (XSS) vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we were able to collect system fingerprints, monitor active sessions, and – in a twist that will

After the Takedown: Excavating Abuse Infrastructure with DNS Sinkholes

(Sunday January 18, 2026)

DNS sinkholing does not erase abuse infrastructure but captures it at the moment of intervention, creating a stable boundary from which pre-takedown organiza...

Successful Errors: New Code Injection and SSTI Techniques

(Sunday January 18, 2026)

Clear and obvious name of the exploitation technique can create a false sense of familiarity, even if its true potential was never researched, the technique itself is never mentioned and payloads are limited to a couple of specific examples. This research focuses on two such techniques for Code Injection and SSTI. - vladko312/Research_Successful_Errors

Account Takeover in Facebook mobile app due to usage of cryptographically unsecure random number generator and XSS in Facebook JS SDK

(Sunday January 18, 2026)

Facebook Javascript SDK and Facebook plugins

Weekly Update 487

(Sunday January 18, 2026)

Black Basta Ransomware Leader Added to EU Most Wanted and INTERPOL Red Notice

(Saturday January 17, 2026)

Ukrainian and German law enforcement authorities have identified two Ukrainians suspected of working for the Russia-linked ransomware-as-a-service (RaaS) group Black Basta. In addition, the group's alleged leader, a 35-year-old Russian national named Oleg Evgenievich Nefedov (Нефедов Олег Евгеньевич), has been added to the European Union's Most Wanted and INTERPOL's Red Notice lists, authorities

React2shell attack lab

(Saturday January 17, 2026)

React2Shell (CVE-2025-55182 / CVE-2025-66478) vulnerability lab - Learn to detect and exploit vulnerable Next.js applications

OpenAI to Show Ads in ChatGPT for Logged-In U.S. Adults on Free and Go Plans

(Saturday January 17, 2026)

OpenAI on Friday said it would start showing ads in ChatGPT to logged-in adult U.S. users in both the free and ChatGPT Go tiers in the coming weeks, as the artificial intelligence (AI) company expanded access to its low-cost subscription globally. "You need to know that your data and conversations are protected and never sold to advertisers," OpenAI said. "And we need to keep a high bar and give

GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection

(Friday January 16, 2026)

The JavaScript (aka JScript) malware loader called GootLoader has been observed using a malformed ZIP archive that's designed to sidestep detection efforts by concatenating anywhere from 500 to 1,000 archives. "The actor creates a malformed archive as an anti-analysis technique," Expel security researcher Aaron Walton said in a report shared with The Hacker News. "That is, many unarchiving tools

StackWarp: Exploiting Stack Layout Vulnerabilities in Modern Processors

(Friday January 16, 2026)

StackWarp is a security vulnerability that exploits a synchronization bug present in all AMD Zen 1–5 processors. In the context of SEV-SNP, this flaw allows malicious VM hosts to manipulate the guest VM’s stack pointer. This enables hijacking of both control and data flow, allowing an attacker to achieve remote code execution and privilege escalation inside a confidential VM. __ READ __ CITE @inproceedings{Zhang2026StackWarp, author = {Ruiyi Zhang and Tristan Hornetz and Daniel Weber...

Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts

(Friday January 16, 2026)

Cybersecurity researchers have discovered five new malicious Google Chrome web browser extensions that masquerade as human resources (HR) and enterprise resource planning (ERP) platforms like Workday, NetSuite, and SuccessFactors to take control of victim accounts. "The extensions work in concert to steal authentication tokens, block incident response capabilities, and enable complete account

Your Digital Footprint Can Lead Right to Your Front Door

(Friday January 16, 2026)

You lock your doors at night. You avoid sketchy phone calls. You’re careful about what you post on social media. But what about the information about you that’s already out there—without your permission? Your name. Home address. Phone number. Past jobs. Family members. Old usernames. It’s all still online, and it’s a lot easier to find than you think. The hidden safety threat lurking online Most

LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing

(Friday January 16, 2026)

Security experts have disclosed details of a new campaign that has targeted U.S. government and policy entities using politically themed lures to deliver a backdoor known as LOTUSLITE. The targeted malware campaign leverages decoys related to the recent geopolitical developments between the U.S. and Venezuela to distribute a ZIP archive ("US now deciding what's next for Venezuela.zip")

Multiple cross-site leaks disclosing Facebook users in third-party websites

(Friday January 16, 2026)

Introduction This write-up consolidates several XS-Leak issues discovered across Meta-owned platforms, including Facebook, Workplace, Meta for Work, and internal Meta surfaces.

Instagram account takeover via Meta Pixel script abuse

(Friday January 16, 2026)

Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites. In many cases, the only security control enforced is an origin check validating that messages originate from facebook.com or its subdomains.

Leaking Meta FXAuth Token leading to 2 click Account Takeover

(Friday January 16, 2026)

Introduction FXAuth is Meta’s shared authentication system used across Facebook, Instagram, and Meta (Horizon / VR). It is used by Accounts Center for account linking, re-authentication, and sensitive action confirmation.

What is "Has Madison Account" in Account info subscriber on Google account

(Friday January 16, 2026)

China-Linked APT Exploited Sitecore Zero-Day in Critical Infrastructure Intrusions

(Friday January 16, 2026)

A threat actor likely aligned with China has been observed targeting critical infrastructure sectors in North America since at least last year. Cisco Talos, which is tracking the activity under the name UAT-8837, assessed it to be a China-nexus advanced persistent threat (APT) actor with medium confidence based on tactical overlaps with other campaigns mounted by threat actors from the region.

Weekly Update 486

(Friday January 16, 2026)

. It’s special here, like a second home that just feels…

Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways

(Friday January 16, 2026)

Cisco on Thursday released security updates for a maximum-severity security flaw impacting Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager, nearly a month after the company disclosed that it had been exploited as a zero-day by a China-nexus advanced persistent threat (APT) actor codenamed UAT-9686. The vulnerability, tracked as CVE-2025-20393 (CVSS

WinBoat: Drive by Client RCE + Sandbox escape.

(Friday January 16, 2026)

A remote webpage can abuse an unauthenticated guest HTTP API to compromise the Windows guest container, then feed a malicious app entry leading to Linux host code execution on click.

AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks

(Thursday January 15, 2026)

A critical misconfiguration in Amazon Web Services (AWS) CodeBuild could have allowed complete takeover of the cloud service provider's own GitHub repositories, including its AWS JavaScript SDK, putting every AWS environment at risk. The vulnerability has been codenamed CodeBreach by cloud security company Wiz. The issue was fixed by AWS in September 2025 following responsible disclosure on

Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation

(Thursday January 15, 2026)

Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.

WEF: AI overtakes ransomware as fastest-growing cyber risk

(Thursday January 15, 2026)

We can no longer say that artificial intelligence is a "future risk", lurking somewhere on a speculative threat horizon. The truth is that it is a fast-growing cybersecurity risk that organizations are facing today. That's not just my opinion, that's also the message that comes loud and clear from the World Economic Forum's newly-published "Global Cybersecurity Outlook 2026." Read more in my article on the Fortra blog.

Demonstration: prompt-injection failures in a simulated help-desk LLM

(Thursday January 15, 2026)

The requested lab could not be found.

CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center

(Thursday January 15, 2026)

Cymulate Research Labs uncovered CVE-2026-20965, a token validation flaw in Azure Windows Admin Center enabling tenant-wide RCE and lateral movement.

Critical WordPress Modular DS Plugin Flaw Actively Exploited to Gain Admin Access

(Thursday January 15, 2026)

A maximum-severity security flaw in a WordPress plugin called Modular DS has come under active exploitation in the wild, according to Patchstack. The vulnerability, tracked as CVE-2026-23550 (CVSS score: 10.0), has been described as a case of unauthenticated privilege escalation impacting all versions of the plugin prior to and including 2.5.1. It has been patched in version 2.5.2. The plugin

Researchers Reveal Reprompt Attack Allowing Single-Click Data Exfiltration From Microsoft Copilot

(Thursday January 15, 2026)

Cybersecurity researchers have disclosed details of a new attack method dubbed Reprompt that could allow bad actors to exfiltrate sensitive data from artificial intelligence (AI) chatbots like Microsoft Copilot in a single click, while bypassing enterprise security controls entirely. "Only a single click on a legitimate Microsoft link is required to compromise victims," Varonis security

Smashing Security podcast #450: From Instagram panic to Grok gone wild

(Thursday January 15, 2026)

Confusion reigns after claims that data linked to 17.5 million Instagram accounts is up for sale - sparked by a vague post, contradictory statements, and a flood of password reset emails nobody asked for. And we dig into Grok, Elon Musk’s AI chatbot, after it started generating sexualised images of women and children - raising uncomfortable questions about guardrails, accountability, and why playing the censorship card doesn’t make the problem go away. All this, and much more, in episode 450 of the "Smashing Security" podcast with Graham Cluley, and special guest Monica Verma.

Most Inspiring Women in Cyber 2026: Meet The Judges

(Thursday January 15, 2026)

Next month, the annual Most Inspiring Women in Cyber Awards will take place at The BT Tower, London, celebrating some of the industry’s most inspirational – and oftentimes unsung – women. Sponsored by Fidelity International, BT, Plexal and Bridewell, and proudly supported by industry-leading diversity groups WiTCH, WiCyS UK&I and Seidea, the 2026 event is […] The post .

ThreatsDay Bulletin: AI Voice Cloning Exploit, Wi-Fi Kill Switch, PLC Vulns, and 14 More Stories

(Thursday January 15, 2026)

The internet never stays quiet. Every week, new hacks, scams, and security problems show up somewhere. This week’s stories show how fast attackers change their tricks, how small mistakes turn into big risks, and how the same old tools keep finding new ways to break in. Read on to catch up before the next wave hits. Unauthenticated RCE risk Security Flaw in Redis

Cisco’s Journey in AI Workforce Transformation

(Thursday January 15, 2026)

Cisco’s latest AI research reveals how AI is reshaping the way Cisco employees work—and what that means for individual and team engagement, performance, career growth, and leadership.

Model Security Is the Wrong Frame – The Real Risk Is Workflow Security

(Thursday January 15, 2026)

As AI copilots and assistants become embedded in daily work, security teams are still focused on protecting the models themselves. But recent incidents suggest the bigger risk lies elsewhere: in the workflows that surround those models. Two Chrome extensions posing as AI helpers were recently caught stealing ChatGPT and DeepSeek chat data from over 900,000 users. Separately, researchers

4 Outdated Habits Destroying Your SOC's MTTR in 2026

(Thursday January 15, 2026)

It’s 2026, yet many SOCs are still operating the way they did years ago, using tools and processes designed for a very different threat landscape. Given the growth in volumes and complexity of cyber threats, outdated practices no longer fully support analysts’ needs, staggering investigations and incident response. Below are four limiting habits that may be preventing your SOC from evolving at

Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data

(Thursday January 15, 2026)

Microsoft Legal Action Disrupts RedVDS Cybercrime Infrastructure Used for Online Fraud

(Thursday January 15, 2026)

Microsoft on Wednesday announced that it has taken a "coordinated legal action" in the U.S. and the U.K. to disrupt a cybercrime subscription service called RedVDS that has allegedly fueled millions in fraud losses. The effort, per the tech giant, is part of a broader law enforcement effort in collaboration with law enforcement authorities that has allowed it to confiscate the malicious

Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC

(Thursday January 15, 2026)

Desoldering a drone's flash chip and reconstructing the firmware from broken data.

Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

(Thursday January 15, 2026)

Palo Alto Networks has released security updates for a high-severity security flaw impacting GlobalProtect Gateway and Portal, for which it said there exists a proof-of-concept (PoC) exploit. The vulnerability, tracked as CVE-2026-0227 (CVSS score: 7.7), has been described as a denial-of-service (DoS) condition impacting GlobalProtect PAN-OS software arising as a result of an improper check for

The Triton System Attack: The Most Dangerous Malware Ever Discovered

(Thursday January 15, 2026)

Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers

(Wednesday January 14, 2026)

The Black Lotus Labs team at Lumen Technologies said it null-routed traffic to more than 550 command-and-control (C2) nodes associated with the AISURU/Kimwolf botnet since early October 2025. AISURU and its Android counterpart, Kimwolf, have emerged as some of the biggest botnets in recent times, capable of directing enslaved devices to participate in distributed denial-of-service (DDoS)

Microsoft named a Leader in IDC MarketScape for Unified AI Governance Platforms

(Wednesday January 14, 2026)

Microsoft is honored to be named a Leader in the 2025–2026 IDC MarketScape for Unified AI Governance Platforms, highlighting our commitment to making AI innovation safe, responsible, and enterprise-ready. The post .

Cisco AI Summit will define what comes next

(Wednesday January 14, 2026)

Cisco AI Summit brings together Jensen Huang, Sam Altman, Matt Garman, Marc Andreessen, Dr. Fei-Fei Li, and more to define how artificial intelligence will reshape business and society.

FBI raids home and seizes phone of Washington Post journalist

(Wednesday January 14, 2026)

The reporter had previously reported on the Trump administration's efforts to fire hundreds of thousands of federal workers.

Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover

(Wednesday January 14, 2026)

Introduction

AI Agents Are Becoming Authorization Bypass Paths

(Wednesday January 14, 2026)

Not long ago, AI agents were harmless. They wrote snippets of code. They answered questions. They helped individuals move a little faster. Then organizations got ambitious. Instead of personal copilots, companies started deploying shared organizational AI agents - agents embedded into HR, IT, engineering, customer support, and operations. Agents that don’t just suggest, but act. Agents

Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations

(Wednesday January 14, 2026)

Microsoft’s investigation into RedVDS services and infrastructure uncovered a global network of disparate cybercriminals purchasing and using to target multiple sectors. In collaboration with law enforcement agencies worldwide, Microsoft’s Digital Crimes Unit (DCU) recently facilitated a disruption of RedVDS infrastructure and related operations. The post .

Hackers Exploit c-ares DLL Side-Loading to Bypass Security and Deploy Malware

(Wednesday January 14, 2026)

Security experts have disclosed details of an active malware campaign that's exploiting a DLL side-loading vulnerability in a legitimate binary associated with the open-source c-ares library to bypass security controls and deliver a wide range of commodity trojans and stealers. "Attackers achieve evasion by pairing a malicious libcares-2.dll with any signed version of the legitimate ahost.exe (

Fortinet Fixes Critical FortiSIEM Flaw Allowing Unauthenticated Remote Code Execution

(Wednesday January 14, 2026)

Fortinet has released updates to fix a critical security flaw impacting FortiSIEM that could allow an unauthenticated attacker to achieve code execution on susceptible instances. The operating system (OS) injection vulnerability, tracked as CVE-2025-64155, is rated 9.4 out of 10.0 on the CVSS scoring system. "An improper neutralization of special elements used in an OS command ('OS command

Keeper Security puts Atlassian Williams F1 Team in pole position on cybersecurity

(Wednesday January 14, 2026)

In Formula 1, milliseconds matter… and so does security. Keeper Security has helped Atlassian Williams F1 Team tighten its cyber defences, revealing how the iconic racing team is using KeeperPAM to protect its data, systems and global operations without taking its foot off the accelerator. Announced on 13 January 2026, a new case study from […] The post .

New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification

(Wednesday January 14, 2026)

Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise. Specific offenders: Google Tag Manager (8% of violations), Shopify (5%), Facebook Pixel (4%). Download the

Links:

] The Mad Hacker [

Collecting all the news about Cybersecurity, computer security, cracking, hacking, infosec, netsec, & security vunerabilities in one convenient place