Cybersecurity News | Daily Recap [30 Jan 2026]

hendryadrian.com

hendryadrian.com

Vulnerabilities & Exploits

• A pair of critical n8n eval‑injection flaws (CVE‑2026‑1470, CVE‑2026‑0863) could allow authenticated remote code execution and full instance takeover, with patches released in multiple n8n builds — n8n RCE, n8n RCE
• Multiple actively exploited flaws including a Microsoft Office bypass (CVE‑2026‑21509), GNU InetUtils telnetd root bug, SmarterMail RCEs and a Linux kernel integer overflow were added to CISA’s KEV catalog with a remediation deadline of Feb 16, 2026 — KEV Additions
• The six‑month‑old CVE‑2025‑8088 WinRAR path‑traversal bug continues to be weaponized by state‑linked and criminal groups (UNC4895/RomCom, APT44, Turla) to drop payloads like NESTPACKER/Snipbot, STOCKSTAY and POISONIVY via Alternate Data Streams — WinRAR Abuse

AI, LLMs & Cloud Abuse

• A large‑scale LLMjacking operation dubbed Operation Bizarre Bazaar scans and hijacks exposed LLM/MCP endpoints to resell API access, exfiltrate data and monetize compute (over 35,000 observed sessions; targets include Ollama and OpenAI‑compatible endpoints) — LLM Hijack
• A Pakistan‑linked campaign called “Sheet Attack” abuses Google Sheets as a C2 to target Indian government entities using tools like SHEETCREEP, showing AI‑assisted malware development and cloud‑service blending — Sheet Attack
• An exposed Bondu AI toy admin panel leaked tens of thousands of children’s transcripts and personal data via an IDOR/auth bypass, prompting takedown and investigation — Bondu Panel
• The acting CISA director triggered alerts by uploading sensitive contracting files into public ChatGPT, prompting a DHS damage assessment and scrutiny of public AI tool use in government — CISA ChatGPT

Networks & Botnets

• Google disrupted/dismantled the global IPIDEA residential proxy network that covertly enrolled millions of consumer devices via SDKs, seizing control domains and degrading proxy operations used for espionage and cybercrime — IPIDEA Takedown, IPIDEA Takedown

Incidents & Data Leaks

• A new wave of breaches hit consumer platforms including Bumble, Panera, Match Group and CrunchBase, with limited data exposure reported and the group ShinyHunters claiming responsibility via vishing and extortion tactics — Platform Attacks
• Hudson Rock recovered internal operational documents exfiltrated from a Gaza Strip machine by an infostealer that revealed plans and OPSEC requests tied to the Breaking Dawn operation — Gaza Infostealer
• An independent report finds EU data‑breach notifications rose 22% year‑on‑year to an average of 443 notifications/day and GDPR fines reached about €1.2 billion in 2025, warning proposed rules (Digital Omnibus, NIS2, DORA) could reshape incident‑notification thresholds and enforcement — EU Breaches

Malware, Initial Access & Mobile Threats

• Initial access broker TA584 is using aged compromised accounts and geofenced redirect chains to deploy PowerShell loaders that load Tsundere Bot (Node.js MaaS retrieving C2 via Ethereum) and XWorm, likely enabling ransomware follow‑ons — Tsundere Bot
• An Android romance‑scam campaign called GhostChat lured victims (notably in Pakistan) to install spyware disguised as chat apps, enabling silent surveillance and exfiltration tied to ClickFix social engineering and WhatsApp QR linking — GhostChat Spyware
• Malicious Chrome extensions were shown to be capable of spying on users’ ChatGPT chats, highlighting extension risk to AI interaction privacy — Chrome Spy Extensions

Critical Infrastructure & OT

• A coordinated cyberattack on Poland’s grid impacted around 12–30 distributed energy sites (CHP, wind, solar), damaged OT equipment and wiped Windows systems but failed to cut power (~1.2 GW / 5% of supply); Dragos attributes the campaign with moderate confidence to the Russian‑linked Electrum using wipers like DynoWiper, Caddywiper and Industroyer2 — Poland Grid
• A survey of 100+ energy systems reveals pervasive critical OT cybersecurity gaps across the sector, underscoring risks to distributed energy and industrial control environments — OT Survey

Policy, Industry & Strategy

• SecurityWeek’s Cyber Insights 2026 frames Zero Trust as an ongoing identity‑first journey complicated by AI, non‑human identities, OT/IT convergence and regulation, urging continuous verification and microsegmentation — Zero Trust
• PwC and Google Cloud struck a $400 million, three‑year deal to build AI‑powered security operations that integrate Google threat intelligence with PwC managed services for hybrid and multi‑cloud defense — PwC Google
• Guidance and decision pieces for CISOs outline three priority choices to reduce downtime risk in 2026, emphasizing resilience, identity controls and measured automation adoption — CISO Decisions
• Analysis comparing background activities of the GoTo Resolve tool to common ransomware tactics highlights telemetry and governance gaps enterprises should assess — GoTo Resolve

Cybersecurity News | Daily Recap – hendryadrian.com