Microsoft announced that Exchange Web Services (EWS) for Exchange Online will be shut down on April 1, 2027, with default blocking beginning October 1, 2026 and no exceptions after the final cutoff. Administrators can temporarily preserve access by configuring application allowlists by the end of August 2026, Microsoft will pre-populate allowlists in September 2026 for tenants that do not create their own, may run temporary “scream tests” to expose hidden dependencies, and recommends migrating apps to the Microsoft Graph API. #ExchangeWebServices #MicrosoftGraph
Category: Cyber Security News
Researchers at Tenable disclosed two critical vulnerabilities called “LookOut” that can enable remote code execution and the theft of Looker’s internal management database, risking full system takeover and exposure of sensitive corporate data. Organizations running self-hosted Looker must apply patches immediately while Google has secured its managed cloud; #LookOut #GoogleLooker…
Independent researcher Kevin Beaumont says three East Asia–linked organizations reported incidents where attackers gained hands‑on‑keyboard access by exploiting the Notepad++ updater. The vulnerability involved the GUP/WinGUP updater downloading and executing files from notepad-plus-plus.org (via gup.xml and %TEMP%) that could be redirected through ISP‑level TLS interception, and Beaumont’s December theory was later…
A Chinese-aligned threat group known as Amaranth-Dragon rapidly weaponized a WinRAR path traversal flaw (CVE-2025-8088) to deliver malicious RAR archives that execute code when opened, targeting government and law enforcement agencies across Southeast Asia. The attackers deploy an Amaranth loader to fetch Havoc C2 payloads and a TGAmaranth RAT that uses…
Orca Security warns that GitHub Codespaces automatically executes VS Code–integrated configuration files when opening repositories or pull requests, creating a supply chain attack vector. Attackers can abuse .vscode files, devcontainer.json, and terminal variables to run commands, exfiltrate GitHub tokens and Codespaces secrets, and leverage vulnerabilities like “0.0.0.0 Day” to expand access….
Sygnia uncovered a coordinated campaign of cloned law-firm websites comprising more than 150 related domains designed for evasion and persistence. The sites use multiple registrars, distinct SSL/TLS certificates, Cloudflare protection, and recycled phone numbers while promising free asset recovery to lure victims—if in doubt, examine the site’s depth. #Sygnia #Cloudflare…
Substack disclosed a security incident after a hacker leaked user records allegedly taken from its systems, exposing email addresses, phone numbers, and internal metadata. The company says passwords and payment information were not exposed, notified users after discovering the October 2025 incident on February 3, and urged vigilance for suspicious messages….
The viral AI-built social network Moltbook exposed 1.5 million API tokens, tens of thousands of emails and thousands of private messages due to a misconfigured production database. Wiz researchers found an exposed client-side Supabase API key that granted unauthenticated read/write access because AI-generated code omitted Row Level Security, allowing agent impersonation…
![Cybersecurity News | Daily Recap [04 Feb 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [04 Feb 2026]")
Daily Recap, patches and active exploitation are underway for several critical flaws, including the Metro4Shell vulnerability (CVE-2025-11953) delivering PowerShell loaders, the vLLM RCE via malicious video URLs affecting millions of AI servers, and Foxit PDF Editor XSS bugs requiring immediate updates and mitigations. Additionally, Iran-linked APT42 used social engineering to deploy the fileless TAMECAT backdoor; Mountain View shut down Flock Safety ALPR cameras after unauthorized searches, Lakelands Health disclosed a cyberattack with no patient data exposure, Grok investigations in France prompting a raid, and RADICL and RapidFort securing funding to boost threat detection and software supply-chain security. #Metro4Shell #vLLMRCE #FoxitXSS #APT42 #TAMECAT #MountainView #FlockSafety #LakelandsHealth #Grok #Europol #FranceBan #RADICL #RapidFort
Attackers are abusing unsecured Zendesk support ticket forms to flood inboxes worldwide with automated “Activate your account” and support-style emails that bypass spam filters. The surge mirrors a January relay-spam campaign that hit companies including Dropbox and 2K, raising concerns that recent Zendesk safeguards may not fully stop this abuse. #Zendesk #RelaySpam
Betterment suffered a January breach that exposed personal data from 1,435,174 accounts, including email addresses, names, and other contact and identifying details. Attackers also sent fraudulent promotional emails to solicit cryptocurrency, and a CrowdStrike-supported forensic investigation reported no evidence that customer account credentials were accessed. #Betterment #CrowdStrike
Substack has notified users that attackers stole email addresses, phone numbers, and other internal metadata in October 2025, and the company says it only discovered the breach in February 2026. Substack claims credentials and financial information were not accessed, it has patched the flaw, and a threat actor later leaked 697,313 alleged records on BreachForums. #Substack #BreachForums
Italy says it foiled a series of cyberattacks that targeted some of its foreign ministry offices, including one in Washington, as well as Winter Olympics websites and hotels in Cortina d’Ampezzo. Foreign Minister Antonio Tajani attributed the attempted attacks to Russia, and Interior Minister Matteo Piantedosi said 6,000 security officers are…
Nullify raised $12.5 million in a seed round led by SYN Ventures, bringing total funding to $16.9 million to scale go-to-market, engineering and research teams, and expand internationally. Nullify’s AI-based autonomous workforce for vulnerability management integrates with codebases, cloud environments, ticketing systems and a long-term memory called Vault to detect, triage,…
A critical expression-escape vulnerability, CVE-2026-25049, in n8n allows authenticated users to execute arbitrary system commands by bypassing the platform’s expression sandbox. Users should upgrade immediately to patched releases to mitigate a high-impact flaw that evades prior fixes. #n8n #CVE-2026-25049…