CISA added four vulnerabilities—CVE-2025-40551, CVE-2021-39935, CVE-2019-19006, and CVE-2025-64328—affecting SolarWinds Web Help Desk, GitLab, and Sangoma FreePBX to its Known Exploited Vulnerabilities catalog, including critical RCE, SSRF, authentication bypass, and command injection flaws. Federal civilian agencies must remediate the listed issues under BOD 22-01 by the specified deadlines (SolarWinds by Feb 6,…
Category: Cyber Security News
CERT Polska reports a sustained campaign of destructive attacks against Poland’s energy sector that targeted renewable facilities, a large CHP plant, and a manufacturing supplier, using wiper malware to disrupt OT and distribution connections. Investigators identified two bespoke destructive families, DynoWiper and LazyWiper, and traced infrastructure overlap to the state-linked cluster…
SecurityWeek’s Cyber Insights 2026 gathers experts who warn that cyberwarfare – driven by nation-state pre-positioning, AI-enabled operations, and rising geopolitical tensions – will escalate faster than criminal cybercrime in 2026. The report highlights blurred lines between criminal and state actors, the difficulty of attribution, and the need for improved detection, resilience,…
Tenable researchers discovered two vulnerabilities in the Google Looker business intelligence platform that, collectively named LookOut, could allow an attacker with developer permissions to execute remote code and steal sensitive data. Google patched the flaws in late September 2025 and applied fixes to cloud-hosted instances, but self-hosted Looker deployments must be…
TRM Labs raised $70 million in a Series C round to expand its AI capabilities for disrupting criminal networks and addressing national security risks. The funding, led by Blockchain Capital and bringing TRM’s valuation to $1 billion, will scale engineering and accelerate AI-powered investigative tools used by law enforcement and financial…
New Cyble research shows ransomware attacks rose about 30% since late 2025 and continued into January 2026, with many incidents targeting software and manufacturing supply chains. Top groups such as Qilin and CL0P led high-volume claims while several major supply-chain-related breaches and new ransomware affiliates increased the overall threat. #Qilin #CL0P…
![Cybersecurity News | Daily Recap [03 Feb 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [03 Feb 2026]")
Daily Recap, attackers hijacked an OpenVSX publisher to push the GlassWorm macOS infostealer via malicious extension updates and Notepad++ update tampering, while researchers uncovered 341 ClawHub skills, OpenClaw one-click RCE from a critical token-exfiltration bug (CVE-2026-25253), and MoltBot used to push password-stealing malware across developer ecosystems. The Microsoft section notes APT28 exploiting CVE-2026-21509 to deploy the Covenant loader, NTLM is being phased out in favor of Kerberos, a Windows shutdown bug affects Windows 11 and 10 with a temporary workaround, ShinyHunters expanded extortion to vishing and MFA-credential harvesting alongside the PaneraBread breach, and destructive attacks on Polish energy sites via Fortinet devices, with Mozilla adding an AI controls panel in Firefox and policy moves toward stronger age verification and platform oversight. #GlassWorm #OpenVSX #Notepad++ #ClawHub #OpenClaw #MoltBot #AtomicStealer #CVE-2026-25253 #CVE-2026-21509 #APT28 #CovenantLoader #NTLM #Kerberos #PaneraBread #ShinyHunters #Sandworm #PolandGrid #Fortinet #Firefox #VirtualSecureMode
A sophisticated Iranian state-sponsored espionage campaign attributed to APT42 has used patient social engineering to compromise senior defense and government officials before deploying a modular PowerShell backdoor called TAMECAT. TAMECAT operates primarily in memory with modules for browser data theft, screen capture, file crawling, hardcoded AES-256 configuration, and Telegram-based C2 over…
VulnCheck has observed in-the-wild exploitation of a critical React Native Community CLI vulnerability tracked as CVE-2025-11953, nicknamed Metro4Shell. Attackers are remotely exploiting internet-exposed Metro development servers to deliver a PowerShell loader that disables Microsoft Defender and retrieves a Rust payload targeting Windows and Linux. #Metro4Shell #CVE-2025-11953…
Foxit Software released security updates fixing multiple cross-site scripting (XSS) vulnerabilities in Foxit PDF Editor Cloud and Foxit eSign that could allow attackers to execute arbitrary JavaScript in users’ browsers. The flaws (including CVE-2026-1591, CVE-2026-1592, and CVE-2025-66523) stem from improper input validation and output encoding and have been patched; administrators should…
Lakelands Public Health is responding to a cyberattack discovered on January 29, 2026, securing affected systems and engaging a leading cybersecurity firm to investigate and restore services. Initial investigations indicate sensitive public health records, including infectious disease and immunization data, were not impacted while enhanced monitoring and access controls are implemented…
Mountain View has paused its Flock Safety ALPR pilot and turned off all cameras after discovering that out-of-state and nationwide searches accessed the city’s license plate data without authorization. The breach exposed vendor transparency and access-control failures, prompting a City Council review and renewed debate over vendor-managed surveillance. #FlockSafety #MountainView…
RapidFort raised $42 million in a Series A round led by Blue Cloud Ventures and Forgepoint Capital to accelerate its automated vulnerability elimination technology. The company’s platform secures the software lifecycle by generating SBOMs, offering near-zero-CVE container images, and applying runtime hardening to reduce attack surface while meeting standards like FedRAMP…
Write 2 sentences summarizing the content. At the end, add hashtags for specific keywords mentioned in the article—such as names of malware, threat actors, or affected organizations/systems. Avoid general terms like #malware, #ransomware, or #cybersecurity. Use this format: #Keyword1 #Keyword2…
A newly disclosed critical vulnerability in the vLLM Python package (CVE-2026-22778) allows remote code execution by submitting a malicious video URL to multimodal API endpoints, putting millions of AI servers at risk. The flaw stems from a PIL memory-address disclosure combined with a JPEG2000 heap overflow in FFmpeg (bundled with OpenCV);…