SentinelOne and Censys uncovered roughly 175,000 exposed Ollama hosts worldwide, many operating without authentication, monitoring, or safety guardrails, with 23,000 hosts driving most activity across 130 countries and 4,032 ASNs. About half of these hosts could execute code and access APIs, enabling low-cost abuse for spam, phishing, disinformation, prompt injection, and…
Category: Cyber Security News
Aisy has launched from stealth with $2.3 million in seed funding to deliver an AI-assisted platform that helps security teams manage and prioritize overwhelming volumes of vulnerability alert tickets. It maps systems from an attacker’s perspective and chains related alerts to surface the most critical issues for remediation while using AI…
This weekly roundup covers major global cyber incidents, emerging threats in AI and ad fraud, critical zero-day patches, and growing regulatory scrutiny affecting public and private sectors. Highlights include the disruptive attack on Russian security firm Delta, the discovery of the ShadowHS Linux post-exploitation framework, Ivanti emergency fixes for CVE-2026-1281 and…
A recent attack on Poland’s power grid targeted communication and control systems across roughly 30 sites, compromising RTUs and other OT devices and causing irreversible ICS damage at some locations. Dragos attributes the operation with moderate confidence to Electrum (related to Sandworm), while ESET reported Sandworm deployed wiper malware; the attackers…
Attackers abused Hugging Face datasets to distribute an Android remote access trojan via a fake security app named TrustBastion, Bitdefender reports. The TrustBastion dropper tricks users with update dialogs, fetches payloads from a Hugging Face repository, requests broad Accessibility and screen-capture permissions, and uses persistent C&C channels to exfiltrate screen content…
On January 22, 2026, France’s data protection authority, the CNIL, imposed a €5 million fine on France Travail for failing to properly secure the personal data of job seekers following a major 2024 breach. Investigators found that social engineering against CAP EMPLOI adviser accounts, weak authentication, overly broad permissions and poor…
Two critical code-injection zero-days in Ivanti Endpoint Manager Mobile (CVE-2026-1281 and CVE-2026-1340) allowed unauthenticated attackers to execute arbitrary code and compromise on-premises EPMM appliances, prompting Ivanti to issue emergency RPM mitigations. Exploited systems exposed administrator and user credentials, device identifiers and location data, and CISA added CVE-2026-1281 to its Known Exploited…
Ad fraud has escalated into a systemic threat to the digital economy, with mobile fraud rising 21% in 2024 and programmatic ad fraud costing the industry nearly $50 billion. During Data Privacy Week 2026, experts like Dhiraj Gupta of mFilterIt emphasize that independent verification, real-time data-flow audits, and continuous partner accountability…
Microsoft linked recent Windows 11 boot failures after the January 2026 update to devices that previously failed to install the December 2025 security update and were left in an “improper state.” Attempting to install updates while in that state can produce an UNMOUNTABLE_BOOT_VOLUME BSOD and Microsoft is working on a partial fix that won’t repair already-unbootable devices. #Windows11 #KB5074109
![Cybersecurity News | Daily Recap [29 Jan 2026]](https://www.hendryadrian.com/tweet/image/DailyRecap.png "Cybersecurity News | Daily Recap [29 Jan 2026]")
Daily Recap, The day’s cybersecurity news shows ongoing exploitation of the WinRAR CVE-2025-8088 to drop silent payloads into Windows Startup folders by nation-state and criminal groups. It also highlights high-severity flaws such as Grist Core RCE in Pyodide, React2Shell deserialization, Fortinet FortiOS SSO bypass, and other attacks, underscoring urgent patching and proactive defense. #WinRAR #React2Shell
Marquis Software Solutions says the August 2025 ransomware attack that affected dozens of U.S. banks and credit unions was enabled by firewall configuration data stolen from SonicWall’s MySonicWall cloud backup rather than by exploiting an unpatched firewall. SonicWall later confirmed all cloud backup customers were impacted, Mandiant linked the breach to state-sponsored actors, and Marquis is evaluating options to seek recoupment for response costs. #MarquisSoftwareSolutions #SonicWall
Match Group confirmed a cybersecurity incident after the ShinyHunters threat group leaked 1.7 GB of files allegedly containing user records and internal documents from Hinge, Match, and OkCupid. The company says a limited amount of user data was accessed via a compromised Okta SSO account but that there is no indication of stolen log-in credentials, financial information, or private communications. #ShinyHunters #MatchGroup
Google Threat Intelligence Group (GTIG), together with industry partners, disrupted IPIDEA by taking down domains and sharing intelligence on its proxy SDKs, infected-device management, and traffic routing infrastructure. IPIDEA covertly enrolled millions of devices through trojanized Android apps and Windows binaries to sell proxy access to over 550 threat groups and support botnets like Aisuru and Kimwolf. #IPIDEA #BadBox2_0
Ivanti disclosed two critical code‑injection zero‑day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-1281 and CVE-2026-1340, both rated CVSS 9.8 and observed in limited active exploitation. Ivanti released RPM hotfixes that require no downtime but must be reapplied after upgrades and provided detection and remediation guidance while a permanent fix arrives in EPMM 12.8.0.0. #Ivanti #EPMM #CVE-2026-1281 #CVE-2026-1340 #CISA
Researchers at Bitdefender uncovered an Android campaign that uses Hugging Face repositories and CDN links to host and deliver thousands of polymorphic APK payloads via a dropper called TrustBastion. The remote-access payload abuses Android Accessibility Services to present fake Alipay and WeChat login overlays, capture screenshots, steal credentials and exfiltrate data to a persistent C2. #TrustBastion #HuggingFace