Russia-linked APT28 exploited a newly disclosed Microsoft Office flaw within days of disclosure.

CVE-2026-21509 was used via malicious RTF files, with geo-fenced delivery targeting Ukraine, Slovakia, and Romania.

Mozilla will add 1-click Firefox setting to fully disable generative AI features.

With Firefox 148, users can block all current and future AI features or manage them individually, keeping AI strictly opt-in as browsers add more automation.

SATOSHI NAKAMOTO WALLET JUST BECAME ACTIVE AGAIN!

SOMEONE TRANSFERRED IN 2,565 $BTC AFTER 15 YEARS OF DORMANCY.

SO SATOSHI IS ALIVE AND BUYING BITCOIN?

Almost 1.4M users reportedly affected in Betterment breach.

Spain's Ministry of Science shuts down systems after breach claims.

Russian group APT28 (aka Fancy Bear or UAC-0001) has launched a sophisticated espionage campaign targeting European military and government entities.

WHO confirms the United States officially withdrew from the World Health Organization, effective Jan 22, 2026.

Best thing to happen to the rest of the world!

@TheGhostsITM

Nearly 5 Million Web Servers Found Exposing Git Metadata – Study Reveals Widespread Risk of Code and Credential Leaks.

Hacker targets 155 countries in 'Shadow Campaigns' espionage op

According to Palo Alto Networks’ Unit 42 division, the group has been active since at least January 2024, and there is high confidence that it operates from Asia. Until definitive attribution is possible, the researchers track the actor as TGR-STA-1030/UNC6619.

Ivanti EPMM Zero-Day Exploits Breach Dutch Regulators, Linked to Wider 🇪🇺 EU Government Intrusions.

Attackers exploited CVSS 9.8 unauthenticated RCE flaws to access employee work contact data.

Related activity also impacted the European Commission and Finland’s Valtori systems.

Ivanti released fixes for CVE-2026-1281 and CVE-2026-1340 (CVSS scores: 9.8), which could be exploited by an attacker to achieve unauthenticated remote code execution.

Chinese cyberspies breach Singapore's four largest telcos.

German Agencies Warn of Signal Phishing Targeting Politicians, Military, Journalists.

Fortinet Fixes Critical FortiClientEMS RCE (CVE-2026-21643, CVSS 9.1).

SQL injection flaw enables unauthenticated remote command execution via crafted requests. Affects EMS 7.4.4 (patch available).

Separate FortiCloud SSO bug is actively exploited for admin persistence and firewall config theft.

Singapore’s cyber agency says China-linked UNC3886 targeted all four national telecom operators.

Attackers used a firewall zero-day and rootkits to access parts of critical systems. Espionage activity was contained. No service disruption or customer data theft found.

The Microsoft Defender Security Research Team said it's not clear whether the activity weaponized recently disclosed flaws (CVE-2025-40551, CVSS score: 9.8, and CVE-2025-40536, CVSS score: 8.1), or a previously patched vulnerability (CVE-2025-26399, CVSS score: 9.8).

Microsoft traced a multi-stage intrusion to exposed SolarWinds Web Help Desk servers.

Attackers used unauthenticated RCE, moved laterally, and abused legit RMM tools for persistence — plus credential dumping and DCSync.

North Korean hackers use new macOS malware in crypto-theft attacks.

AI tools, supply chains, and trusted platforms are now attack paths.

Malicious AI skills, Signal phishing, Docker AI RCE, update hijacks — plus a record 31.4 Tbps DDoS. All in one week.

Bloody Wolf tied to a spear-phishing campaign deploying NetSupport RAT across Central Asia and Russia.

~60 victims across government, finance, manufacturing. Malicious PDFs drop loaders that persist via scripts + scheduled tasks.