BeyondTrust patched pre-auth RCE (CVE-2026-1731) in Remote Support and PRA.
Attackers could run OS commands via crafted requests.~11K exposed instances found. Patches released.
Attackers could run OS commands via crafted requests.~11K exposed instances found. Patches released.
Cisco Talos exposed DKnife — a China-linked AitM framework active since 2019 on compromised routers and edge devices.
It monitors traffic, steals credentials, and hijacks app/software updates to deploy ShadowPad and DarkNimbus on PCs and phones.
It monitors traffic, steals credentials, and hijacks app/software updates to deploy ShadowPad and DarkNimbus on PCs and phones.
Malicious updates were published to official dYdX trading packages on npm and PyPI, delivering a wallet stealer and remote access malware.
Published via compromised maintainer accounts, the malware hid inside transaction-signing and wallet code.
Published via compromised maintainer accounts, the malware hid inside transaction-signing and wallet code.
AISURU/Kimwolf launched a record 31.4 Tbps HTTP DDoS attack — mitigated by Cloudflare.
Same botnet drove holiday flood campaigns as Q4 hyper-volumetric attacks surged. Runs on 2M+ infected Android devices via proxy networks.
Same botnet drove holiday flood campaigns as Q4 hyper-volumetric attacks surged. Runs on 2M+ infected Android devices via proxy networks.
Israeli spyware company Paragon posted their surveillance software's control panel by mistake.
This is a major opsec flaw.
This is a major opsec flaw.
Anthropic’s Claude Opus 4.6 AI found 500+ previously unknown high-severity flaws in open-source code.
Impacted: Ghostscript, OpenSC, CGIF. Bugs ranged from buffer overflows to memory corruption — all validated and patched.
Impacted: Ghostscript, OpenSC, CGIF. Bugs ranged from buffer overflows to memory corruption — all validated and patched.
APT Infy paused C2 ops during Iran’s Jan internet blackout — then rebuilt infrastructure as access returned.
Timing ties activity to state network controls. Latest malware uses Telegram + HTTP for dual-channel C2.
Timing ties activity to state network controls. Latest malware uses Telegram + HTTP for dual-channel C2.
Critical RCE flaw in n8n (CVE-2026-25049, CVSS 9.4) lets authenticated users execute system commands via crafted workflow expressions.
Public webhooks exposed → remote trigger, credential theft, server takeover.
Public webhooks exposed → remote trigger, credential theft, server takeover.
Amaranth-Dragon targeted Southeast Asian government and law enforcement networks in 2025, with links to the APT41 ecosystem.
Campaigns leveraged political lures and the WinRAR CVE-2025-8088 RCE flaw, using cloud delivery and geo-fenced infrastructure for stealth.
Campaigns leveraged political lures and the WinRAR CVE-2025-8088 RCE flaw, using cloud delivery and geo-fenced infrastructure for stealth.
Microsoft warns infostealers are expanding from Windows to macOS.
Since late 2025, malvertising (Google Ads) and ClickFix lures have delivered fake DMG installers. Python-based stealers abuse native macOS tools + AppleScript to extract creds, cookies, and iCloud Keychain data.
Since late 2025, malvertising (Google Ads) and ClickFix lures have delivered fake DMG installers. Python-based stealers abuse native macOS tools + AppleScript to extract creds, cookies, and iCloud Keychain data.
Fake recruiter coding tests pushed poisoned npm & PyPI dependencies to developers.
Hidden packages deployed RAT access, while separate implants stole browser & crypto wallet data. One library exceeded 10,000 downloads before weaponization.
Hidden packages deployed RAT access, while separate implants stole browser & crypto wallet data. One library exceeded 10,000 downloads before weaponization.
Google tracked multiple state groups using Gemini for vuln research, exploit debugging, and persona building across cyber operations.
One malware strain even generated second-stage code via the API, executed filelessly in memory.
One malware strain even generated second-stage code via the API, executed filelessly in memory.
Threat actors are actively exploiting CVE-2026-1731 (9.9) in BeyondTrust Remote Support & PRA.
Attackers extract portal data, then open WebSocket channels to trigger unauthenticated RCE.
Attackers extract portal data, then open WebSocket channels to trigger unauthenticated RCE.
417 exploitation sessions from 8 unique source IP addresses between February 1 and 9, 2026. An estimated 346 exploitation sessions have originated from 193.24.123[.]42, accounting for 83% of all attempts.
The malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a "very limited number of customers" who were impacted following the zero-day exploitation of the issues.
The malicious activity is designed to exploit CVE-2026-1281 (CVSS scores: 9.8), one of the two critical security vulnerabilities in EPMM, along with CVE-2026-1340 that could be exploited by an attacker to achieve unauthenticated remote code execution. Late last month, Ivanti acknowledged it's aware of a "very limited number of customers" who were impacted following the zero-day exploitation of the issues.
Interference with the Global Positioning System (GPS) in and around Haifa.