CVE-2026-20045 on DanSec Daily

Cybersecurity Brief – 2026-01-24

Sat, 24 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

An unsecured database exposing 149 million usernames and passwords, including Gmail, Facebook, and banking credentials, was discovered by researchers. The data is suspected to have been collected via infostealing malware.
Under Armour is investigating a data breach involving the compromise of customer email addresses and other personal information.
Dozens of Venezuelan nationals were charged in the US for using malware in ATM jackpotting schemes, stealing hundreds of thousands of dollars from banks. Two individuals have been convicted and are set for deportation.
Spammers are abusing Zendesk to flood inboxes with legitimate-looking emails from trusted brands, generating significant inbox noise without direct phishing or malware delivery.

Newly Discovered Vulnerabilities

Fortinet confirmed active exploitation of a critical FortiCloud SSO authentication bypass vulnerability, affecting even fully patched FortiGate firewalls. The vulnerability is not yet fully remediated.
CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Versa, Zimbra, the Vite frontend tool, and SmarterMail. Exploitation of the SmarterMail authentication bypass began two days after patch release.
A critical authentication bypass vulnerability in GNU InetUtils telnetd, present for 11 years, is being actively exploited to gain root access.
Cisco UC is affected by a critical zero-day vulnerability (CVE-2026-20045) under mass scanning, which could allow complete system takeover.
Two malicious AI-powered extensions on the Microsoft Visual Studio Code (VSCode) Marketplace, installed 1.5 million times, have exfiltrated developer data to servers in China.
At Pwn2Own Automotive 2026, researchers disclosed 76 zero-day vulnerabilities in vehicle infotainment systems and EV chargers, earning over $1 million in rewards.

Notable Threat Actor Activity

The ShinyHunters extortion group claimed responsibility for a wave of ongoing voice phishing attacks targeting SSO accounts at Okta, Microsoft, and Google, enabling breaches of corporate systems.
ESET attributed a late 2025 cyberattack on Poland’s power grid to the Sandworm group, involving the use of data-wiping malware dubbed DynoWiper.
A dual-vector phishing campaign has been observed using stolen credentials to deploy legitimate Remote Monitoring and Management (RMM) software (LogMeIn) for persistent remote access.
Microsoft reported a multi-stage adversary-in-the-middle (AitM) phishing and business email compromise (BEC) campaign targeting energy sector organizations, with attackers abusing SharePoint for payload delivery.
Attackers are increasingly leveraging visually stylized (“fancy”) QR codes in quishing (QR-based phishing) campaigns, making malicious links harder to detect.

Trends, Tools, or Tactics of Interest

Security researchers demonstrated new attack vectors against automotive infotainment systems and EV chargers at Pwn2Own Automotive 2026, highlighting the expanding attack surface in connected vehicles.
AI-generated code was shown to introduce subtle vulnerabilities when over-trusted, as evidenced by an AI-written honeypot that was exploited due to hidden flaws.
Forty percent of employees have never received cybersecurity training, rising to nearly sixty percent in small businesses, according to a new report from Yubico.
Attackers are abusing trusted platforms, such as Zendesk and SharePoint, to deliver spam or malicious payloads, complicating detection and response.
Legitimate RMM tools are being leveraged post-compromise to establish persistent access within enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

The US Cybersecurity and Infrastructure Security Agency (CISA) continues to update its KEV catalog, mandating increased attention to actively exploited vulnerabilities by federal and critical infrastructure entities.
GDPR enforcement remains significant, with €1.2 billion in fines reported.
Cyber regulations and compliance requirements are becoming increasingly complex, impacting business operations and risk management strategies.

Cybersecurity Brief – 2026-01-23

Fri, 23 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Under Armour suffered a ransomware breach resulting in the alleged exposure of data belonging to 72 million customers. The stolen data is reported to be circulating on the dark web.
Fortinet FortiGate devices are being actively targeted and compromised in automated attacks. Threat actors are creating rogue accounts and stealing firewall configuration data, with reports of malicious configuration changes even on fully patched devices.
A major food service franchisee operator in Southeast Asia was targeted by the new Osiris ransomware family in November 2025, leveraging a Bring Your Own Vulnerable Driver (BYOVD) attack using the POORTRY driver.
SmarterTools SmarterMail email servers are being actively exploited via an authentication bypass vulnerability. Attackers are hijacking admin accounts and resetting passwords, with exploitation observed within two days of patch release.
Researchers were able to recover stolen data from 12 U.S. organizations impacted by INC ransomware due to an operational security failure by the threat actors.
Okta SSO accounts are being targeted in active vishing-based data theft attacks, with attackers employing custom phishing kits tailored for voice-based social engineering.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-24061, CVSS 9.8) was disclosed in GNU InetUtils telnetd, allowing attackers to bypass login and gain root access. The flaw was present for nearly 11 years.
Atlassian, GitLab, and Zoom released security patches addressing over two dozen vulnerabilities, including several critical- and high-severity issues.
Cisco released patches for a critical zero-day vulnerability (CVE-2026-20045) in Cisco Unified CM, which could allow unauthenticated remote code execution and is under active exploitation.
A new authentication bypass flaw in SmarterMail is being exploited in the wild to hijack administrator accounts.
At Pwn2Own Automotive 2026, researchers exploited 29 zero-day vulnerabilities across automotive technologies in a single day.

Notable Threat Actor Activity

North Korean-linked threat actor KONNI is conducting a phishing campaign targeting developers, using AI-generated PowerShell backdoors.
DPRK actors are deploying spear-phishing campaigns that utilise VS Code Tunnels and trusted Microsoft infrastructure to facilitate remote hacking while evading detection.
A widespread phishing campaign is targeting LinkedIn users via automated comments posted by bots impersonating LinkedIn personnel.
A malicious PyPI package impersonating the SymPy library was discovered deploying XMRig cryptominer on Linux hosts.
Fake LastPass maintenance phishing emails are targeting users, urging them to back up their vaults within 24 hours.
Threat actors are using trusted Remote Monitoring and Management (RMM) tools as backdoors, as observed in a dual-vector campaign exploiting legitimate RMM software for persistent access.

Trends, Tools, or Tactics of Interest

Attackers are increasingly exploiting trusted and familiar systems, such as RMM tools, VS Code Tunnels, and routine services, to gain and maintain access.
Social engineering tactics are evolving, with a rise in vishing attacks targeting Okta SSO and phishing campaigns leveraging LinkedIn comments.
The use of AI is expanding in both attack and defence: threat actors are using AI to generate malware, while defenders are integrating AI-driven detection into security products.
Old attack techniques, such as Linux page cache exploits, are being optimised for greater speed and efficiency by researchers.
The abuse of software supply chains continues, with malicious packages on PyPI and impersonation of popular libraries.
Microsoft Teams will introduce brand impersonation warnings to help detect social engineering attempts during calls.

Regulatory or Policy Developments Affecting the Security Industry

The EU AI Act introduces a legal requirement for AI literacy training, shifting best practice into a compliance mandate for organisations operating in or with the EU.
The developer of the curl project is ending its bug bounty programme on HackerOne due to a high volume of low-quality, AI-generated vulnerability reports.
Increased scrutiny in Europe regarding overreliance on US cybersecurity technology providers, with ongoing policy discussions about technology sovereignty and supply chain risks.
The Australian government is reviewing the cybersecurity risks of Chinese-made electric buses, which have been found to contain vulnerabilities and a potential remote “kill switch.”

Cybersecurity Brief – 2026-01-22

Thu, 22 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Zendesk ticket systems were hijacked in a large-scale global spam campaign, with individuals worldwide receiving hundreds of unsolicited and sometimes alarming emails originating from unsecured Zendesk support systems.
Security testing and training applications such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP have been exploited by threat actors to breach cloud environments of major security vendors and Fortune 500 firms, due to misconfigurations and over-permissioned access.
PcComponentes, a Spanish technology retailer, confirmed a credential stuffing attack but denied claims of a data breach affecting 16 million customers.
LastPass users are being targeted by a phishing campaign using fake password vault backup alerts, leveraging convincing subject lines and messaging.
Tesla’s Infotainment System was compromised, and 37 zero-day vulnerabilities were demonstrated at Pwn2Own Automotive 2026, with researchers earning $516,500 for successful exploits.

Newly Discovered Vulnerabilities

Cisco patched a critical zero-day vulnerability (CVE-2026-20045) in Unified Communications Manager (CM) and Webex Calling Dedicated Instance, which was actively exploited for remote code execution.
Fortinet FortiGate firewalls are being compromised via a patch bypass for a previously fixed authentication vulnerability (CVE-2025-59718), with reports of attacks on both patched and unpatched devices. Automated attacks are altering firewall configurations via FortiCloud SSO abuse.
Zoom and GitLab released security updates addressing vulnerabilities that allowed remote code execution, denial-of-service, and a high-severity two-factor authentication (2FA) bypass in GitLab Community and Enterprise editions.
Chainlit, a popular open-source AI framework, was found to have two high-severity vulnerabilities enabling arbitrary file read and server-side request forgery (SSRF), allowing attackers to steal sensitive data and breach cloud environments.
Anthropic’s official MCP server contained vulnerabilities exploitable via prompt injections, leading to potential code execution and data exposure.
Oracle’s January 2026 Critical Patch Update (CPU) delivered 337 new security patches, addressing approximately 230 unique vulnerabilities across over 30 products.
Researchers demonstrated that malicious Google Calendar invites can leverage prompt injection to bypass privacy controls and cause AI assistants to leak private data.

Notable Threat Actor Activity

North Korean threat actors, identified with the PurpleBravo campaign, targeted at least 3,136 IP addresses through fake job interviews, resulting in compromise of 20 organizations, including those in AI, blockchain, and fintech sectors. The campaign involves malicious Visual Studio Code projects and leverages trusted repository authorship to deliver backdoors.
Phishing campaigns targeting LastPass customers are using sophisticated, AI-generated emails to increase credibility and effectiveness, particularly around holiday periods.
New phishing techniques are exploiting human factors such as timing, context, and emotion, with campaigns becoming more industrialized and scalable.
A new family of Android malware is using AI (TensorFlow models) to perform automated click fraud by detecting and interacting with hidden advertisement elements.

Trends, Tools, or Tactics of Interest

AI-assisted social engineering is a growing concern, with 47% of organizations in a World Economic Forum survey citing adversarial AI advancements as their top worry regarding generative AI.
The VoidLink Linux malware framework, comprising 88,000 lines of code, was largely developed with AI assistance, marking a significant evolution in the use of AI for malware creation.
Attackers are leveraging prompt injection vulnerabilities in AI-powered systems (e.g., Anthropic MCP server, Google Calendar invites) to bypass controls and facilitate data exfiltration.
Exposure Assessment Platforms (EAPs) are emerging as a new security focus, reflecting a shift towards continuous, automated exposure management in response to overwhelming security workloads.
Use of legitimate Windows tools (LOLBins) continues as a tactic for deploying remote access trojans (RATs), with recent incidents involving an unusually large assortment of such tools in a single attack.
Managed Security Service Providers (MSSPs) are increasingly adopting AI to manage alert volumes and deliver higher-level protection with reduced analyst headcount.
Data exfiltration via outbound email remains a critical and often underprotected vulnerability vector.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the Embedded Systems Threat Matrix (ESTM), a new security framework designed to help organizations protect critical embedded systems.
Increased attention is being paid to health privacy and surveillance, with reports highlighting the impact of data brokers and law enforcement (e.g., ICE) on patient trust and healthcare access.