Cybersecurity Brief – 2026-01-16

Fri, 16 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
Eurail reported a breach in which hackers stole personal and reservation information of travellers.
Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.

Cybersecurity Brief – 2026-01-14

Wed, 14 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Central Maine Healthcare experienced a data breach affecting over 145,000 individuals, exposing sensitive personal information.
Belgian hospital AZ Monica was forced to shut down all servers, cancel procedures, and transfer critical patients due to a cyberattack.
Betterment, a US digital investment advisor, confirmed a breach resulting in fake crypto-related emails being sent to customers.
Target source code samples were leaked and confirmed as authentic by employees, prompting an accelerated lockdown of internal systems.
JPMorgan disclosed that the law firm Fried Frank suffered a data security incident impacting high-profile clients.
Spanish energy company Endesa was hacked, resulting in the theft of customer data, including contact, payment, and national identity information.

Newly Discovered Vulnerabilities

Microsoft’s January 2026 Patch Tuesday addressed 114 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed). Updates also replaced expiring Secure Boot certificates and fixed vulnerabilities in Windows 10 and 11.
ServiceNow patched a critical AI platform vulnerability that allowed unauthenticated user impersonation, exposing customer data and systems.
Adobe released patches for 25 vulnerabilities, including a critical Apache Tika flaw in ColdFusion.
SAP’s January 2026 updates addressed 17 vulnerabilities, with four rated critical (including SQL injection, remote code execution, and code injection).
Broadcom Wi-Fi chipset vulnerability was disclosed, allowing attackers to disrupt networks on affected devices, including Asus routers.
Apple confirmed active exploitation of a vulnerability, with full protections available only for iPhones running iOS 26+.

Notable Threat Actor Activity

Ukrainian Defense Forces were targeted with PLUGGYAPE malware via Signal and WhatsApp in a charity-themed campaign between October and December 2025.
A long-running web skimming campaign, active since January 2022, has targeted major payment networks by stealing credit card data from online checkout pages.
A new malicious Chrome extension was discovered stealing MEXC cryptocurrency exchange API keys by posing as a trading tool.
The SHADOW#REACTOR campaign used multi-stage Windows attack chains and text-only files to deliver Remcos RAT, employing techniques to bypass detection and leverage native utilities.
Attackers are abusing Python and Cloudflare services to deliver AsyncRAT, leveraging legitimate cloud infrastructure and open source tools.
GoBruteforcer botnet is targeting crypto and blockchain projects, exploiting AI-generated server deployments with weak credentials and legacy web stacks.
Dutch port hacker sentenced to prison for planting remote access malware on a logistics firm’s systems, with insider assistance.

Trends, Tools, or Tactics of Interest

AI-powered deepfakes are being used to impersonate religious figures and solicit fraudulent donations from congregations.
Attackers are increasingly using agentic AI to automate and scale traditional attack techniques, optimising established playbooks rather than relying solely on novel exploits.
Phishing campaigns are leveraging LinkedIn comment-reply tactics, posting convincing fake replies to lure users into clicking malicious links.
AI agents such as Copilot, Claude Code, and Codex are now capable of building, testing, and deploying software autonomously, raising concerns about shadow API key sprawl and tool misuse.
Web skimming and supply chain attacks remain persistent threats, with campaigns demonstrating long-term stealth and adaptability.
CISO turnover is highlighted as a compounding risk factor for organisational security posture.
Data brokers are being scrutinised for selling sensitive health and personal profiles, as evidenced by regulatory fines.

Regulatory or Policy Developments

A data broker was fined by California regulators for selling sensitive information on Alzheimer’s patients and millions of other individuals.
Microsoft’s security updates and certificate rollouts have implications for compliance and device security baselines.
CrowdStrike announced the acquisition of browser security firm Seraphic for $420 million, following its agreement to acquire identity security startup SGNL for $740 million.

Central Maine Healthcare on DanSec Daily

Cybersecurity Brief – 2026-01-16

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2026-01-14

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments