China-linked APT exploits Sitecore zero-day to attack critical U.S. infrastructure
January 16, 2026Ravi LakshmananZero Day/Cyber Espionage Threat actors believed to be aligned with China have been observed targeting critical infrastructure sectors in North America since at least the last year. Cisco Talos, which is tracking this activity under the name UAT-8837, has assessed with medium confidence that this is a Chinese-aligned Advanced Persistent Threat (APT) […]
Cisco patches zero-day RCE exploited by China-linked APT in secure email gateway
January 16, 2026Ravi LakshmananVulnerabilities / Web Security Cisco on Thursday released a security update for maximum severity security flaws affecting Cisco AsyncOS software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. This comes nearly a month after the company disclosed that it had been attacked by a zero-day attack by a […]
AWS CodeBuild misconfiguration exposed GitHub repository to potential supply chain attacks
A critical misconfiguration in Amazon Web Services (AWS) CodeBuild could result in a complete takeover of a cloud service provider’s own GitHub repository containing the AWS JavaScript SDK, potentially putting all AWS environments at risk. The vulnerability has been codenamed “CodeBreach” by cloud security company Wiz. This issue was fixed by AWS in September 2025 […]
Critical flaw in WordPress Modular DS plugin can be actively exploited to gain administrator access
January 15, 2026Ravi LakshmananWeb security/vulnerabilities According to Patchstack, a maximum severity security flaw in a WordPress plugin called Modular DS is being exploited in the wild. This vulnerability is tracked as CVE-2026-23550 (CVSS score: 10.0) and is described as a case of unauthenticated privilege escalation affecting all versions of the plugin prior to 2.5.1. Version […]
Researchers uncover a re-prompting attack that allows data to be extracted from Microsoft Copilot with a single click
January 15, 2026Ravi LakshmananPrompt injection / enterprise security Cybersecurity researchers have revealed details of a new attack method called “Reprompt.” This attack technique could allow malicious attackers to steal sensitive data from artificial intelligence (AI) chatbots such as Microsoft Copilot with a single click, completely bypassing corporate security controls. “It only takes one click on […]
AI Voice Cloning Exploit, Wi-Fi Kill Switch, PLC Vulns, and 14 More Stories
Jan 15, 2026Ravie LakshmananCybersecurity / Hacking News The internet never stays quiet. Every week, new hacks, scams, and security problems show up somewhere. This week’s stories show how fast attackers change their tricks, how small mistakes turn into big risks, and how the same old tools keep finding new ways to break in. Read on […]
Model security is the wrong framework – the real risk is workflow security
January 15, 2026hacker newsData security/artificial intelligence Even as AI co-pilots and assistants become part of daily operations, security teams are still focused on securing the models themselves. However, recent incidents suggest that the greater risk lies elsewhere: in the workflows surrounding these models. Two Chrome extensions masquerading as AI helpers were recently caught stealing ChatGPT […]
4 outdated habits that will destroy your SOC’s MTTR in 2026
Even though it’s 2026, many SOCs are still operating the same way they did a few years ago, with tools and processes designed for a completely different threat landscape. Given the growing volume and complexity of cyber threats, outdated practices can no longer fully support the needs of analysts, significantly slowing investigations and incident response. […]
Microsoft legal action disrupts RedVDS cybercrime infrastructure used for online fraud
Microsoft announced Wednesday that it has taken “coordinated legal action” in the United States and United Kingdom to disrupt a cybercrime subscription service called RedVDS that is said to have caused millions in fraudulent losses. The tech giant said the effort was part of a broader law enforcement operation in collaboration with law enforcement authorities […]
Palo Alto fixes GlobalProtect DoS flaw that could crash firewall without logging in
January 15, 2026Ravi LakshmananNetwork security/vulnerabilities Palo Alto Networks has released a security update for a high-severity security flaw affecting GlobalProtect Gateway and Portal. It states that a proof-of-concept (PoC) exploit exists for this flaw. This vulnerability is tracked as CVE-2026-0227 (CVSS score: 7.7) and is described as a denial of service (DoS) condition affecting GlobalProtect […]