Security. In focus.

UK investigating first suspected breach of cyber sanctions | The Record from Recorded Future News

The UK is investigating its first suspected breaches of cyber sanctions since the regime began over five years ago, with up to five potential violations involving financial services firms. This marks the first known suspected breaches, following improvements in the Office of Financial Sanctions Implementation (OFSI) monitoring capabilities.

Iron Mountain: Data breach mostly limited to marketing materials

Iron Mountain states that a data breach claimed by the Everest extortion gang was limited to a single folder of marketing materials shared with third-party vendors. The company confirmed that no customer confidential or sensitive information was involved, and no other Iron Mountain systems were breached, with no ransomware or malware deployed.

An AI plush toy exposed thousands of private chats with children | Malwarebytes

The Bondus AI plush toy exposed approximately 50,000 private chats between children and their toys through an unsecured web console, revealing sensitive personal information. While Bondus implemented fixes and security measures, the incident highlights the privacy risks associated with AI-powered children’s toys, emphasizing the need for parental oversight and skepticism.

Russian Hacker Alliance Targeting Denmark in Large-Scale Cyberattack

A new Russian hacker alliance, Russian Legion, has launched a large-scale cyberattack against Denmark, targeting critical infrastructure and government services with DDoS attacks. The group demands Denmark withdraw military aid to Ukraine, threatening further action if ignored.

DynoWiper Data-Wiping Malware Attacking Energy Companies to Destroy Data

A new data-wiping malware named DynoWiper is targeting energy companies in Poland, aiming to destroy critical data rather than encrypt it for ransom. This sophisticated malware, attributed to the Russia-aligned Sandworm threat group, was deployed using Active Directory exploitation and shares similarities with the ZOV wiper.

Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

A security audit of ClawHub skills revealed 341 malicious skills designed to steal data from OpenClaw users, with 335 of them using fake prerequisites to install a macOS stealer named Atomic Stealer (AMOS), codenamed ClawHavoc. OpenClaw’s creator has since implemented a reporting feature to help mitigate the issue of malicious skills being uploaded to the platform.

Mozilla announces switch to disable all Firefox AI features

Mozilla is introducing new controls in Firefox 148, rolling out February 24th, allowing users to disable all AI features or manage them individually. This update responds to user feedback and ensures users have agency over AI integration, with options to block or enable features like translation, image alt text generation, and chatbot access.

Ex-Google Engineer Convicted of Stealing AI Data for China

A former Google engineer, Linwei Ding, has been convicted of stealing thousands of pages of confidential AI data and transferring it to Chinese technology companies. He faces decades in prison for economic espionage and trade secret theft, having used the stolen information to establish competing ventures in China.

Phishing Scam Uses Clean Emails and PDFs to Steal Dropbox Logins – Hackread – Cybersecurity News, Data Breaches, AI, and More

A new phishing scam uses clean emails with PDF attachments that contain hidden links, leading victims to fake Dropbox login pages hosted on Vercel cloud storage to steal credentials. The stolen data is then sent to a Telegram bot for the attackers.

GitHub - RootUp/claude-poc: Claude Code Remote Code Execution

A GitHub post details a code execution vulnerability in the claude-poc repository, specifically within the apiKeyHelper script. This script, designed to generate authentication headers, can be abused because it accepts and executes system commands, potentially leading to silent code execution if the parent folder is already trusted.

Panera Bread breach affected 5.1 Million accounts, HIBP Confirms

A Panera Bread breach impacted 5.1 million accounts, according to Have I Been Pwned, with attackers claiming to have accessed data using a compromised Microsoft Entra SSO code. The exposed information primarily consists of contact details, and Panera Bread has notified authorities.

Russian hackers exploit recently patched Microsoft Office bug in attacks

Russian hackers, identified as APT28, are actively exploiting a recently patched Microsoft Office vulnerability (CVE-2026-21509) to deploy malware, including the COVENANT framework, via malicious documents. These attacks, targeting Ukrainian and other EU organizations, utilize a complex download chain involving COM hijacking and cloud storage for command-and-control.

Spain Ministry Data Breach: Actor Claims IDOR Hack - TechNadu

A threat actor known as GordonFreeman claims to have breached Spain’s Ministry of Science, Innovation, and Universities by exploiting an IDOR vulnerability and leaked credentials. The alleged breach reportedly exposed sensitive data including passport scans, DNI/NIE records, academic transcripts, and financial information.

Match, Hinge, OkCupid, and Panera Bread breached by ransomware group | Malwarebytes

The ShinyHunters ransomware group has claimed responsibility for data breaches affecting Match Group and Panera Bread, compromising millions of user records. While Match Group’s breach involves user PII and tracking data, Panera Bread’s breach also exposed PII, though both companies state that sensitive information like login credentials and financial data were not accessed.

New Apple privacy feature limits location tracking on iPhones, iPads

Apple’s new “Limit Precise Location” feature, available on select iPhone and iPad models with iOS 26.3+, restricts the location data mobile carriers can access via cell tower connections, offering a more approximate location instead of precise addresses. This privacy enhancement does not affect location sharing with emergency responders or apps like Find My, but its availability depends on carrier support and is currently limited to a few networks globally.

Critical Johnson Controls Products Vulnerabilities Enables Remote SQL Injection Attacks

A critical SQL injection vulnerability (CVE-2025-26385) with a maximum CVSS score of 10.0 affects multiple Johnson Controls products, including Application and Data Server (ADS) and Extended Application and Data Server (ADX), allowing remote attackers to execute arbitrary SQL commands without authentication. The vulnerability impacts systems used in critical infrastructure sectors such as commercial facilities, energy, government, and transportation, and CISA recommends network isolation, firewalls, and VPNs for mitigation.

Exposed MongoDB instances still targeted in data extortion attacks

A single threat actor is actively targeting exposed MongoDB instances in automated data extortion attacks, demanding around $500 in Bitcoin for data restoration. Researchers found that nearly half of publicly accessible MongoDB servers were compromised, with ransom notes indicating a single attacker responsible for the majority of attacks.

depthfirst | 1-Click RCE To Steal Your Moltbot Data and Keys

A critical 1-Click Remote Code Execution (RCE) vulnerability has been discovered in OpenClaw (formerly Moltbot), an AI personal assistant trusted by over 100,000 developers. The exploit, chained by Mav Levin, leverages a logic flaw identified by depthfirst that allows an attacker to steal authentication tokens and execute arbitrary code on a victim’s machine with a single click on a malicious webpage. The vulnerability has been patched, and users are advised to upgrade and rotate tokens if compromised.

Comcast agrees to $117.5 million settlement to resolve lawsuits over 2023 Citrix Bleed data breach – DataBreaches.Net

Comcast has reached a preliminary $117.5 million settlement to resolve lawsuits stemming from a 2023 data breach that affected over 30 million customers. If finalized, the settlement would offer impacted individuals three years of identity-theft protection and either expense reimbursement up to $10,000 or a $50 cash payment, though Comcast denies liability.

BD: 14,000 journos’ personal data leaked online – DataBreaches.Net

The personal data of approximately 14,000 journalists, including their National ID numbers and mobile phone numbers, was exposed online due to a technical failure at the Bangladesh Election Commission’s website. The breach occurred on the EC’s portal for modernizing the accreditation process, and access was disabled shortly after the vulnerability was discovered.

Nobel Hacking Likely Leaked Peace Prize Winner Name, Probe Finds - Slashdot

An investigation by the Norwegian Nobel Institute suggests that a hacking of their computer systems likely led to the premature leak of Maria Corina Machado as the Nobel Peace Prize winner. This leak caused an unusual surge in betting on Machado hours before the official announcement, despite her not being a previous favorite for the award.

StopICE Hacked: Names And Locations of Over 100k Users Were Sent to the FBI, ICE and HSI – DataBreaches.Net

The StopICE app and website experienced a security breach, exposing the personal information of over 100,000 users, including names, logins, passwords, phone numbers, and GPS coordinates, which were sent to the FBI, ICE, and HSI. The hackers reportedly delivered this sensitive data directly to federal agencies, and a key organizer allegedly failed to inform users of the breach.

Mandiant details how ShinyHunters abuse SSO to steal cloud data

Mandiant details how threat actors, including ShinyHunters, are exploiting vishing attacks and fake company SSO portals to steal credentials and MFA codes, enabling them to access and exfiltrate sensitive cloud data from various SaaS applications.

Kerberos Authentication Relay via DNS CNAME Abuse

A new technique abuses Kerberos TGS requests and DNS CNAME resolution to allow attackers to impersonate users by relaying authentication tickets. This method, detailed in research by Cymulate, enables lateral movement and privilege escalation, and while Microsoft has patched HTTP-related vulnerabilities (CVE-2026-20929), the core DNS CNAME abuse remains a threat.

175K Exposed Ollama Hosts Allow Remote Code Execution cyberpress.org/175k-expo…

A massive global network of 175,000 publicly exposed Ollama AI servers, posing significant remote code execution risks across 130 countries.

An unmanaged layer of AI compute infrastructure operating without the security guardrails and monitoring systems that major platform providers implement by default.

Over a 293-day scanning period, researchers identified 7.23 million observations from unique Ollama hosts spanning 130 countries and 4,032 autonomous system numbers.

The infrastructure analysis revealed a persistent core of approximately 23,000 hosts that generated most of the activity, while a larger layer of transient hosts appeared briefly before disappearing.

Nearly half of the observed hosts are configured with tool-calling capabilities that enable them to execute code, access APIs, and interact with external systems.