Security. In focus.

LangChain core vulnerability allows prompt injection and data exposure

A critical vulnerability in LangChain Core (CVE-2025-68664) allows prompt injection and data exposure by enabling attackers to instantiate unsafe objects during serialization and deserialization. This flaw, affecting widely used functions, can lead to secret leakage and potential code execution, with patches available in versions 1.2.5 and 0.3.81.

Meet the team that investigates when journalists and activists get hacked with government spyware | TechCrunch

The Access Now Digital Security Helpline is a team of digital security experts who investigate suspected government spyware attacks on journalists and activists, handling about 1,000 cases annually. This 24/7 service, which Apple directs users to when they receive spyware threat notifications, provides crucial support and analysis for victims of sophisticated spyware made by companies like NSO Group.

Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks | bobdahacker

A security researcher discovered multiple critical vulnerabilities in Petlibro’s smart pet feeder app, including an authentication bypass that allows complete account takeover, access to private audio recordings, and device hijacking. Despite being reported over two months ago, the authentication bypass remains active for ‘legacy compatibility’, posing a significant risk to millions of pet owners.

Everest Ransomware Group Claims Theft of Over 1TB of Chrysler Data – Hackread – Cybersecurity News, Data Breaches, AI, and More

The Everest ransomware group claims to have stolen over 1TB of data from Chrysler, including extensive operational and customer records from 2021-2025. The group has threatened to release the full dataset, which reportedly contains sensitive information from Salesforce and internal file servers, while Chrysler has not yet confirmed the breach.

NPM package with 56,000 downloads compromises WhatsApp accounts

The NPM package Lotusbail, downloaded over 56,000 times, has been revealed to steal WhatsApp credentials and data by acting as a malicious WhatsApp Web API library. This package, which supports sending and receiving messages, intercepts credentials, contacts, and media, and even hijacks the device pairing process, granting attackers persistent account access.

Denmark Is Being Heavily Targeted: Weekly DDoS Threat Intelligence Analysis “Between 15 and 21 December 2025, SOCRadar identified a coordinated DDoS campaign conducted by the pro-Russian threat actor NoName057(16) and their project DDoSia. The campaign resulted in 4,559 recorded attack entries, targeting 148 unique domains and 137 unique IP addresses across multiple countries.” socradar.io/blog/ddos…

“Between 15 and 21 December 2025, SOCRadar identified a coordinated DDoS campaign conducted by the pro-Russian threat actor NoName057(16) and their project DDoSia. The campaign resulted in 4,559 recorded attack entries, targeting 148 unique domains and 137 unique IP addresses across multiple countries.” socradar.io/blog/ddos…

Coordinated Scams Target MENA Region With Fake Online Job Ads “A coordinated wave of fake online job advertisements targeting countries across the Middle East and North Africa (MENA) has been uncovered, exploiting the region’s sustained shift toward remote work.” www.infosecurity-magazine.com/news/scam…

Nomani Investment Scam Surges 62% Using AI Deepfake Ads on Social Media “The fraudulent investment scheme known as Nomani has witnessed an increase by 62%, according to data from ESET, as campaigns distributing the threat have also expanded beyond Facebook to include other social media platforms, such as YouTube.” thehackernews.com/2025/12/n…

Phoenix University data breach exposes 3.4M​Phoenix University data breach exposes another 3.4M victims of Cl0p Oracle hacks | Cybernews

The University of Phoenix is notifying 3.4 million individuals about a data breach that occurred in August, exposing personal information including Social Security numbers. The breach was caused by a Cl0p ransomware gang attack on the university’s Oracle E-Business Suite (EBS).

Shinsegae affiliate reports leak of personal data involving some 80,000 employees - The Korea Times

South Korean retail giant Shinsegae Group’s IT affiliate, Shinsegae I&C Inc., has reported a personal data leak affecting approximately 80,000 employees and subcontractors. The breach, which involved corporate IDs, names, departments, and IP addresses, was detected on Wednesday and reported to authorities, with no customer information compromised.

GitHub - ruvnet/wifi-densepose: Production-ready implementation of InvisPose - a revolutionary WiFi-based dense human pose estimation system that enables real-time full-body tracking through walls using commodity mesh routers

The WiFi DensePose GitHub repository introduces a privacy-first human pose estimation system that utilizes WiFi signals and Channel State Information (CSI) data, eliminating the need for cameras. It offers real-time processing with low latency, supports multi-person tracking, and is designed for various applications including healthcare, fitness, and security, with enterprise-ready features like a production-grade API and WebSocket streaming.

Asiana Airlines informs employees of personal data hack

Asiana Airlines disclosed a data breach affecting approximately 10,000 employees, including staff from partner companies. The breach, caused by an external cyberattack on the airline’s intranet, exposed personal information but no customer data.

Evasive Panda APT poisons DNS requests to deliver MgBot securelist.com/evasive-p…

The Evasive Panda APT group (also known as Bronze Highland, Daggerfly, and StormBamboo) has been active since 2012, targeting multiple industries with sophisticated, evolving tactics. Our latest research (June 2025) reveals that the attackers conducted highly-targeted campaigns, which started in November 2022 and ran until November 2024.

The group mainly performed adversary-in-the-middle (AitM) attacks on specific victims. These included techniques such as dropping loaders into specific locations and storing encrypted parts of the malware on attacker-controlled servers, which were resolved as a response to specific website DNS requests. Notably, the attackers have developed a new loader that evades detection when infecting its targets, and even employed hybrid encryption practices to complicate analysis and make implants unique to each victim.

Furthermore, the group has developed an injector that allows them to execute their MgBot implant in memory by injecting it into legitimate processes. It resides in the memory space of a decade-old signed executable by using DLL sideloading and enables them to maintain a stealthy presence in compromised systems for extended periods.

Lumma Stealer: Danger lurking in fake game updates from itch.io and Patreon www.gdatasoftware.com/blog/2025…

Another malicious campaign has again been found on Itch.io, which is an online platform for distributing independently developed video games with a pay-what-you-can model for revenue. Multiple spam comments in legitimate games are claiming to be “game updates” and offering download links for the updates, but a close look into these download links instead show malware hiding their tracks.

ThreatsDay Bulletin: Stealth Loaders, AI Chatbot Flaws AI Exploits, Docker Hack, and 15 More Stories

The ThreatsDay Bulletin highlights a shift in cyberattacks towards stealth and manipulation, with attackers increasingly abusing legitimate software, AI chatbots, and familiar interfaces. Key stories include the exploitation of the Nezha monitoring tool, a surge in Android NFC malware, and prompt injection flaws in AI assistants like Docker’s Ask Gordon, underscoring the need for heightened awareness in the evolving threat landscape.

xHunt APT: Cyber-Espionage Operations Targeting Kuwait and Exchange Servers

The xHunt APT group has been conducting cyber-espionage operations targeting Kuwait, focusing on shipping, transportation, and government sectors since 2018. They utilize custom tools, often named after anime characters, and employ diverse attack vectors including watering hole attacks and compromises of Microsoft Exchange and IIS servers to deploy backdoors like BumbleBee, TriFive, and Snugy.

‘I Quit!’ - When CISOs Need to Take Charge of Their Careers

This article discusses how CISOs face career challenges due to structural flaws in how organizations manage cyber risk, leading to retroactive accountability when breaches occur after denied budget requests. To improve the CISO role, conversations should shift from “secure enough” to risk posture selection, making accountability forward-facing and fostering shared ownership to prevent burnout and strengthen organizational security.

CISA Flags Actively Exploited Digiever NVR Vulnerability Allowing Remote Code Execution

CISA has added a command injection vulnerability (CVE-2023-52163) in Digiever DS-2105 Pro NVRs to its Known Exploited Vulnerabilities (KEV) catalog, noting active exploitation for remote code execution. Due to the device being end-of-life, patches are unavailable, and users are advised to avoid internet exposure and change default credentials.

LastPass 2022 Breach Led to Years-Long Cryptocurrency Thefts, TRM Labs Finds

The 2022 LastPass breach has led to years-long cryptocurrency thefts, with bad actors cracking stolen vault backups to drain assets as recently as late 2025, according to TRM Labs. Evidence suggests Russian cybercriminal actors are involved, using Russian exchanges as off-ramps for laundered funds.

FBI seized ‘web3adspanels.org’ hosting stolen logins

The FBI seized the domain web3adspanels.org, used by cybercriminals to store stolen bank login credentials. The criminals used fake ads to redirect victims to fraudulent websites, capturing their login information to access and steal funds from real bank accounts.

GitHub - tomer8007/mtproto-dissector: Wireshark plugin for dissecting the Telegram protocol

Wireshark dissector for Telegram traffic using MTProto 2.0 protocol. Supports de-obfuscation, decryption with auth key, and TL language RPC payload dissection. Installation requires luagcrypt bindings and copying the mtproto directory to Wireshark’s plugins directory.

US Energy Dept Flags AI, Cyber Gaps as Top Risks for 2026

A new inspector general report identifies AI and cybersecurity governance as major risks for the U.S. Energy Department in 2026, citing a lag between rapid technology deployment and oversight. The report warns that without stronger coordination, the department’s increasing reliance on digital systems could expose critical infrastructure to significant risks due to decentralized security models and underfunded updates.

FCC bans foreign-made drones over national security, spying concerns www.politico.com/news/2025…

The Federal Communications Commission on Monday blacklisted all new foreign-made drones and components over concerns the equipment poses “an unacceptable risk” to national security — ensnaring Chinese drone-maker DJI after long-time concerns that the tech gives Beijing a foothold inside U.S. critical infrastructure.

The tech was placed on the commission’s “Covered List,” barring DJI and other foreign drone manufacturers from receiving the FCC’s approval to sell new drone models for import or sale in the U.S. In Monday’s announcement, the agency said that the move “will reduce the risk of direct [drone] attacks and disruptions, unauthorized surveillance, sensitive data exfiltration and other [drone] threats to the homeland.”

Microsoft Teams strengthens messaging security by default in January www.bleepingcomputer.com/news/micr…

Microsoft announced that Teams will automatically enable messaging safety features by default to strengthen defenses against content tagged as malicious.

The change will roll out starting January 12, 2026, to tenants still using the default configuration and who haven’t previously modified messaging safety settings.

“We’re improving messaging security in Microsoft Teams by enabling key safety protections by default,” Microsoft told administrators in a Microsoft 365 message center update. “This update helps safeguard users from malicious content and provides options to report incorrect detections.”

Microsoft said the update will activate three key security features: weaponizable file type protection, malicious URL detection, and a system for reporting false positives. As previously noted, organizations that previously customized these settings will see no changes.

After the messaging protections are enabled, users may notice warning labels on messages containing suspicious URLs and the ability to flag incorrect security detections, while messages containing potentially dangerous file types will be blocked entirely.

Malicious extensions in Chrome Web store steal user credentials www.bleepingcomputer.com/news/secu…

Two Chrome extensions in the Web Store named ‘Phantom Shuttle’ are posing as plugins for a proxy service to hijack user traffic and steal sensitive data.

Both extensions are still present in Chrome’s official marketplace at the time of writing and have been active since at least 2017, according to a report from researchers at the Socket supply-chain security platform.

Phantom Shuttle’s target audience is users in China, including foreign trade workers who need to test connectivity from various locations in the country.