2026-02-10 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-6830 Xpoda Türkiye Informati...
ictsec.pl
2026-02-04 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2019-25232 NetPCLinker - NetPCLin...
Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users
A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks. ClawHub ...
Notepad++ Hijacked by State-Sponsored Hackers
According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for n...
Mutagen Astronomy - From Discovery to CISA Recognition—A Seven-Year Journey
On January 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2018-14634 to its Known Exploited Vulnerabilities (KEV) catalog. The same vulnerability was discovered by ...
Multiple vulnerabilities in Cybozu Garoon
Multiple vulnerabilities have been identified in Cybozu Garoon, detailed in JVN#35265756 and published on 2026/02/02. Cybozu Garoon provided by Cybozu, Inc. contains these multiple vulnerabilities....
D-Link DIR-825 Rev.B 2.10 - Stack Buffer Overflow (DoS)
A stack-based buffer overflow vulnerability, identified as CVE-2025-10666, exists in the apply.cgi endpoint of the D-Link DIR-825 Rev.B router (firmware <= 2.10). This vulnerability, explicitly ...
Android RAT Uses Hugging Face to Host Malware
A new Android remote access trojan (RAT) uses the popular AI platform Hugging Face to host and distribute malicious payloads, Bitdefender has revealed. The dropper contacts an encrypted endpoint h...
New Apple Privacy Feature Limits Location Tracking on iPhones, iPads
Apple is introducing a new privacy feature that lets users limit the precision of location data shared with cellular networks on some iPhone and iPad models. The “Limit Precise Location” setting wi...
Moltbook AI Vulnerability Exposes Email Addresses, Login Tokens, and API Keys
A critical vulnerability in Moltbook, the nascent AI agent social network launched in late January 2026 by Octane AI’s Matt Schlicht, exposes email addresses, login tokens, and API keys for its reg...
ShadowHS - A Fileless Linux Post‑Exploitation Framework Built on a Weaponized hackshell
Cyble Research & Intelligence Labs (CRIL) has identified a Linux intrusion chain leveraging a highly obfuscated, fileless loader that deploys a weaponized variant of hackshell entirely from mem...
Phishing kits adapt to the script of callers
Okta Threat Intelligence has detected and dissected multiple custom phishing kits that have evolved to meet the specific needs of voice-based social engineers (“callers”) in vishing campaigns. Thes...
Ex-Google Engineer Convicted for Stealing 2,000 AI Trade Secrets for China Startup
A former Google engineer accused of stealing thousands of the company’s confidential documents to build a startup in China has been convicted in the U.S., the Department of Justice (DoJ) announced ...
Empire Market co-founder faces 10 years to life after guilty plea
Empire Market co-founder Raheim Hamilton pleaded guilty to U.S. drug conspiracy charges in Chicago, facing a mandatory 10 years to life in prison. Raheim Hamilton (30) of Virginia, co-creator of th...
I'm locked in!
Cisco Talos Incident Response’s report for Q4 2025 is now available. We observed that exploitation of public-facing applications remained the top method of initial access, though it declined from 6...
France Fines National Employment Agency €5m Over 2024 Data Breach
The French employment agency, France Travail, has received a €5m ($6m) fine for security failures that led to the compromise of an estimated 43 million jobseekers. In a public statement on January ...
Disrupting Largest Residential Proxy Network
This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a litt...
Clawdbot’s rename to Moltbot sparks impersonation campaign
After the viral AI assistant Clawdbot was forced to rename to Moltbot due to a trademark dispute, opportunists moved quickly. Within days, typosquat domains and a cloned GitHub repository appeared—...
Russian Cybercrime Platform RAMP Forum Seized by FBI
In a huge blow to the global cybercrime underground, US federal authorities have seized the clearnet and dark web domains of RAMP (Ramp4u.io), a well-known Russian-language cybercrime forum used by...
Old Windows quirks help punch through new admin defenses
Microsoft patched a bevy of bugs that allowed bypasses of Windows Administrator Protection before the feature was made available earlier this month. James Forshaw, security researcher at Google’s P...