Sign in Subscribe

InfoSec News 06FEB2026

General

  • It appears that Microsoft is pivoting away from its security commitments, back to 'security is a product-line'. The more technical-focused Charlie Bell is stepping down from the 'Executive Vice President, Security' role, in favour of Hayete Gallot.
    There are also rumours that "is essentially being taken out of Connect (yearly goal reviews), which was Microsoft's big commitment to Congress as part of Secure Future Initiative....it's been watered down now to the point where it basically doesn't exist any more"
Hayete ... spent more than 15 years at Microsoft with senior leadership roles across engineering and sales, playing multiple critical roles in building two of our biggest franchises – Windows and Office, leading our commercial solution areas’ go-to-market efforts. And she was instrumental in the design and implementation of our Security Solution Area. She brings an ethos that combines product building with value realization for customers, which is critical right now
The vulnerabilities allowed any authenticated user to seize complete control of the server, stealing every stored credential, API key, and secret on both self hosted and cloud instances. On n8n Cloud, the shared multi-tenant architecture meant a single malicious user could potentially breach the entire platform, accessing data belonging to all other customers.
...
The attack requires nothing special. If you can create a workflow, you can own the server.
We discovered a critical vulnerability (GHSA-6cqr-8cfr-67f8 / CVE-2026-25049) in n8n that allows authenticated users to achieve remote code execution (RCE) via sandbox escape. With full control over the n8n instance, attackers can read files, execute system commands, access databases, and exfiltrate credentials stored in n8n's credential vault.

Geo-Politics

  • [IT] Italy is blaming Russia for cyberattacks, in the lead-up to the Winter Olympics.
Italy thwarted a series of cyberattacks of “Russian origin” targeting diplomatic missions abroad and sites linked to the upcoming Winter Olympics, Foreign Minister Antonio Tajani said Wednesday.
The attempted attacks hit multiple foreign ministry offices “starting with Washington,” according to Tajani, as well as facilities connected to the 2026 Winter Games, including hotels in the Alpine resort of Cortina d’Ampezzo. He did not disclose technical details of the incidents.
...
Russia-linked hackers have previously targeted countries hosting major sporting events. During the 2018 Winter Olympics in Pyeongchang, the Russian state-sponsored hacking group Sandworm, also known as APT44, disrupted the Games’ IT infrastructure using so-called Olympic Destroyer malware in a false-flag operation designed to implicate North Korean and Chinese actors.
APT28's attack begins with spear-phishing emails containing weaponized documents that exploit CVE-2026-21509, a Microsoft Office security feature bypass vulnerability. This vulnerability was addressed by an urgent, out-of-band security update. When victims open these malicious documents, the exploit triggers automatically without requiring macros or user interaction. The vulnerability allows embedded OLE objects to execute by leveraging the WebDAV protocol to fetch external payloads from attacker-controlled infrastructure.
...
The adversary orchestrated a concentrated 72-hour spear-phishing campaign (January 28-30, 2026), delivering at least 29 distinct emails across nine Eastern European nations, primarily targeting defense ministries (40%), transportation/logistics operators (35%), and diplomatic entities (25%). These emails originated from compromised government accounts of multiple countries, including Romania, Bolivia, and Ukraine.

Privacy

  • An Administrative Review Tribunal has reversed most of the Office of the Australian Information Commissioners earlier findings against Bunnings, for its use of Face Recognition Technology (FRT).
Between 6 November 2018 and 30 November 2021 (the Relevant Period), Bunnings operated FRT
...
Bunnings ceased operating the FRT system on 30 November 2021.
...
We have found that during the Relevant Period, Bunnings was entitled to use FRT for the limited purpose of combatting very significant retail crime and protecting their staff and customers from violence, abuse and intimidation within its stores.
...
We have also found that, whilst using FRT during the Relevant Period, Bunnings did not comply with obligations relating to notification in APP 5.1 and management of personal information in APP1.2 and 1.3. If personal information is to be collected by FRT, Bunnings and other APP entities must take reasonable steps to provide notification that personal information is being collected and to implement appropriate practices, procedures and systems.
...
The decision of the Tribunal is to set aside the Determination by the Privacy Commissioner in relation to the finding that Bunnings breached APP 3.3 and to substitute a decision that Bunnings did not breach APP 3.3 because subclause 3.4 applies and a permitted general situation existed in relation to the collection of information by Bunnings during the Relevant Period.

AI

  • A few new model releases...
  • Mistral have released Voxtral Transcribe 2, a speech-to-text model, with both open-weights and closed-weights variants.
Voxtral Mini Transcribe V2: State-of-the-art transcription with speaker diarization, context biasing, and word-level timestamps in 13 languages.
Voxtral Realtime: Purpose-built for live transcription with latency configurable down to sub-200ms, enabling voice agents and real-time applications.
Voxtral Realtime - official name Voxtral-Mini-4B-Realtime-2602 - is the open weights (Apache-2.0) model, available as a 8.87GB download from Hugging Face.
The new Claude Opus 4.6 improves on its predecessor’s coding skills. It plans more carefully, sustains agentic tasks for longer, can operate more reliably in larger codebases, and has better code review and debugging skills to catch its own mistakes. And, in a first for our Opus-class models, Opus 4.6 features a 1M token context window in beta.
The model advances both the frontier coding performance of GPT‑5.2-Codex and the reasoning and professional knowledge capabilities of GPT‑5.2, together in one model, which is also 25% faster. This enables it to take on long-running tasks that involve research, tool use, and complex execution. 
The September announcement described a wildly ambitious plan: 10 gigawatts of Nvidia systems for OpenAI, requiring power output equal to roughly 10 nuclear reactors. Nvidia CEO Jensen Huang told CNBC at the time that the project would match Nvidia’s total GPU shipments for the year. “This is a giant project,” Huang said.
But the deal was always a letter of intent, not a binding contract. And in recent weeks, Huang has been walking back the number. On Saturday, he told reporters in Taiwan that the $100 billion was “never a commitment.” He said OpenAI had invited Nvidia to invest “up to” that amount and that Nvidia would “invest one step at a time.”

Subscribe to Deuxieme RE Banque News

Sign up now to get access to the library of members-only issues.
Jamie Larson
Subscribe