InfoSec News 21JAN2026
General
- Brian Krebs has just dropped part three of his investigation into the Kimwolf botnet
- Checkpoint researchers - who first revealed the VoidLink malware (15JAN2026 news) - are suggesting it may have been built with a large amount of LLM assistance. They've uncovered initial specifications (using Spec Driven Design), and subsequent task artefacts that align with use of "an AI-centric IDE" (Integrated Development Environment) called TRAE.
- [UK] The UK is launching a new "Report Fraud" service, that promises to keep people informed as their reporting leads to investigations. Underneath - analytics, including Palantir Foundry.
- [UK] Dell is suing VMware for not honouring contracts to extend support for perpetual VMware licences.
- [US] Efforts are underway to keep the CISA Act limping along - only ten days remain for it to pass, before existing (temporary) funding expires.
Getting Techy
- An interesting (now closed) window in Cloudflare WAF (but potentially something similar exist in other WAF products), built to support ACME automated certificate issuance.
- A classic race-condition, in the Flashbots relay for Ethereum.
- Humorous retro bug in telnetd, that's over ten years old.
Privacy
- [US] The Supreme Court will hear a challenge to the constitutionality of geofence warrants.
According to Chatrie’s lawyers’ petition to the Supreme Court, Google saw a 1,500% increase in geofence warrant requests from 2017 to 2018. An increase of an additional 500% occurred in 2019, according to Harvard Law Review. The warrants are still used today.
...
After Chatrie challenged the geofence warrant used in his case as unconstitutional, a federal judge agreed the search likely violated the Fourth Amendment, but declined to prevent prosecutors from introducing the evidence collected from the warrant.
- [US] Admissions that DOGE accessed information, "even after a court order prohibited it". They may also have illegally shared information for political activities, in contravention of the Hatch Act.
(SSA = Social Security Administration)
SSA determined in its recent review that in March 2025, a political advocacy group contacted two members of SSA’s DOGE Team with a request to analyze state voter rolls that the advocacy group had acquired. The advocacy group’s stated aim was to find evidence of voter fraud and to overturn election results in certain States.
AI
- OpenAI pushing to win back users with a limited-time free-for-a-month ChatGPT-Plus offering.
- Another day, another LLM subverted - Google Gemini convinced to leak private calendar info, via a calendar invite. In short - send a calendar invite with instructions, wait for the trigger to be used (e.g. "what's my calendar look like for today"), leak data via new calendar entry.
- One more subversion - chaining MCP (Model Context Protocol) servers together.