Sign in Subscribe

InfoSec News 23JAN2026

General

The flaw is exploitable remotely in both forwarding and recursive modes; the attacker only needs to cause the server to process a crafted DNS message containing an undersized HHIT or BRID RR.
CBEST is a targeted assessment that allows regulators, firms and Financial Market Infrastructures (FMIs) to better understand weaknesses and vulnerabilities and take remedial actions.
Staff culture, awareness and training
Weaknesses in cyber resilience culture exploited during CBESTs include:
Firms/FMIs whose staff were susceptible to social engineering tactics were more likely to be vulnerable to simulated attacks aimed at credentials or system access. These attacks could occur directly via phishing or indirectly through the exposure of sensitive information, for example in job descriptions or on social media. (PR.AT-01)
Firms/FMIs in which users were routinely storing credentials in unprotected facilities, such as in spreadsheets or in open file shares, were more likely to have those credentials exposed and used as part of simulated cyberattacks. (PR.AT-01)
Firms/FMIs with insecure protocols for helpdesks, such as limited or no authentication of users during interactions with cyber attackers, were vulnerable to being attacked using fraudulently obtained credentials to further malicious access to sensitive information or systems. (PR.AT-02)

Getting Techy

Geo-Politics

  • [ES] Spain gives up on its probe into the use of NSO Pegasus spyware against the Spanish Prime Minister and Defence Minister, blaming a lack of co-operation from Israel.
Israel has not responded to five cooperation requests, breaking “the balance inherent in international cooperation and [violating] the principle of good faith that should govern relations between states,” Judge José Luis Calama, of the Audiencia Nacional high court, reportedly said in court documents.
Spain’s thwarted probe found evidence of crimes enabled by Pegasus, which the court has reportedly said “jeopardized the security of the Spanish State.”
Reports suggest that the primary motivation behind the CBI's USDT acquisitions was to control foreign exchange markets. This aligns with the on-chain activity we observed. The routing of funds to Nobitex indicates a strategy of injecting US dollar liquidity into the local market to prop up the rial.
Beyond domestic intervention, the CBI also appears to be constructing a "sanctions-proof" banking mechanism that replicates the utility of international dollar accounts. By treating USDT as "digital off-book eurodollar accounts", the regime creates a shadow financial layer capable of holding US dollar value outside the reach of US authorities.
Between January 2024 and June 2025, we collected and forensically analyzed three iPhones and one Android device belonging to members of Jordanian civil society that had been detained, arrested or interrogated by the authorities. This set included the devices of two political activists, a student organizer, and a human rights defender. We conclude with high confidence that all four devices were subjected to forensic extraction with a Cellebrite product. In addition, our analysis surfaced high-confidence, and previously-unpublished, Indicators of Compromise (IoCs) of Cellebrite forensic extraction on iOS and Android devices.
We find that, during the time the phone was in possession of the GID, the iPhone was connected via USB to a device that identified itself with the HostID 9016926980658937761372207 and SystemBUID 30313996-42072961236303456. We attribute both to Cellebrite with high confidence, as they appear in DLL files digitally signed by Cellebrite on VirusTotal, including “CellebriteMobileAgent/iPhoneLib.dll.”
Action to promote the wellbeing of children in relation to social media
(1) Within 12 months of the day on which this Act is passed, the Secretary of State must, for the purposes of promoting the wellbeing of children—
(a) direct the Chief Medical Officers of the United Kingdom (“the UK CMOs”) to prepare and publish advice for parents and carers on the use of social media by children at different ages and developmental stages, and
(b) by regulations made by statutory instrument require all regulated user-to-user services to use highly- effective age assurance measures to prevent children under the age of 16 from becoming or being users.

Privacy

  • [EU] 2025 was another big year for General Data Protection Regulation (GDPR) fines - US$1.42b, up from US$1.26b in 2024.
For the first time since 25 May 2018, average breach notifications per day have reached over 400 – breaking the plateauing trend we have seen in recent years. Between 28 January 2025 and 27 January 2026, the average number of breach notifications per day increased by 22% – from 363 to 443. While the data does not reveal the exact causes of this spike in notifications, it seems likely that geopolitical tensions, the abundance of new technologies available to threat actors to launch cyber-attacks, and the raft of new laws including incident notification requirements are all contributing factors.

AI

  • A reliable, and completely intended, stop-string in Anthropic's Claude. Consider it the LLM equivalent of EICAR, triggering a refusal to respond.
The reason this "magic string" exists is practical: in real deployments, a model can refuse mid-stream, and apps need to handle partial tokens, missing refusal messages, and state cleanup. The magic string is a deterministic way to validate that your streaming client handles those edge cases every time, without having to craft a policy-violating prompt.
ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86
A minimal, LLM-friendly programming language with mandatory testing and unambiguous syntax.
NanoLang transpiles to C for native performance while providing a clean, modern syntax optimized for both human readability and AI code generation.

Subscribe to Deuxieme RE Banque News

Sign up now to get access to the library of members-only issues.
Jamie Larson
Subscribe