Archive

General * Google is expanding theft protection for mobile devices, including default enabling in presumably high-risk countries (initially Brazil). Updates include changes to "Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts", "critical tools that utilize Biometric Prompt, like

General * Apparently, there are enough exposed LLM servers on the Internet, to make a viable business. Scan the Internet, find unsecured Ollama/vLLM/OpenAI-compatible endpoints, test, then re-sell access. * https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization * https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/ * Moltbot (formerly Clawdbot) has

General * More from Brian Krebs, pivoting from the Kimwolf botnet, to an earlier antecedent - Badbox 2.0. This earlier botnet was used to help bootstrap the Kimwolf botnet, providing access to vulnerable IoT devices on which Badbox was running, as well as other vulnerable systems within the adjacent network.

General * Pwn2Own Automotive wrapped up, where "$1,047,000 USD was awarded for 76 unique 0-day vulnerabilities". Kudos to Juurin Oy for installing Doom on an HYC50 Compact wall-mountable (vehicle) charger. * https://www.zerodayinitiative.com/blog/2026/1/23/pwn2own-automotive-2026-day-three-results-and-the-master-of-pwn * https://www.zerodayinitiative.com/blog/2026/1/22/

General * ZenDesk ticket systems are getting spammed en masse, generating large amounts of spam for some users (acknowledgement email for opening a ticket) and presumably the organisations. Attackers appear to be using email lists for valid emails when opening the tickets. The goal is currently unclear, as they are not

General * More Cisco Remote Code Execution (RCE) - in Cisco Unified Communications Manager. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A

General * Brian Krebs has just dropped part three of his investigation into the Kimwolf botnet * https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/ * Checkpoint researchers - who first revealed the VoidLink malware (15JAN2026 news) - are suggesting it may have been built with a large amount of LLM assistance. They've

General * Microsoft are doubling-down on their favoured strategy to make money - create a massive security (data-loss) issue, then sell controls to fix it. Using Purview, to control Recall - the 'feature' that captures frequent snapshots of the screen. * https://learn.microsoft.com/en-us/purview/dlp-recall-get-started Getting Techy

General * Quality Microsoft coding - secured Windows 11 23H2 Enterprise and IoT versions fail to shutdown with the latest cumulative update. After installing the January 13, 2026, Windows security update (KB5073455) for Windows 11, version 23H2, some PCs with Secure Launch are unable to shut down or enter hibernation. Instead,

General * Time to update your Bluetooth audio accessories, if they support Google Fast Pair. Turns out that a lot of them don't require the device to be in pairing mode, before allowing anyone to proceed through the Fast Pairing pathway. * https://www.esat.kuleuven.be/cosic/news/whisperpair-hijacking-bluetooth-accessories-using-google-fast-pair/