Archive

General * More from Brian Krebs, pivoting from the Kimwolf botnet, to an earlier antecedent - Badbox 2.0. This earlier botnet was used to help bootstrap the Kimwolf botnet, providing access to vulnerable IoT devices on which Badbox was running, as well as other vulnerable systems within the adjacent network.

General * Pwn2Own Automotive wrapped up, where "$1,047,000 USD was awarded for 76 unique 0-day vulnerabilities". Kudos to Juurin Oy for installing Doom on an HYC50 Compact wall-mountable (vehicle) charger. * https://www.zerodayinitiative.com/blog/2026/1/23/pwn2own-automotive-2026-day-three-results-and-the-master-of-pwn * https://www.zerodayinitiative.com/blog/2026/1/22/

General * ZenDesk ticket systems are getting spammed en masse, generating large amounts of spam for some users (acknowledgement email for opening a ticket) and presumably the organisations. Attackers appear to be using email lists for valid emails when opening the tickets. The goal is currently unclear, as they are not

General * More Cisco Remote Code Execution (RCE) - in Cisco Unified Communications Manager. This vulnerability is due to improper validation of user-supplied input in HTTP requests. An attacker could exploit this vulnerability by sending a sequence of crafted HTTP requests to the web-based management interface of an affected device. A

General * Brian Krebs has just dropped part three of his investigation into the Kimwolf botnet * https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/ * Checkpoint researchers - who first revealed the VoidLink malware (15JAN2026 news) - are suggesting it may have been built with a large amount of LLM assistance. They've

General * Microsoft are doubling-down on their favoured strategy to make money - create a massive security (data-loss) issue, then sell controls to fix it. Using Purview, to control Recall - the 'feature' that captures frequent snapshots of the screen. * https://learn.microsoft.com/en-us/purview/dlp-recall-get-started Getting Techy

General * Quality Microsoft coding - secured Windows 11 23H2 Enterprise and IoT versions fail to shutdown with the latest cumulative update. After installing the January 13, 2026, Windows security update (KB5073455) for Windows 11, version 23H2, some PCs with Secure Launch are unable to shut down or enter hibernation. Instead,

General * Time to update your Bluetooth audio accessories, if they support Google Fast Pair. Turns out that a lot of them don't require the device to be in pairing mode, before allowing anyone to proceed through the Fast Pairing pathway. * https://www.esat.kuleuven.be/cosic/news/whisperpair-hijacking-bluetooth-accessories-using-google-fast-pair/

General * Microsoft finally gets around to patching its SQLite3 DLL (WinSqlite3.dll), patched upstream in June 2025 (3.50.2). * https://www.bleepingcomputer.com/news/microsoft/microsoft-updates-windows-dll-that-triggered-security-alerts/ * https://www.sqlite.org/cves.html * Microsoft agrees to pay for the electricity and water its data-centres use, and even pay their fair

General * Google Mandiant has released a security testing tool for Salesforce Experience Cloud. This is for testing of the low-code sites (the ‘older’ way information was leaked out of Salesforce instances), rather than checking for permissions to connect data-exfiltration tools (the more recently exploited mechanism, as used by Shiny Lapsus$