Threats
Summary Attackers compromised the official download page of EmEditor, a popular text and code editor, to distribute a trojanized installer containing multi-stage malware. The attack targeted the software's primarily Japanese developer user base during the late December 2025 holiday period when security monitoring typically weakens. The malware performs
Alerts
A critical vulnerability in the Academy LMS plugin for WordPress is under active exploitation, allowing unauthenticated attackers to take over administrator accounts and gain full control of affected eLearning platforms. The flaw, tracked as CVE-2025-15521, carries a CVSS score of 9.8 and affects all versions of the plugin up
Breaches
The Nova ransomware group has claimed responsibility for an attack against KPMG, one of the Big Four professional services firms, threatening to release 500GB of stolen data if ransom demands are not met. The listing appeared on Nova's dark web leak site on January 23, 2026, with a
Threats
A sophisticated evolution of the ClearFake malware campaign is abusing a legitimate Windows component to execute malicious PowerShell commands while evading endpoint detection systems. The campaign, which has compromised hundreds of websites since August 2025, now leverages a command injection vulnerability in a trusted Microsoft-signed script to silently run malicious
Threats
A previously undocumented ransomware family dubbed Osiris has emerged in attacks targeting enterprise environments, with technical evidence suggesting the operators may have ties to the Inc ransomware group. Symantec's Threat Hunter Team identified the new strain during an investigation into an attack against a major food service franchisee
Alerts
Microsoft's January 2026 cumulative update for Windows 11 is causing widespread system stability issues, with users reporting full lockups, black screens, and application failures that have forced many to uninstall the security patches. KB5074109, released on Patch Tuesday January 13, targets Windows 11 versions 24H2 and 25H2, delivering
Threats
North Korean-linked threat actor KONNI is deploying an AI-generated PowerShell backdoor in an ongoing phishing campaign targeting software developers and engineering teams with access to blockchain infrastructure. The campaign, documented by Check Point Research, marks a notable evolution in both the group's targeting and tooling. Expanding Beyond Traditional
Alerts
A wave of automated attacks is actively compromising FortiGate firewalls through malicious SSO logins, with threat actors creating persistence accounts and exfiltrating device configurations within seconds of initial access. Arctic Wolf began tracking the campaign on January 15, 2026, and warns the situation remains developing. Attack Chain The intrusions follow
Threats
While much of the security industry's attention has been fixed on North Korea's sprawling IT worker infiltration schemes, Pyongyang's traditional cyber espionage units have been far from idle. New research from WithSecure reveals that Andariel—a state-sponsored group linked to the RGB's
Alerts
Developers using Orval to generate type-safe clients from OpenAPI specifications are being urged to update immediately after the discovery of a critical code injection vulnerability that threatens the JavaScript supply chain. The flaw, tracked as CVE-2026-23947, carries a CVSS score of 9.3 and allows attackers to execute arbitrary code
Alerts
Cisco has disclosed a critical zero-day vulnerability in its Unified Communications products that is being actively exploited in the wild, allowing unauthenticated attackers to execute arbitrary commands and gain root access on affected systems. The vulnerability, tracked as CVE-2026-20045, affects the web-based management interface of multiple Cisco UC products. Cisco&
Alerts
Google has released a security update for Chrome addressing a high-severity vulnerability in the V8 JavaScript engine that powers the browser. The flaw, tracked as CVE-2026-1220, is a race condition in V8—the component responsible for executing JavaScript code. Race conditions occur when the timing of operations can be exploited