CISA Mandates Patches for Exploited Windows & Gogs Zero-Days; Ransomware Cripples Hospital & Energy Giant Breached

CISA Adds Actively Exploited Windows Zero-Day (CVE-2026-20805) to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a zero-day vulnerability in the Windows Desktop Window Manager (CVE-2026-20805) by February 3, 2026. The medium-severity information disclosure flaw is being actively exploited in the wild as a crucial component in multi-stage attack chains, allowing attackers to bypass Address Space Layout Randomization (ASLR) and enable more severe exploits like remote code execution. The flaw was addressed in Microsoft's January 2026 Patch Tuesday update.

CVE-2026-20805WindowsZero-DayCISAKEV +3 more

5 min read

CISA Mandates Patch for Exploited Windows Zero-Day Used in Attack Chains

Patch Management

Threat Intelligence

Spanish Energy Giant Endesa Hit by Massive Data Breach, 20M Records Allegedly For Sale

Endesa Confirms Data Breach; Hacker Claims to Hold Data of 20 Million People

Spain's largest electric utility, Endesa, has confirmed a data breach after detecting unauthorized access to a commercial platform. The company admitted that customer PII, contact details, and bank account IBANs were potentially exposed. The situation is amplified by a threat actor on a cybercrime forum who claims to have stolen a 1.05 TB database containing the data of over 20 million people, which is now up for sale. Endesa, which serves over 10 million customers, is urging vigilance against phishing and fraud.

Data BreachEndesaSpainPIIEnergy Sector +2 more

5 min read

Data Breach

Cyberattack

Industrial Control Systems

Pax8 Data Leak Exposes Sensitive MSP and Customer Info via Accidental Email

MEDIUM

Pax8 Accidentally Exposes Partner and Customer Business Data via Email

Cloud commerce marketplace Pax8 has confirmed a data exposure incident caused by human error. On January 13, an employee mistakenly sent an email containing a CSV file with sensitive, non-PII business data for approximately 1,800 Managed Service Provider (MSP) partners. The email, sent to fewer than 40 UK-based partners, exposed valuable information such as customer names, Microsoft license counts, pricing, and contract renewal dates, creating a significant risk of targeted phishing and competitive poaching.

Data LeakPax8MSPHuman ErrorData Exposure +1 more

5 min read

Pax8 Data Leak Exposes Sensitive MSP and Customer Info via Accidental Email

Data Breach

Supply Chain Attack

Cloud Security

CISA Warns of Critical Flaws in Rockwell & YoSmart ICS Equipment

CISA Issues Advisories for Critical Vulnerabilities in Rockwell Automation and YoSmart Industrial Control Systems

CISA has released several Industrial Control Systems (ICS) advisories, warning of significant vulnerabilities in widely deployed equipment from Rockwell Automation and YoSmart. A high-severity SQL injection flaw (CVE-2025-12807) in Rockwell's FactoryTalk platform could allow for database takeover, while another flaw (CVE-2025-9368) can cause a denial-of-service condition. Separately, multiple flaws in YoSmart smart home hubs could permit remote device control and data interception, posing risks to both manufacturing and communications sectors.

ICSSCADACISARockwell AutomationYoSmart +3 more

CISA Warns of Critical Flaws in Rockwell & YoSmart ICS Equipment

Industrial Control Systems

Patch Management

Russian GRU Hackers (APT28) Evolve Credential-Harvesting Tactics

GRU-Linked BlueDelta (APT28) Refines Credential-Harvesting Operations Against European and Eurasian Targets

The Russian GRU-linked threat group BlueDelta, also known as APT28 or Fancy Bear, has been observed refining its credential-harvesting operations. According to research from Recorded Future, campaigns between February and September 2025 targeted energy, defense, and policy organizations in Europe and Eurasia. The group uses tailored spear-phishing emails, multi-stage redirection, and abuses low-cost, disposable infrastructure like ngrok and other free hosting services to enhance stealth and complicate attribution.

APT28Fancy BearBlueDeltaGRURussia +3 more

Russian GRU Hackers (APT28) Evolve Credential-Harvesting Tactics

Threat Actor

Phishing

Threat Intelligence

Russian Hackers Target Ukrainian Military with "PluggyApe" Malware

Void Blizzard (UAC-0190) Targets Ukrainian Defense Forces with PluggyApe Malware via Charity-Themed Lures

A Russian-linked hacking group, Void Blizzard (also known as UAC-0190), has been targeting the Ukrainian Defense Forces with a new cyber-espionage campaign. According to CERT-UA, the attacks, which occurred between October and December 2025, use a novel malware strain called PluggyApe. The campaign employs sophisticated social engineering, with attackers making direct contact with targets on secure messaging apps like Signal and WhatsApp, using charity-themed lures to build trust and deliver the malware.

Void BlizzardPluggyApeUkraineRussiaCyber Espionage +2 more

Threat Actor

Malware

Cyberattack

ConnectPOS Exposed Admin GitHub Token for Over Four Years, Creating Massive Supply Chain Risk

CRITICAL

ConnectPOS Leaked Admin-Level GitHub Token in Public Docs for Four Years, Posing Major Supply Chain Risk

Point-of-sale vendor ConnectPOS exposed a GitHub Personal Access Token (PAT) with full administrative privileges in its public documentation for over four years, from September 2021 until its discovery in January 2026. The blunder, found by security firm Sansec, put the vendor's entire software supply chain at risk. An attacker could have used the token to inject malicious code, such as a payment card skimmer, into the POS software, which would then be distributed to its 12,000+ customers, including major brands like Asus and Indiana University.

ConnectPOSSupply Chain AttackGitHubSecret LeakPAT +2 more

ConnectPOS Exposed Admin GitHub Token for Over Four Years, Creating Massive Supply Chain Risk

Supply Chain Attack

Data Breach

Microsoft's January 2026 Patch Tuesday Fixes 114 Flaws, Including One Exploited Zero-Day

Microsoft January 2026 Patch Tuesday Addresses 114 Vulnerabilities, Including One Exploited Zero-Day

Microsoft has released its first Patch Tuesday of 2026, a substantial update that addresses 114 security vulnerabilities across a wide range of its products, including Windows, Office, Azure, and SharePoint. The release includes fixes for eight critical remote code execution (RCE) vulnerabilities and, most notably, one moderate-severity information disclosure zero-day (CVE-2026-20805) that is confirmed to be actively exploited in the wild. This makes it the third-largest January update on record, urging administrators to prioritize deployment.

Patch TuesdayMicrosoftVulnerabilityZero-DayRCE +1 more

3 min read

Microsoft's January 2026 Patch Tuesday Fixes 114 Flaws, Including One Exploited Zero-Day

Patch Management