Microsoft and Fortinet Race to Patch Actively Exploited Zero-Days as ShinyHunters Claims Massive Match Group Breach
Summary
This 24-hour period saw urgent, out-of-band patches from major vendors to combat actively exploited zero-day vulnerabilities. Microsoft issued an emergency fix for a critical Office security bypass (CVE-2026-21509), while Fortinet scrambled to address a critical SSO authentication bypass (CVE-2026-24858), both of which were added to CISA's KEV catalog. In the data breach landscape, the ShinyHunters group claimed a massive breach of Match Group, allegedly compromising 10 million user records from Hinge and OkCupid. Additionally, SolarWinds disclosed five critical RCE and auth bypass flaws in its Web Help Desk, and the Illinois Department of Human Services confirmed a breach affecting 700,000 individuals.
Today New Articles
SolarWinds Discloses Five Critical RCE & Auth Bypass Flaws in Web Help Desk
SolarWinds has disclosed a set of five critical vulnerabilities in its Web Help Desk (WHD) platform, a tool used by over 300,000 organizations. The flaws include two unauthenticated remote code execution (RCE) vulnerabilities and two authentication bypasses, e...
ShinyHunters Claims Breach of 10M Match Group Users from Hinge & OkCupid
The notorious cybercrime group ShinyHunters has claimed responsibility for a major data breach impacting Match Group, the parent company of popular dating apps like Hinge, OkCupid, and Match.com. The group posted on a dark web forum that it has stolen over 10...
Critical RCE Flaws in n8n Workflow Platform Put Thousands of Instances at Risk
Two new high-severity vulnerabilities have been discovered in the n8n workflow automation platform, a tool that often holds credentials to critical corporate systems. The most severe flaw, CVE-2026-1470, is a critical eval injection vulnerability (CVSS 9.9) th...
Malicious PyPI Packages `spellcheckerpy` & `spellcheckpy` Deliver RAT via Hidden Payload
A software supply chain attack has been uncovered on the Python Package Index (PyPI), involving two malicious packages named `spellcheckerpy` and `spellcheckpy`. Downloaded over 1,000 times, the packages contained a hidden, dormant payload. A later version upd...
US Indicts 31 More in ATM Jackpotting Ring Linked to Tren de Aragua Gang
A U.S. federal grand jury has indicted an additional 31 individuals for their participation in a widespread 'ATM jackpotting' conspiracy, bringing the total number of defendants to 87. The sophisticated scheme involved using malware to force ATMs to dispense l...
Nova Ransomware Group Claims Cyberattack on KPMG Netherlands, Sets 10-Day Deadline
The Nova ransomware group has claimed responsibility for a cyberattack against the Netherlands division of global professional services firm KPMG. The claim, which appeared on ransomware monitoring services on January 23, 2026, alleges that the group successfu...
'Stanley' MaaS Sells Malicious Chrome Extensions Guaranteed for Web Store Publication
A new Malware-as-a-Service (MaaS) platform named 'Stanley' has appeared on Russian-language cybercrime forums, specializing in the sale of malicious Google Chrome extensions. A key feature of the service is a guarantee that the malicious extensions will be suc...
Article Updates
Mustang Panda APT Deploys Signed Kernel-Mode Rootkit to Hide Backdoor
Update:The China-aligned Mustang Panda (HoneyMyte) APT group has expanded its cyber-espionage campaign targeting government, military, and NGOs in Southeast and East Asia. The group is now deploying an updated version of its 'CoolClient' backdoor and multiple new bro...
Illinois DHS Exposes Data of 700,000 Residents in Massive Misconfiguration Breach
Update:The Illinois Department of Human Services (IDHS) data breach, previously attributed to a server misconfiguration, now has an undisclosed cause, with the new report implying potential malicious activity by cybercriminals. Crucially, the updated information stat...
Fortinet Confirms Active Exploitation of FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls
Update:A new critical authentication bypass, CVE-2026-24858, has been disclosed in FortiCloud SSO. This vulnerability allows attackers with any FortiCloud account to gain unauthorized access to other customers' devices, and crucially, it bypasses patches for the prev...