Russian APT Exploits Patched Office Flaw in Days; Chinese Spies Hijack Notepad++ Updates

The cybersecurity landscape on February 4th, 2026, is dominated by sophisticated state-sponsored attacks. The Russian APT28 group was caught weaponizing a freshly patched Microsoft Office zero-day vulnerability (CVE-2026-21509) within days, targeting European entities. In a separate, long-running campaign, a Chinese APT compromised the Notepad++ update mechanism in a six-month supply chain attack. Other major incidents include the resurfacing of a massive AT&T customer dataset with 176 million records, a widespread DDoS campaign by pro-Russian hacktivists, and critical vulnerability disclosures for Django and Ingress-NGINX.