SecurityWeek Briefing

"The loudest voices in security often have the least to lose."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents. Accessed on 07 January 2026, 2222 UTC.

Content and Source: Email subscription from https://feedly.com.

https://feedly.com/i/subscription/feed%2Fhttp%3A%2F%2Ffeeds.feedburner.com%2FSecurityweek

Please check subscription link or scroll down to read your selections. Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

Today

The Loudest Voices in Security Often Have the Least to Lose

by / 6h

Security advice fails when it comes from those who don’t bear the consequences and won’t be responsible for making it work. The post appeared first on SecurityWeek .

Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats

by Ionut Arghire / 7h

Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity. The post appeared first on SecurityWeek .

Vulnerability in Totolink Range Extender Allows Device Takeover

by Ionut Arghire / 8h

An error in the firmware-upload handler leads to devices starting an unauthenticated root-level Telnet service. The post appeared first on SecurityWeek .

Several Code Execution Flaws Patched in Veeam Backup & Replication

by Eduard Kovacs / 8h

Four vulnerabilities have been fixed in the latest release of Veeam Backup & Replication. The post appeared first on SecurityWeek .

Cybersecurity Firms Secured $14 Billion in Funding in 2025: Analysis

by Eduard Kovacs / 9h

2025 was the strongest year for cybersecurity funding since the 2021 peak, according to . The post appeared first on SecurityWeek .

Hackers Exploit Zero-Day in Discontinued D-Link Devices

2 TTPs

•

by Ionut Arghire / 9h

The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands. The post appeared first on SecurityWeek .

Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks

by Ionut Arghire / 10h

Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally. The post appeared first on SecurityWeek .

Yesterday

Hacker Conversations: Katie Paxton-Fear Talks Autism, Morality and Hacking

by Kevin Townsend / 1d

From dismantling online games as a child to uncovering real-world vulnerabilities, Katie Paxton-Fear explains how autism, curiosity, and a rejection of ambiguity shaped her path into . The post appeared first on SecurityWeek .

Cyber Risk Trends for 2026: Building Resilience, Not Just Defenses

by / 1d

We can’t outpace the adversary by trying to stop every attack, but we can outlast them by engineering systems and culture to take a punch and try to quickly rebound. The post appeared first on SecurityWeek .

Researchers Trap Scattered Lapsus$ Hunters in Honeypot

by Ionut Arghire / 1d

Using fake accounts and synthetic data to lure the hackers, the researchers gathered information on their servers. The post appeared first on SecurityWeek .

Critical Dolby Vulnerability Patched in Android

by Eduard Kovacs / 1d

The flaw is tracked as and its existence came to light in October 2025 after it was discovered by Google researchers. The post appeared first on SecurityWeek .

Sophisticated ClickFix Campaign Targeting Hospitality Sector

by Ionut Arghire / 1d

Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to . The post appeared first on SecurityWeek .

Dozens of Major Data Breaches Linked to Single Threat Actor

by Ionut Arghire / 1d

The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations. The post appeared first on SecurityWeek .

NordVPN Denies Breach After Hacker Leaks Data

NordVPN Salesforce database allegedly leaked

•

by Eduard Kovacs / 1d

The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems. The post appeared first on SecurityWeek .

Jan 5, 2026

Cybersecurity M&A Roundup: 30 Deals Announced in December 2025

by Eduard Kovacs / 1d

Significant cybersecurity M&A deals announced by , Red Hat, Checkmarx, Silent Push, and ServiceNow. The post appeared first on SecurityWeek .

Cyberattack Unlikely in Communications Failure That Grounded Flights in Greece

Greece rules out cyberattack flight disruption

•

by Associated Press / 2d

Flights across Greece were impacted for several hours after noise was reported on multiple air traffic communication channels. The post appeared first on SecurityWeek .

Brightspeed Investigating Cyberattack

Impact (Enterprise TA0040)

•

by Ionut Arghire / 2d

•

Crimson Collective breaches Brightspeed data

The hacking group Crimson Collective has claimed the theft of personal information pertaining to over 1 million Brightspeed customers. The post appeared first on SecurityWeek .

Sedgwick Confirms Cyberattack on Government Subsidiary

Sedgwick confirms cyberattack on subsidiary

•

by Ionut Arghire / 2d

Hackers have compromised a file transfer system at Sedgwick’s subsidiary that serves government agencies. The post appeared first on SecurityWeek .

CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries

by Ionut Arghire / 2d

With 24 new vulnerabilities known to be exploited by ransomware groups, the list now includes 1,484 software and hardware flaws. The post appeared first on SecurityWeek .

Kimwolf Android Botnet Grows Through Residential Proxy Networks

Kimwolf botnet infects two million devices

•

by Ionut Arghire / 2d

The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth. The post appeared first on SecurityWeek .

Researcher Spotlights WhatsApp Metadata Leak as Meta Begins Rolling Out Fixes

by Eduard Kovacs / 2d

WhatsApp device fingerprinting can be useful in the delivery of sophisticated spyware, but impact is very limited without a zero-day. The post appeared first on SecurityWeek .

Jan 3, 2026

President Trump Orders Divestment in $2.9 Million Chips Deal to Protect US Security Interests

Trump cancels chip deal over security

•

by Associated Press / 4d

The deal involved aerospace and defense specialist Emcore Corp. selling its computer chips and wafer fabrication operation. The post appeared first on SecurityWeek .

Jan 2, 2026

Two US Cybersecurity Pros Plead Guilty Over Ransomware Attacks

Cybersecurity pros plead guilty ransomware

•

by Eduard Kovacs / 5d

Ryan Goldberg and Kevin Martin have admitted being affiliates of the BlackCat/Alphv ransomware group. The post appeared first on SecurityWeek .

RondoDox Botnet Exploiting React2Shell Vulnerability

RondoDoX botnet exploits Next.js vulnerability

•

by Ionut Arghire / 5d

In December, the botnet’s operators focused on weaponizing the flaw to compromise vulnerable Next.js servers. The post appeared first on SecurityWeek .

Covenant Health Data Breach Impacts 478,000 Individuals

2 TTPs

•

by Eduard Kovacs / 5d

The Qilin ransomware group hacked the healthcare organization and stole data from its systems in May 2025. The post appeared first on SecurityWeek .

Adobe ColdFusion Servers Targeted in Coordinated Campaign

2.5M malicious requests target ColdFusion

•

by Ionut Arghire / 5d

GreyNoise has observed thousands of requests targeting a dozen vulnerabilities in Adobe ColdFusion during the Christmas 2025 holiday. The post appeared first on SecurityWeek .

Dec 31, 2025

Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist

4 TTPs

•

by Ionut Arghire / 7d

•

Trust Wallet users report fund theft

The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets. The post appeared first on SecurityWeek .

Dec 30, 2025

European Space Agency Confirms Breach After Hacker Offers to Sell Data

ESA data breach exposes sensitive information

•

by Eduard Kovacs / 7d

The European Space Agency is conducting an investigation and says external science servers have been compromised. The post appeared first on SecurityWeek .

Hawaii Cybersecurity Journal