Breaking cybersecurity news and vulnerability disclosures.https://uinat.com/https://uinat.com/news/lockbit-operation-cronos-takedown-2024/https://uinat.com/news/lockbit-operation-cronos-takedown-2024/On February 20, 2024, a 10-country task force seized LockBit's infrastructure, identified 194 affiliates, and froze $112 million in cryptocurrency in the most significant ransomware takedown in history.Fri, 20 Feb 2026 00:00:00 GMThttps://uinat.com/news/clop-oracle-ebs-zero-day-campaign-2026/https://uinat.com/news/clop-oracle-ebs-zero-day-campaign-2026/The Clop ransomware group weaponized CVE-2025-61882 and CVE-2025-61884 to breach nearly 100 organizations including Allianz UK, GlobalLogic, Envoy Air, Harvard, and Washington Post, with ransom demands reaching $50 million.Thu, 05 Feb 2026 00:00:00 GMThttps://uinat.com/news/coupang-data-breach-33-million-accounts-2026/https://uinat.com/news/coupang-data-breach-33-million-accounts-2026/South Korean e-commerce giant Coupang confirmed an additional 165,000 user accounts were exposed in the massive data breach affecting 33.7 million total accounts, triggered by a former employee using valid authentication keys.Thu, 05 Feb 2026 00:00:00 GMThttps://uinat.com/news/amaranth-dragon-apt41-winrar-exploitation-2026/https://uinat.com/news/amaranth-dragon-apt41-winrar-exploitation-2026/Check Point Research documents a new threat cluster weaponizing CVE-2025-8088 within days of disclosure to target government and law enforcement agencies across Cambodia, Thailand, Philippines, and neighboring countries.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/dead-vax-asyncrat-ipfs-campaign-2026/https://uinat.com/news/dead-vax-asyncrat-ipfs-campaign-2026/Securonix researchers document a sophisticated malware campaign that chains IPFS hosting, virtual hard disk abuse, and in-memory shellcode injection to deliver AsyncRAT while evading traditional detection.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/metro4shell-react-native-rce-exploitation-2026/https://uinat.com/news/metro4shell-react-native-rce-exploitation-2026/CVE-2025-11953 in React Native CLI's Metro Development Server is being exploited in the wild to deploy Rust-based malware on developer systems, with attacks observed since December 2025.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/apt28-lamehug-ai-malware-ukraine-2026/https://uinat.com/news/apt28-lamehug-ai-malware-ukraine-2026/Russia's APT28 has deployed LAMEHUG and PROMPTSTEAL malware that queries large language models via Hugging Face to dynamically generate attack commands, marking the first confirmed use of AI-powered malware in active cyber operations.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/harvard-upenn-shinyhunters-breach-2026/https://uinat.com/news/harvard-upenn-shinyhunters-breach-2026/The ShinyHunters cybercriminal group published stolen data from Harvard University and the University of Pennsylvania after ransom demands went unpaid, exposing over 2 million alumni, donor, and student records.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/n8n-cve-2026-25049-sandbox-bypass-rce-2026/https://uinat.com/news/n8n-cve-2026-25049-sandbox-bypass-rce-2026/A critical flaw in n8n (CVSS 9.4) exploits TypeScript/JavaScript type mismatch to bypass sanitization from a December 2025 patch, enabling authenticated remote command execution via webhook workflows.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/react2shell-nginx-traffic-hijacking-campaign-2026/https://uinat.com/news/react2shell-nginx-traffic-hijacking-campaign-2026/Threat actors are using CVE-2025-55182 exploitation to inject malicious NGINX configurations that silently redirect web traffic through attacker infrastructure, targeting Asian TLDs and government sites.Wed, 04 Feb 2026 00:00:00 GMThttps://uinat.com/news/apt28-operation-neusploit-office-zero-day-2026/https://uinat.com/news/apt28-operation-neusploit-office-zero-day-2026/Russia's APT28 weaponized CVE-2026-21509 within three days of Microsoft's disclosure, deploying MiniDoor email stealers and PixyNetLoader against Ukraine, Slovakia, and Romania.Tue, 03 Feb 2026 00:00:00 GMThttps://uinat.com/news/mozilla-firefox-ai-disable-option-2026/https://uinat.com/news/mozilla-firefox-ai-disable-option-2026/Firefox 148 introduces a 'Block AI enhancements' toggle that disables all current and future generative AI features, plus individual controls for translations, tab grouping, link previews, and chatbot access.Tue, 03 Feb 2026 00:00:00 GMThttps://uinat.com/news/dockerdash-ai-assistant-vulnerability-2026/https://uinat.com/news/dockerdash-ai-assistant-vulnerability-2026/Noma Labs discovered a critical flaw in Docker's Ask Gordon AI assistant allowing attackers to hijack AI reasoning through malicious image metadata, leading to remote code execution or data exfiltration.Tue, 03 Feb 2026 00:00:00 GMThttps://uinat.com/news/nationstates-data-breach-rce-user-data-exposed/https://uinat.com/news/nationstates-data-breach-rce-user-data-exposed/NationStates shut down its site after a vulnerability reporter chained input sanitization flaws to achieve remote code execution, copying user emails, password hashes, and IP addresses.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/notepad-supply-chain-attack-chinese-threat-actors/https://uinat.com/news/notepad-supply-chain-attack-chinese-threat-actors/Lotus Blossom APT compromised Notepad++'s hosting provider to intercept update traffic and deliver the Chrysalis backdoor to targeted government and financial organizations over a six-month period.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/vllm-critical-rce-vulnerability-2026/https://uinat.com/news/vllm-critical-rce-vulnerability-2026/CVE-2026-22778, a critical RCE in vLLM versions 0.8.3-0.14.0, chains a PIL information leak with a JPEG2000 heap overflow to achieve code execution through a malicious video link.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/openclaw-one-click-rce-vulnerability-2026/https://uinat.com/news/openclaw-one-click-rce-vulnerability-2026/CVE-2026-25253 (CVSS 8.8) allows attackers to steal authentication tokens and achieve RCE through a single malicious link via cross-site WebSocket hijacking—even on localhost-only OpenClaw instances.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/malicious-openclaw-skills-clawhub-malware-2026/https://uinat.com/news/malicious-openclaw-skills-clawhub-malware-2026/Over 400 malicious OpenClaw AI agent skills on ClawHub deploy Atomic Stealer via ClickFix-style social engineering. The hightower6eu account alone published 314 malicious skills targeting crypto and developer credentials.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/microsoft-ntlm-deprecation-three-phase-plan-2026/https://uinat.com/news/microsoft-ntlm-deprecation-three-phase-plan-2026/Microsoft will disable the 33-year-old NTLM authentication protocol by default in future Windows releases through a phased rollout: enhanced auditing now, Kerberos improvements in H2 2026, and disabled-by-default in future major releases.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/n8n-sandbox-escape-jfrog-vulnerabilities-2026/https://uinat.com/news/n8n-sandbox-escape-jfrog-vulnerabilities-2026/JFrog discovered two sandbox escape flaws in n8n: CVE-2026-1470 (CVSS 9.9) bypasses JavaScript sandboxing via deprecated 'with' statement, and CVE-2026-0863 (CVSS 8.5) escapes Python restrictions via AttributeError.obj.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/pdf-dropbox-phishing-credential-theft-2026/https://uinat.com/news/pdf-dropbox-phishing-credential-theft-2026/A phishing campaign uses clean PDF attachments hosted on Vercel to redirect victims to fake Dropbox login pages, bypassing email security by avoiding traditional malware or suspicious links.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/winrar-cve-2025-8088-ongoing-exploitation-2026/https://uinat.com/news/winrar-cve-2025-8088-ongoing-exploitation-2026/CVE-2025-8088 (CVSS 8.8), a path traversal flaw abusing Windows Alternate Data Streams, continues to be exploited by Russian APTs, Chinese actors, and cybercriminals to achieve persistence via Startup folder drops.Mon, 02 Feb 2026 00:00:00 GMThttps://uinat.com/news/mongodb-extortion-campaign-1400-servers-wiped/https://uinat.com/news/mongodb-extortion-campaign-1400-servers-wiped/A single threat actor is conducting automated attacks against exposed MongoDB instances, wiping databases and demanding 0.005 BTC per server, with 208,500 instances publicly exposed worldwide.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/eu-ai-act-enforcement-begins-2026/https://uinat.com/news/eu-ai-act-enforcement-begins-2026/The European Union's AI Act marks one year of prohibited AI enforcement on February 2, 2026, triggering Article 112's mandated Commission review. High-risk AI rules take effect August 2027.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/microsoft-copilot-enterprise-security-controls-2026/https://uinat.com/news/microsoft-copilot-enterprise-security-controls-2026/Microsoft introduces new Purview DLP integration, sensitivity label enforcement, and oversharing assessment tools for Copilot for Microsoft 365, responding to widespread CISO concerns about AI assistants accessing sensitive data through existing permissions.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/crosscurve-bridge-hack-3m-2026/https://uinat.com/news/crosscurve-bridge-hack-3m-2026/Attackers drained approximately $3 million from CrossCurve's cross-chain bridge by spoofing messages to the ReceiverAxelar contract, which lacked proper validation of cross-chain calls.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/reprompt-attack-microsoft-copilot-varonis-2026/https://uinat.com/news/reprompt-attack-microsoft-copilot-varonis-2026/Varonis discovered a prompt injection attack chain that could steal sensitive data from Microsoft Copilot with a single click, bypassing safety filters through double-request and chain-request techniques. Patched January 13, 2026.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/tulsa-airport-qilin-ransomware-2026/https://uinat.com/news/tulsa-airport-qilin-ransomware-2026/The Russian-speaking Qilin ransomware group listed Tulsa International Airport as a victim, leaking financial documents, employee IDs, and executive communications in the aviation sector's first reported attack of 2026.Sun, 01 Feb 2026 00:00:00 GMThttps://uinat.com/news/glassworm-vscode-supply-chain-attack-2026/https://uinat.com/news/glassworm-vscode-supply-chain-attack-2026/GlassWorm, a self-propagating worm using Solana blockchain for C2 and invisible Unicode obfuscation, has infected 35,800+ developers through compromised VS Code extensions on Open VSX.Sat, 31 Jan 2026 00:00:00 GMThttps://uinat.com/news/redkitten-iran-ngo-campaign-2026/https://uinat.com/news/redkitten-iran-ngo-campaign-2026/HarfangLab uncovered an Iran-linked campaign using AI-generated Office macros and the SloppyMIO backdoor to target activists documenting human rights violations during Iran's 2025-2026 protests.Sat, 31 Jan 2026 00:00:00 GMT