January 2026 – Page 7

Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid

The “coordinated” cyber attack targeting multiple sites across the Polish power grid has been attributed with medium confidence to a Russian state-sponsored hacking crew known as ELECTRUM.
Operational technology (OT) cybersecurity company Dragos, in a new intelligence brief published Tuesday, described the late December 2025 activity as the first major cyber attack targeting distributed energy

AI Is Rewriting Compliance Controls and CISOs Must Take Notice

AI agents are now executing regulated actions, reshaping how compliance controls actually work. Token Security explains why CISOs must rethink identity, access, and auditability as AI becomes a digital employee. […]

SolarWinds warns of critical Web Help Desk RCE, auth bypass flaws

SolarWinds has released security updates to patch critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk IT help desk software. […]

Cyber Insights 2026: Offensive Security; Where It is and Where Its Going

Malicious attacks are increasing in frequency, sophistication and damage. Defenders need to find and harden system weaknesses before attackers can attack them.

The post Cyber Insights 2026: Offensive Security; Where It is and Where Its Going appeared first on SecurityWeek.

Mesh Security Raises $12 Million for CSMA Platform

The investment will allow Mesh to advance its autonomous, agentic capabilities, and scale sales and customer support efforts.

The post Mesh Security Raises $12 Million for CSMA Platform appeared first on SecurityWeek.

Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

A critical sandbox escape vulnerability has been disclosed in the popular vm2 Node.js library that, if successfully exploited, could allow attackers to run arbitrary code on the underlying operating system.
The vulnerability, tracked as CVE-2026-22709, carries a CVSS score of 9.8 out of 10.0 on the CVSS scoring system.
“In vm2 for version 3.10.0, Promise.prototype.then Promise.prototype.catch

Why We Can’t Let AI Take the Wheel of Cyber Defense

The fastest way to squander the promise of AI is to mistake automation for assurance, and novelty for resilience.

The post Why We Can’t Let AI Take the Wheel of Cyber Defense appeared first on SecurityWeek.

Hackers hijack exposed LLM endpoints in Bizarre Bazaar operation

A malicious campaign is actively targeting exposed LLM (Large Language Model) service endpoints to commercialize unauthorized access to AI infrastructure. […]

Rein Security Emerges From Stealth With $8M, Bringing Inside-Out Protection to AppSec

Rein aims to close the production visibility gap by stopping attacks inside the application runtime.

The post Rein Security Emerges From Stealth With $8M, Bringing Inside-Out Protection to AppSec appeared first on SecurityWeek.

Slovakian man pleads guilty to operating darknet marketplace

A Slovakian national admitted on Tuesday to helping operate a darknet marketplace that sold narcotics, cybercrime tools and services, fake government IDs, and stolen personal information for more than two years. […]

Month: January 2026