Cybersecurity Newsfeed - 02/11/26

Cybersecurity Newsfeed

📅 02/11/26

🛡️ Vulnerabilities

• TeamViewer Vulnerability Lets Attackers Run Code on IT Support Staff’s PCs: Cybersecurity firm Remedio disclosed a critical vulnerability in TeamViewer that allows remote attackers to execute arbitrary code on an IT support technician’s local machine immediately once an incoming remote-control connection is accepted. TeamViewer released security updates to fix the flaw. More info

• Alpine Linux Rebuilds GitLab After Attempted RCE Attack: Alpine Linux completely rebuilt its GitLab server infrastructure and issued global password resets following an attempted remote code execution (RCE) attack targeting CVE-2026-97229. Forensic investigation confirmed release binaries and signing keys remained uncompromised. More info

• A Shared ChatGPT Link Could Run Arbitrary Code on Users’ Computers: Security researchers identified a high-severity flaw in ChatGPT’s shared link rendering mechanism that could allow threat actors to execute remote code on visiting user systems. OpenAI released a server-side hotfix to sanitize shared conversation contexts. More info

• SS7 and Diameter Attacks: How Signaling Flaws Expose Your Phone: A technical security analysis highlights persistent architectural vulnerabilities within legacy SS7 and modern Diameter telecommunications signaling protocols, enabling cellular location tracking, SMS interception, and 2FA code hijacking without target interaction. More info

🎯 Adversaries

• FBI Links $6.3 Billion Binance Crypto Heist to North Korean Hackers: The FBI formally attributed a record-breaking $6.3 billion cryptocurrency theft from Binance to state-sponsored threat group TraderTraitor, following initial access gained through a compromised DevOps engineer’s workstation. More info

  More info

  More info

• Fake GitHub Repo Tricks AI Agents Into Installing SolanaCry Malware: AIR Research Lab identified a malicious campaign deploying a fake GitHub repository disguised as a Solana development kit to trick automated AI coding agents into installing SolanaCry malware via NetSupport Manager binaries. More info

• NetamLoader Malware Targets Government Windows 10 Systems in Asia: A novel malware strain named NetamLoader exploits AppDomainManager injection by abusing PatchMyPC-ScriptRunner.exe to sideload rogue DLLs and execute multi-stage payloads against Asian government entities. More info

• Chinese Hackers Use AI-Powered ARTEX to Target Critical Infrastructure: Chinese state-sponsored threat actors are deploying an AI-powered framework named ARTEX to automate network reconnaissance, evaluate system vulnerabilities, and craft tailored spear-phishing lures against critical infrastructure targets. More info

• Hugging Face Malware Campaign Returns to Hijack GPUs for Crypto Mining: Attackers uploaded trojanized machine learning models to Hugging Face containing malicious scripts that execute automatically during model loading to hijack GPU resources for unauthorized cryptocurrency mining. More info

📈 Trends

• From Beginner to Bug Hunter: Learning Cybersecurity in the AI Era: The cybersecurity education landscape is shifting as generative AI tools assist security researchers in vulnerability analysis, while experts emphasize that foundational knowledge in network architecture and manual source auditing remains essential. More info

• Cloudflare Reports 182 Million Network DDoS Attacks Mitigation: Cloudflare published threat intelligence data detailing the mitigation of over 182 million DDoS attacks, highlighting a steep rise in high-volume hyper-volumetric attacks leveraging misconfigured cloud infrastructure and botnets. More info

• Reddit to Lock Content Behind Logins to Fight Scrapers: Reddit announced plans to restrict unauthenticated visitor access to combat unauthorized web scraping and prevent artificial intelligence companies from harvesting user discussions without authorization. More info

• Netlab 360 Releases Monthly Financial Industry Cybersecurity Report & AI Weekly: Netlab 360 published its latest monthly threat report on banking trojans and credential-stuffing targeting the financial sector, alongside its 11th AI Security Weekly issue examining adversarial machine learning and prompt injection trends. More info

  More info

💥 Breaches & Leaks

• Polymarket Users Lose $2.7 Million in Third-Party Script Hack: Prediction market platform Polymarket temporarily placed its exchange into cancel-only mode after attackers compromised a DebugBear RUM JavaScript script to execute unauthorized wallet withdrawals totaling $2.7 million. More info

• Northflank Security Breach Leads to Abuse of Customers’ AI API Keys: Cloud platform provider Northflank issued an urgent notice urging customers to rotate stored secrets after a system breach exposed third-party AI API keys that were subsequently abused for unauthorized LLM inference queries. More info

• Chainalysis Discloses Data Breach From Offensive Agentic Techniques: Blockchain intelligence firm Chainalysis reported a corporate data breach caused by autonomous agentic AI techniques used by threat actors to discover misconfigurations and automate multi-stage credential harvesting. More info

• Trezor Warns of Suspected Crypto-Theft Implant in Hardware Wallet: Hardware wallet manufacturer Trezor issued a security warning regarding authentic-looking Trezor Safe 5 devices distributed by reseller CryptoBilis that were physically modified to extract private seed phrases during setup. More info

• Fake PDF and Search Tools Hijacked Searches for 13.4 Million Chrome Users: A search-hijacking campaign involving 319 malicious Chrome extensions impacted an estimated 13.4 million users by secretly modifying browser engine settings and injecting JavaScript to monetize search traffic via affiliate ad programs. More info

---

⬅ Back to Archive