Google released an emergency Chrome update to fix CVE-2026-2441, a high-severity use-after-free bug in the browser’s CSS processing that has an exploit circulating in the wild. The flaw can allow arbitrary code execution inside the sandbox via a crafted HTML page, and was reported on February 11. Enterprises should fast-track updates and watch for anomalous renderer crashes or exploit telemetry.
Source: Help Net Security
Researchers find vault-compromise paths in major cloud password managers
ETH Zurich researchers demonstrated multiple password recovery and server-side manipulation attacks that could, under certain conditions, compromise vault integrity in Bitwarden, LastPass, Dashlane, and 1Password. The findings highlight systemic risks if a provider’s infrastructure is malicious or compromised, with attack severity ranging from integrity violations to full organizational vault takeover. Teams should review recovery policies, enforce phishing‑resistant MFA, and monitor for unusual recovery events.
Source: SecurityWeek
LockBit 5.0 debuts with coordinated Windows, Linux, and ESXi targeting
Acronis TRU identified LockBit 5.0 in active campaigns, marking a notable RaaS evolution with dedicated builds for Windows, Linux, and VMware ESXi. The cross‑platform focus and enterprise‑tailored tooling increase the likelihood of fast lateral spread and disruptive encryption across hybrid environments. Hardening hypervisors, isolating management planes, and validating offline backups are critical.
Source: Help Net Security
ClickFix campaign abuses nslookup to make users fetch a RAT
Microsoft warns of a ClickFix variant that socially engineers victims into running an nslookup command via the Windows Run dialog to retrieve ModeloRAT over DNS. The technique leverages living‑off‑the‑land binaries to bypass common controls and places the victim in the execution chain. Consider egress controls for DNS, application control for utilities like nslookup, and user training against “click-to-fix” lures.
Source: SecurityWeek
Dragos: Three new threat groups began targeting ICS/OT in 2025
Dragos’ latest Year in Review reports that three additional adversary groups pivoted to ICS/OT targets last year, underscoring persistent expansion of industrial threat activity. The findings reinforce the need for asset visibility, strict network segmentation between IT/OT, and tested incident response playbooks tailored to operational technology.
Source: SecurityWeek
Unit 42: Nearly two‑thirds of breaches now begin with identity abuse
Palo Alto Networks’ Unit 42 says identity‑based attacks are exploding as weak controls span a patchwork of integrated tools and cloud services. Compromised credentials—human and machine—are increasingly the first foothold for intrusions and lateral movement. Organizations should prioritize strong MFA, least‑privilege access, and governance over service accounts, API keys, and tokens.
Source: CyberScoop
Keenadu Android backdoor links multiple major botnets, targets firmware and apps
Kaspersky uncovered Keenadu, a sophisticated Android backdoor embedded in tablet firmware and system/Google Play apps, and used the investigation to expose ties among several prolific Android botnets. The findings raise supply‑chain and persistence concerns that evade standard app‑level defenses. Enterprises should verify device provenance, enforce MDM policies, and leverage firmware attestation where possible.
Source: SecureList
You May Also Be Interested In...
ChatGPT gets new security feature to fight prompt injection attacks
Ireland launches ‘large-scale inquiry’ into Musk’s AI bot Grok
Public Elasticsearch instances expose 43M+ records including credentials and payment data