VulnHub

A newly discovered flaw in telnet servers exposes vulnerabilities in many legacy systems and Internet of Things (IoT) devices still using this outdated protocol for remote access. Despite telnet being largely replaced by more secure options, it remains in use across hundreds of thousands of devices, making them susceptible to potential attacks. Researchers have pointed out that this forgotten attack surface could allow unauthorized access to sensitive systems, putting data and operations at risk. Organizations relying on these systems need to assess their use of telnet and consider transitioning to more secure protocols to mitigate these risks. This situation underscores the importance of keeping security practices updated, even for older technologies that may still be in operation.

WhatsApp has introduced a new feature called 'Strict Account Settings' aimed at enhancing user privacy and protecting against spyware. This toggle allows users to tighten their account security beyond the existing end-to-end encryption already offered by the app. The move comes as concerns grow over the potential for spyware to compromise personal data on messaging platforms. Users will now have more control over who can see their information and how their accounts can be accessed. This is significant as it reflects a broader trend in tech companies prioritizing user privacy amid rising cyber threats.

The extortion group known as WorldLeaks claims to have stolen 1.4TB of sensitive data from Nike, which includes around 188,347 files. Nike is currently investigating this alleged breach to assess the extent of the data compromise. This incident raises serious concerns about the security of corporate networks, particularly for large companies like Nike that handle a significant amount of sensitive information. If the claims are verified, it could lead to potential reputational damage and legal repercussions for the brand. Additionally, it highlights the ongoing threat posed by cybercriminals who are increasingly targeting major corporations to steal and exploit sensitive data.

Researchers have discovered a critical vulnerability in the vm2 library, a popular Node.js sandbox used to execute untrusted code. This security flaw, identified as CVE-2026-22709, enables attackers to escape the sandbox environment and execute arbitrary code on the host system. This poses a significant risk to applications that rely on this library for secure code execution. Developers using vm2 should take immediate action to protect their systems, as the implications could lead to unauthorized access and control over sensitive data. It's crucial for users to stay informed about this vulnerability and implement necessary safeguards to prevent exploitation.

Modern ransomware has evolved beyond just encrypting files; it now focuses on psychological tactics to extort money from victims. Ransomware groups are increasingly using the threat of exposing sensitive data to pressure organizations into paying up. This approach not only exploits the fear of data leaks but also the potential liability that could arise from such exposures. As a result, companies and individuals are facing new challenges in dealing with these sophisticated attacks. Understanding these tactics is crucial for organizations looking to bolster their defenses against this growing form of cyber extortion.

In 2025, numerous internet outages frustrated users across various platforms, with Cloudflare attributing these disruptions to a series of significant events affecting global networks. The incidents were primarily linked to a combination of increased internet traffic and technical difficulties that arose during peak usage times. As a result, many popular websites and services experienced downtime, impacting businesses and consumers alike. This situation serves as a reminder of the vulnerabilities in our interconnected online systems and the need for robust infrastructure to support growing demands. Users and companies alike should be aware of these potential disruptions and consider strategies to mitigate their impact.

SoundCloud has experienced a significant data breach, affecting nearly 30 million user accounts. Hackers accessed personal and contact information, raising concerns about user privacy and security. This breach underscores the vulnerability of online platforms to cyberattacks, highlighting the need for stronger security measures. Users whose accounts were compromised should be vigilant about potential phishing scams and consider changing their passwords. SoundCloud has not yet detailed how the breach occurred, leaving many questions about the effectiveness of their security protocols.

Poland successfully thwarted a cyberattack involving Russian wiper malware aimed at its power and heating plants. This incident, which could have led to significant outages during the winter months, was detected and blocked by Polish officials before any damage occurred. The government has responded by tightening cybersecurity regulations to bolster defenses against potential future attacks. This incident underscores the ongoing tensions between Poland and Russia, particularly regarding cybersecurity threats to critical infrastructure. The prevention of this attack is crucial for maintaining energy stability during colder months, which could have severe implications for public safety and the economy.