Week 2 - 2026 Weekly Digest
05 Jan 2026 – 11 Jan 2026 • Published: 12 Jan 2026
Critical CVEs
CVE-2026-0628 — Insufficient policy enforcement CVSS 8.8Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.
CVE-2026-21858 — Exposure of sensitive information CVSS 10n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
CVE-2026-0830 — Arbitrary command injection CVSS 8.4Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
Top Security News
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors NewsThe Iranian threat actor known as MuddyWater has been attributed to a spear-phishing campaign targeting diplomatic, maritime, financial, and telecom entities in the Middle East with a Rust-based implant codenamed RustyWater.
BreachForums hacking forum database leaked, exposing 324,000 accounts NewsThe latest incarnation of the notorious BreachForums hacking forum has suffered a data breach, with its user database table leaked online. The current BreachForums administrator, known as "N/A," has acknowledged the new breach, stating that a backup of the MyBB user database table was temporarily exposed in an unsecured folder and downloaded only once.
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations NewsRussian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan.
Ransomware Activity
Softlab SpA RansomwareThe threat actor Qilin claims responsibility for a ransomware attack against the victim in the manufacturing sector on January 8.
MUTTI-PARMA RansomwareThe threat actor Clop claims responsibility for a ransomware attack against the victim in the manufacturing sector on January 8.
The Cressi RansomwareThe threat actor Qilin claims responsibility for a ransomware attack against the victim in the manufacturing sector on January 8.
Labeltex Group RansomwareThe threat actor Akira claims responsibility for a ransomware attack against the victim in the manufacturing sector on January 7.
Italgrafica Sistemi RansomwareThe threat actor Brotherhood claims responsibility for a ransomware attack against the victim in the manufacturing sector on January 6.
Saplog Group RansomwareThe threat actor Nova claims responsibility for a ransomware attack against the victim in the logistic sector on January 5.