← Cybersecurity Headlines
Cybersecurity Headlines
Gemini prompt injection flaw exposes calendar info, hacker admits to Supreme Court data leak, researchers uncover PDFSIDER malware
00:07:04
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Tuesday, January 20, 2026. I'm Sarah Lane. Gemini Prompt Injection flaw exposes calendar info Mego Security found a prompt injection issue in Google Gemini that lets attackers hide instructions inside Calendar invites. When users asked Gemini basic scheduling questions, the model copied private meeting details into a new Calendar event visible to the attacker. Google patched the issue after disclosure. Researchers say AI native workflows broaden the attack surface as other labs recently demonstrated similar data exfiltration and privilege escalation paths across Copilot vertex AI agents and multiple AI coding IDEs. Hacker admits to leaking stolen Supreme Court data 24 year old Nicholas Moore of Springfield, Tennessee pleaded guilty to hacking the US Supreme Court's electronic filing system more than 25 times in 2023, using stolen credentials, then posting screenshots to an Instagram account to show off the breach. Prosecutors say he also accessed AmeriCorps and VA systems, which with stolen logins leaking personal and health data from victims. He faces up to a year in prison and a $100,000 fine. Researchers uncover. PDF Cider malware PDF Cider is a newly documented backdoor malware delivered via DLL sideloading in spear phishing zip files. Security firm Resecurity says it uses a fake PDF24 executable to evade AV and EDR, runs commands in memory over an AES encrypted C2 channel and includes anti VM checks, DNS exfiltration and decoy intelligence docs. Researchers describe it as an apt style tooling focused on stealth and long term access rather than mass infection. Acting CISA Chief Saad Ouster of CIO Political sources say acting CISA Director Madhu Gautamakala moved to push out the agency's Chief Information Officer Robert Costello last week, issuing a rapid reassignment that would have forced Costello to resign or transfer within the Department of Homeland Security. Senior political appointees reportedly objected and DHS halted the move. Costello is viewed by many as one of SISA's strongest technical leaders. Sources say Costello and Garmacala previously clashed on contracting and policy decisions. Huge thanks to our sponsor DropZone AI. It's 2am and alert fires possible data exfiltration. Your on call analyst is three time zones away, half asleep, context switching between tools. By the time they piece together the evidence, 45 minutes have passed. Was it a real threat or another false positive? The clock is ticking. Tomorrow we'll tell you how 300 enterprises solved this exact problem. But if you can't wait. Head on over to DropZone AI to learn more. Malware broker set for sentencing Jordanian national Faras Khalil Ahmad Al Bashidi pleaded guilty to acting as an initial access broker selling network access and malware to an undercover FBI agent in 2023. Prosecutors say Al Bashidi, operating as Riz, that's R1Z, facilitated attacks against at least 50 U.S. companies and sold an EDR disabling tool that ultimately exposed his IP address and tied him to a $50 million ransomware incident. He was extradited in 2024 and faces sentencing in May with up to 10 years in prison and a $250,000 fine. Ingram Micro says attack affected 42K plus people Ingram Micro disclosed updated details from its July 2025 ransomware incident, confirming stolen data affected more than 42,000 people, including Social Security numbers and job applicant records. The attack caused a days long outage, work from home orders and 3.5 terabytes of documents stolen. While the company still hasn't formally attributed the breach, SafePay claimed responsibility last summer and has since become one of the more active ransomware crews, filling gaps left by Lockbit and Black Hat. TP link patches VIGI camera vulnerability TP link pushed Fixes for a high severity AUTH bypass In more than 32 Vigi and Vigi insight surveillance camera models reddened. Co founder Arco Dar says attackers can reset admin passwords and take full control, including video feeds. When he found the bug back in October, he says he counted more than 2500 exposed cameras online. The cameras are widely deployed globally and previous TP link flaws have been abused in the wild, making Patching urgent Windows 11 shutdown bug forces Microsoft into out of band damage control Microsoft issued an out of band Windows 11 update on January 17th to fix shutdown, restart and hibernation issues caused by January's patch Tuesday. The problem affected systems with System Guard Secure Launch enabled, preventing proper shutdowns and causing laptops and desktops to drain power. The update also addresses a remote desktop authentication bug. While a separate Outlook POP issue remains unresolved, Microsoft urges affected users to install KB57 7797, reminding us that security updates can create unexpected side effects. When the glut of LLM based tools started cropping up, many assumed they could never approximate the human creativity needed to be effective red teamers by themselves. But these tools are proving remarkably effective. So what's left for the red team that can't be automated? That's one of the questions we'll try to answer on this week's episode of the CISO Series podcast, look for the episode. AI is very efficient at making us forget the value of humans. Wherever you get your podcasts, if you have thoughts on the news from today or about our show in general, be sure to reach out to us feedbackisoseries.com we'd love to hear from you. I'm Sarah Lane reporting for the CISO series and we will talk to you today. Tomorrow.
- [06:48]
A
Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.