← Cybersecurity Headlines
Cybersecurity Headlines
Sandbox flaw exposes n8n instances, Fake Moltbot assistant drops malware, PeckBirdy takes flight for cross-platform attacks
00:08:03
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Thursday, January 29, 2026. I'm Sarah Lane. Sandbox escape flaw exposes N8N instances JFrog researchers disclosed two sandbox escape vulnerabilities in the N8N workflow automation platform that can lead to a full remote code execut on self hosted instances. One bug is rated critical at 9.9 and allows authenticated non admin users to escape JavaScript sandboxing and gain host level control. The other enables similar RCE via Python sub processes. The flaws are patched in recent N8N releases. Cloud hosted N8N is not affected and JFROG warns slow patching will leaves tens of thousands of exposed instances at risk. Fake Multbot Assistant drops malware Security researchers flagged a fake claudebot agent AI coding assistant on Microsoft's VS Code Marketplace that secretly installs malware, giving attackers persistent remote access via a bundled Screen Connect client. The extension exploited multbod's popularity despite the project having no official VS code plug using multiple fallback methods to deliver payloads even if infrastructure went offline. The report also highlights broader Multbot security risks, including exposed unauthenticated instances, leaking API keys and credentials Peck Birdie takes flight for cross platform attacks Trend Micro reports that China aligned threat actors have used a cross platform J script based code command and control framework dubbed Peckbirdie since at least 2023 to run cyber espionage campaigns. In two separate operations, attackers targeted Chinese gambling websites and Asian government entities using Peck Birdie alongside new modular backdoors mkdor and Holodonut to deliver fake software updates, harvest credentials and enable lateral movement while evading endpoint defenses. The framework's use of JavaScript and living off the Land binaries makes detection difficult and points to ongoing state linked espionage activity. Autonomous system uncovers open SSL flaws A January update fixed 12 previously unknown open SSL vulnerabilities, some dating back to 1998 uncovered by autonomous analysis from Aisle. The flaws spanned more than eight subsystems and included one high severity bug that could enable remote code execution under specific conditions alongside moderate and low severity issues. OpenSSL maintainers credited aisles disclosures and said the findings highlight how automated analysis can surface long standing issues in heavily audited code bases. Huge thanks to our sponsor Conveyor, another security questionnaire hits your desk. Ever wish it could magically disappear? You already have the answers that customers should self serve, but they can't find the info in your trust center that's why Conveyor built the first truly agentic trust center. An AI agent lives inside it, answering customer questions, sharing documents and even completing full questionnaires. Instantly, customers get what they need fast. It's magical, touchless, extremely accurate. Join teams at Atlassian, Zapier and more@conveyor.com Teen swatting suspects arrested Hungarian and Romanian police arrested four suspects, including teenagers, over coordinated swatting and doxing campaigns that triggered repeated bomb threats and false emergency calls across Hungary. Authorities say the group used Discord to collect victims personal information, then placed fake threats in their names, prompting large police responses. A 17 year old Romanian national faces terrorism related and false reporting charges while investigations continue into the roles of the other suspects. FBI seizes Ramp the FBI has seized the Ramp Cybercrime forum, a major marketplace used by ransomware gangs to advertise malware hacking services and recruit affiliates. Both its Tor and clearnet domains now show an FBI seizure notice potentially giving law enforcement access to user data, including Messages, emails and IP addresses. RAMP launched back in 2021 as one of the few forums still allowing ransomware promotion and was linked to Babook ransomware operator Mikhail Metv, who was indicted by the DOJ in 2023. Electrum tied to Polish cyber attack Drago says a coordinated cyber attack on Poland's power grid in December is tied with medium confidence to the Russian state linked hacking group Electrum. The attack targeted communications and control systems connecting grid operators to distributed energy resources including wind, solar and combined heat and power facilities, disrupting operations at around 30 sites and permanently disabling some OT equipment. Though no power outages were reported, Drago says the incident shows a division of labor between Electrum and a related access focused cluster Commissite. Empire owner pleads guilty to drug conspiracy A Virginia man who co created the dark web marketplace Empire Market has pleaded guilty to a federal drug conspiracy tied to more than $430 million in illegal transactions between 2018 and 2020. Prosecutors say Empire Market, an AlphaBay style platform with more than 1.6 million users, facilitated roughly $375 million in drug sales, with operators using cryptocurrency to launder proceeds and evade law enforcement. Authorities have seized around $75 million in crypto and the defendant now faces a mandatory minimum of 10 years in prison. If customers want cybersecurity vendors to solve a problem, it should be clear how to market the solution. Unfortunately, too many vendors are marketing something that buyers don't really care about. We try and make sense of the situation on the latest episode of Defense in depth. Look for the episode when cybersecurity marketing fails to reach the buyer. Wherever you get your podcasts. If you have thoughts on the news from today or about the show in general, be sure to reach out to us@feedbacksoseries.com we'd love to hear from you. I am Sarah Lane, reporting for the CISO series. Stay classy and warm out there and we'll see you tomorrow.
- [07:48]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.