Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:06)
These are the cybersecurity headlines for Thursday, February 5, 2026. I'm Sarah Lane. Ukraine tightens controls on Starlink terminals Ukraine introduced a mandatory whitelist for Starlink terminals, disconnecting any unverified devices after confirming Russian forces are using Starlink equipped drones for real time control. Officials say the move, implemented with SpaceX, is meant to stop Russian UAVs that are harder to jam or intercept, with added restrictions limiting terminal use to stationary or low speed operation. More than 50,000 Starlink terminals are active in Ukraine and authorities say the measure is currently the only way to prevent Russian exploitation of the network. VMware ESXi flaw now exploited CISA said Wednesday that ransomware groups are now exploiting a high severity VMware ESXi sandbox escape flaw, which Broadcom patched back in March of 2025 after it was used as a zero day. The bug lets attackers with VMX level privileges rather right to the kernel and escape a virtual machine and has been linked to earlier sophisticated attacks attributed to Chinese speaking threat actors. CISA has added the flaw to its known exploited vulnerabilities catalog and is urging immediate patching. SolarWinds web help desk bug under Attack Attackers are actively exploiting a critical SolarWinds web help desk flaw just days after it was patched, prompting CISA to give Federal agencies a three day deadline to apply fixes. The 9.8 rated untrusted deserialization bug allows unauthenticated remote code execution and affects SolarWinds web help desk versions prior to 2026.1, which was released on January 28th. SolarWinds says it hasn't seen widespread exploitation, but is urging customers to patch its immediately. US used Cyber Weapons to Disrupt Iranian Air defenses Recorded Future news Sources say the US used cyber weapons to disable Iranian air defense systems during 2025 Airstrikes on nuclear sites at Fordo, Natanz and Eastfahan, preventing Iran from launching surface to air missiles at US Aircraft, officials claim Cyber Command, backed by NSA intelligence, targeted upstream network nodes rather than hardened facilities, marking one of the most sophisticated cyber operations against Iran to date. Huge thanks to our sponsor Strike 48. Strike 48 is the agentic log intelligence platform that actually puts AI agents to work, maximizing log visibility without blowing your budget. Find threats, your siloed tools miss get started today with pre built AI agents and workflows that investigate, detect and respond 24. 7 or build your own at strike48.com security that's strike48.com security Eyette Galo back to run cybersecurity at Microsoft Microsoft is bringing back former executive Eyet Galo to run cybersecurity while current security chief Charlie Bell moves into a new role focused on engineering quality. Gello returns after a stint at Google Cloud and will serve as an Executive VP reporting to CEO Satya Nadella. Charlie Bell joined Microsoft from aws back in 2021. Microsoft develops scanner to detect backdoors in other Microsoft news, the company says it's developed a lightweight scanner to detect backdoors in open weight large language models using three behavioral signals to flag poison models with a low false positive rate. The tool can identify trigger based sleeper agent behavior without retraining the model or knowing the backdoor in advance. It needs access to model files and it doesn't work on proprietary systems. Microsoft says this is part of a broader push to integrate AI specific threats like data poisoning into its secure development processes. Epstein files leak sensitive data, victim info and credentials US Authorities have retracted thousands of records tied to the Jeffrey Epstein files after inadequate redactions exposed sensitive data and affecting around 100 victims. This was first noted by AP News on February 2nd. The leaks included photos, names, emails, banking details, Social Security numbers and in some cases, full credit card information. Cyber News now reports the release exposed multiple passwords, some reportedly still valid, for accounts including outlook, Gmail, Yahoo, LinkedIn and Apple ID. System BC found active across infected systems Researchers at Silent Push say the system BC Botnet is still active and linked to more than 10,000 infected IP addresses worldwide, often appearing early in intrusion chains that later lead to ransomware attacks. The proxy malware was first seen back in 2019 and turns compromised systems into SOX5 relays and has been found lingering for weeks or even months, largely on data center infrastructure with infections concentrated in the U.S. researchers also identified a previously undocumented Linux focused variant with no antivirus detections and found compromised systems tied to government websites in Burkina Faso and Vietnam. If you have some thoughts on the news from today or about the show in general, and we know you do, be sure to reach out to us at Feedback. We would love to hear from you. I'm Sarah Lane reporting for the CISO series. Stay classy out there, Planet Earth and Beyond.