Daily Cybersecurity News - February 4, 2026

Tenable Research discovered two critical vulnerabilities in Google Looker, collectively dubbed "LookOut," which could lead to remote code execution and theft of sensitive database credentials. Tracked as CVE-2025-12743, these vulnerabilities have been patched by Google, and self-hosted customers are urged to update immediately.

CISA has flagged a new critical vulnerability, CVE-2025-40551, in SolarWinds Web Help Desk as actively exploited. This "Untrusted Data Deserialization" flaw allows unauthenticated remote command execution. Federal agencies have been ordered to patch by February 6, 2026, creating an immediate 3-day remediation window for all sectors.

Bondu, the creator of an AI-powered plush toy, exposed approximately 50,000 private chat transcripts between children and their toys. The data was left accessible on a web console that allowed anyone with a standard Google account to log in and view sensitive information.

This incident highlights the critical failure of implementing basic authentication controls on administrative portals, especially for products handling sensitive data from children.

Step Finance, a Solana-based DeFi platform, lost approximately $40 million in digital assets after attackers compromised the personal devices of company executives. The breach allowed threat actors to gain privileged access and drain funds from several of the platform's treasury wallets.

This incident highlights the critical risk of targeting personnel with high-level privileges, demonstrating that human operational security is as crucial as protocol-level defenses.

The China-linked threat actor Amaranth Dragon is conducting targeted cyber-espionage campaigns against government and law enforcement agencies in Southeast Asia. The group leverages software vulnerabilities to gain initial access for long-term intelligence collection.

This campaign demonstrates a tightly scoped and stealthy operation, with attacks timed to coincide with sensitive political events to increase engagement. The rapid weaponization of a publicly disclosed vulnerability shows the actor's efficiency and focus on establishing persistent access for geopolitical espionage.

Threat actors are deploying a malicious tool that abuses a legitimate, signed kernel driver from EnCase forensic software to disable security products. This "EDR Killer" is designed to terminate dozens of security tools, allowing attackers to operate undetected after an initial compromise.

This tool marks a continuing trend of attackers abusing legitimate and signed drivers to bypass security controls. By disabling endpoint defenses, these EDR killers enable threat actors to deploy further payloads like ransomware with a higher chance of success.

According to cybersecurity firm Cofense, generative AI is dramatically increasing the scale and sophistication of phishing, doubling the rate of malicious emails detected in the past year. Attackers are now leveraging AI to create flawless, personalized campaigns that bypass traditional security filters.

The rise of AI-driven phishing marks a strategic shift from volume to quality at scale. Security leaders must assume that automated, context-aware, and grammatically perfect attacks can now target any employee, rendering traditional training that relies on spotting errors less effective. This necessitates a greater emphasis on behavior-based email security solutions and a zero-trust mindset that verifies unusual requests, even from seemingly legitimate internal and external sources.