Daily Cybersecurity News - January 21, 2026
Tesla Infotainment System Hacked at Pwn2Own Automotive 2026
Executive Summary
Security researchers successfully hacked the Tesla Infotainment System by exploiting 37 zero-day vulnerabilities during the Pwn2Own Automotive 2026 competition, earning $516,500. The CVE-ID is currently being assigned and the status is unpatched.
Vulnerability Details
- Affected Product: Tesla Infotainment System
- Identifier:Pending Assignment (Zero-Day)
- CVSS Score:Critical (Assessed)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Critical
- Attack Vector: The Tesla Infotainment System was remotely accessed and compromised.
- Ease of Exploit: High
Action Plan
- Immediate Action: Patch the Tesla Infotainment System once the update is available.
- Workaround: Monitor network traffic for suspicious activity.
- Detection: Implement intrusion detection systems to identify potential exploits.
Relevant professional terms
- Zero-day Vulnerability
- A software vulnerability that is unknown to the vendor and for which no patch is yet available.
- Exploit
- A piece of software, a chunk of data, or a sequence of commands that takes advantage of a vulnerability to cause unintended or unanticipated behavior to occur on computer hardware, software, or something electronic.
Source: BleepingComputer
ACF Plugin Vulnerability Allows Admin Access on WordPress Sites
CriticalExecutive Summary
A critical severity vulnerability in the Advanced Custom Fields (ACF) Extended plugin for WordPress allows unauthenticated remote attackers to gain administrative permissions. The vulnerability is tracked as CVE-2025-14533 and is patched in version 0.9.2.2.
Vulnerability Details
- Affected Product: Advanced Custom Fields Extended (ACFE) plugin for WordPress
- Identifier: CVE-2025-14533
- CVSS Score: 9.8 (Critical)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate patching or mitigation is critical due to the high severity and potential for complete system compromise.
- Attack Vector: Remote, unauthenticated attackers can exploit the vulnerability.
- Ease of Exploit: Easy
Action Plan
- Immediate Action: Upgrade to the latest version or apply the provided patch as soon as it becomes available.
- Workaround: Implement temporary mitigations such as disabling the plugin until a patch is available.
- Detection: Monitor for unauthorized administrative access and unusual activity.
Relevant professional terms
- Vulnerability
- A weakness in a system that can be exploited by a threat actor to perform unauthorized actions.
- Exploit
- A piece of software, a chunk of data, or a sequence of commands that takes advantage of a vulnerability to cause unintended or unanticipated behavior to occur on computer hardware, software, or something electronic.
Source: Bleeping Computer
Luxshare Hit by RansomHub Ransomware
Executive Summary
Luxshare, a key Apple partner, has allegedly suffered a breach by RansomHub, with attackers claiming to have stolen and encrypted sensitive data. The attackers are threatening to leak data from Apple, Nvidia, and LG unless a ransom is paid.
Attack Overview
- Attack Path: Initial access is suspected to be through typical methods such as phishing, exploiting known vulnerabilities, and password spraying.
- Attacker: RansomHub
Impact Assessment
- Data Stolen: Confidential 3D CAD product models, engineering design data, geometric data, component drawings, and printed circuit board data related to Apple, Nvidia, LG, Tesla and other companies.
- Operational Impact: Data encryption and potential data leak.
Detection & Hunting
- IOCs: 83.97.73[.]198, 108.181.182[.]143, 46.161.27[.]151, 185.65.212[.]164, 66[.]203.125.21, 89[.]44.168.207 (Data exfiltration endpoints)
- Detection Guidance: Monitor network traffic for data exfiltration to known RansomHub endpoints.
Strategic Takeaway
The breach highlights the risk of supply chain attacks and the need for robust security measures at all levels of the supply chain.
Relevant professional terms
- Ransomware
- A type of malware that encrypts a victim's files, rendering them inaccessible, and demands a ransom payment to restore access.
- Data Exfiltration
- The unauthorized transfer of data from a computer or network to an external location.
Source: Help Net Security
UStrive Security Lapse Exposes User Data
Executive Summary
UStrive, an online mentoring site, suffered a security lapse that exposed user data, including that of children. The incident, caused by a misconfigured GraphQL endpoint, allowed logged-in users to view other users' non-public information.
Attack Overview
- Attack Path: A misconfigured GraphQL endpoint with weak authorization checks allowed unauthorized data access.
Impact Assessment
- Data Stolen: Full names, email addresses, phone numbers, and potentially gender and date of birth of at least 238,000 users were exposed.
Detection & Hunting
- IOCs: Examine GraphQL endpoint logs for unusual queries and access patterns.
- Detection Guidance: Monitor for Broken Object Level Authorization (BOLA) flaws in GraphQL APIs.
Strategic Takeaway
Insufficient authorization checks on API endpoints can lead to significant data exposure, especially when handling sensitive user information.
Relevant professional terms
- GraphQL
- A query language for APIs and a runtime for fulfilling those queries with your existing data.
- BOLA (Broken Object Level Authorization)
- An API security vulnerability where an application fails to properly authorize access to objects based on the user's privileges.
Source: TechCrunch
NexShield Extension Delivers ModeloRAT via CrashFix
Executive Summary
A malicious Chrome extension, NexShield, posing as an ad blocker, crashes the browser to trick users into executing malicious commands. This leads to the installation of ModeloRAT, primarily targeting corporate environments.
Key TTPs
- Initial Access: Malvertising redirects to a fake ad blocker extension on the Chrome Web Store.
- Execution: Uses ClickFix technique, prompting users to execute a malicious PowerShell command copied to the clipboard via the Windows Run dialog.
- Defense Evasion: Delays malicious behavior for 60 minutes after installation to avoid immediate suspicion.
Campaign Analysis
The NexShield extension creates a denial-of-service condition by exhausting browser memory resources, leading to a crash. This "CrashFix" variant then uses social engineering to trick users into running a malicious script.
Targeting & Infrastructure
- Target Profile: Primarily targets domain-joined hosts in corporate environments.
- Infrastructure: Uses
nexsnield[.]comto track installs, updates, and uninstalls.
Actionable Intelligence
- Domains:
nexsnield[.]com
Relevant Terms
- ClickFix: A social engineering technique that tricks users into manually executing malicious commands.
- ModeloRAT: A Python-based Remote Access Trojan delivered in this campaign, enabling system reconnaissance and remote control.
Source: Malwarebytes
Exploitation of Security Testing Applications
Executive Summary
Threat actors are exploiting misconfigured web applications like DVWA, OWASP Juice Shop, Hackazon, and bWAPP. The goal is to gain unauthorized access to cloud environments belonging to Fortune 500 companies and security vendors.
Key TTPs
- Initial Access: Exploiting misconfigured web applications used for security training and internal penetration testing.
Campaign Analysis
Attackers are leveraging known vulnerabilities in security testing applications to target high-profile organizations. This allows them to potentially access sensitive data and disrupt services.
Targeting & Infrastructure
- Target Profile: Fortune 500 companies and security vendors.
Relevant Terms
- Penetration Testing: Simulating cyberattacks on a web application to identify security vulnerabilities.
- Vulnerability: A weakness in a system that can be exploited by a threat actor.
Source: Bleeping Computer
VoidLink: AI-Driven Linux Cloud Malware
Executive Summary
VoidLink is a cloud-focused Linux malware framework, believed to be largely generated by AI, targeting Linux cloud and container environments. The malware is designed for long-term access, surveillance, and data collection within compromised systems.
Key TTPs
- Defense Evasion: Employs rootkit capabilities, runtime code encryption, and adaptive behavior based on the detected environment to evade detection.
- Execution: Utilizes fileless execution via
memfd_createandexecveat.
Campaign Analysis
VoidLink marks a turning point in malware development, showcasing how AI can enable a single actor to create sophisticated malware. Its modular design and cloud-focused capabilities pose a significant threat to Linux-based cloud services.
Targeting & Infrastructure
- Target Profile: Targets Linux cloud and container environments, including AWS, GCP, Azure, Alibaba, and Tencent systems, potentially targeting software developers.
- Infrastructure: Features a Chinese web-based command-and-control (C2) dashboard for remote control and management.
Relevant Terms
- Rootkit: A set of tools used to hide malicious software and activity on a system.
- C2 (Command and Control): Infrastructure used by attackers to control and communicate with compromised systems.
Source: Bleeping Computer