Daily Cybersecurity News - January 22, 2026

On the second day of Pwn2Own Automotive 2026, hackers exploited 29 new zero-day vulnerabilities. This brings the event's cumulative total to 66 unique zero-days and $955,750 in prize money. The vulnerabilities are currently unpatched and actively exploited within the contest environment.

Cisco has released patches for a critical remote code execution (RCE) vulnerability, CVE-2026-20045, affecting its Unified Communications products and Webex Calling Dedicated Instance, which has been actively exploited as a zero-day vulnerability. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system of a susceptible device.

Under Armour suffered a ransomware attack in November 2025, with customer data surfacing on the dark web in January 2026. The Everest ransomware group claimed responsibility, exfiltrating and leaking sensitive data after an unpaid ransom.

The incident highlights the increasing risk of data exfiltration and public data leaks associated with ransomware attacks on retail companies.

A phishing campaign is targeting LastPass users with emails instructing them to back up their vaults within 24 hours. The attackers aim to harvest master passwords by redirecting victims to a fake LastPass domain.

The phishing campaign attempts to create a sense of urgency, a common tactic in social engineering attacks. If successful, attackers gain access to sensitive user data, including usernames, passwords, and financial information.

Attackers are using multiple LOLBins (Living Off The Land Binaries) to deploy Remcos RAT and NetSupport Manager on compromised systems. The campaign leverages legitimate Windows tools to evade detection while establishing remote access.

The attacker's heavy reliance on LOLBins demonstrates a determined effort to blend malicious activity with normal system operations. This approach increases the complexity for detection, requiring vigilant monitoring of potential LOLBin abuse.

A novel AI-augmented attack method leverages LLM services to generate dynamic code in real time within a browser, enabling malicious webpages to conduct phishing attacks. This represents a new frontier in runtime assembly attacks.

The increasing use of LLMs in generating dynamic phishing code poses a significant threat because it allows for real-time adaptation and evasion of traditional security measures. Security teams need to focus on advanced detection techniques that can identify malicious behavior generated by AI, as static analysis and signature-based approaches become less effective against these evolving threats. This requires continuous retraining of detection models with LLM-generated samples and implementing dynamic analysis to understand the runtime behavior of code.

Large language models (LLMs) are vulnerable to prompt injection attacks, where malicious instructions embedded in user inputs can override intended programming and cause unintended behavior. This exploit takes advantage of the model's inability to differentiate between developer-defined prompts and user inputs.

The ongoing vulnerability of LLMs to prompt injection attacks highlights a critical need for improved security measures. As AI systems become more integrated into sensitive areas, the potential for malicious actors to exploit these vulnerabilities increases, potentially leading to data breaches, misinformation, and compromised decision-making processes. Addressing this issue requires a multi-faceted approach, including enhanced input validation, better AI training, and continuous monitoring for malicious prompts.