Floating servers illustrating widespread cyberattacks and data security failures.

Daily Cybersecurity News - January 24, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

January 24, 2026 3:28 PM 6 min read

Root Access via Telnetd Exploit

Critical

Executive Summary

A critical authentication bypass vulnerability exists in GNU InetUtils telnetd, allowing remote attackers to gain root access. This flaw, identified as CVE-2026-24061, has been actively exploited.

Vulnerability Details

Affected Product: GNU InetUtils telnetd versions 1.9.3 through 2.7
Identifier: CVE-2026-24061
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Urgent; immediate action is required to mitigate the risk.
Attack Vector: A crafted USER environment variable with the value '-f root' is passed to the login program, bypassing authentication.
Ease of Exploit: Trivial; the vulnerability is easily exploitable remotely.

Action Plan

Immediate Action: Disable Telnet services if possible. Apply proper network access controls.
Workaround: Ensure proper network segmentation and access controls are in place to limit exposure.
Detection: Monitor for suspicious Telnet connections and the use of the '-f root' USER environment variable.

Relevant professional terms

Authentication Bypass: An attack that circumvents security mechanisms designed to verify the identity of a user or device, allowing unauthorized access.
Remote Code Execution (RCE): The ability to execute arbitrary code on a remote device or system.

Source: Bleeping Computer

Vehicle Systems Hacked at Pwn2Own

Executive Summary

Security researchers found multiple zero-day vulnerabilities in vehicle infotainment systems and EV chargers during the Pwn2Own contest at Automotive World 2026. During the first two days of the competition, 66 unique zero-day vulnerabilities were identified, earning researchers nearly a million dollars.

Vulnerability Details

Affected Product: Vehicle infotainment systems, EV chargers such as Autel MaxiCharger AC Elite Home 40A
Identifier: Zero-day vulnerabilities (66 unique)
CVSS Score: Not specified
Exploitation Status: Actively Exploited during Pwn2Own

Risk & Impact

Triage: Immediate attention is required due to the potential for vehicle operation compromise.
Attack Vector: Exploits via NFC, Bluetooth, or charging gun.
Ease of Exploit: Some vulnerabilities are simple, unpatched bugs.

Action Plan

Immediate Action: Apply patches and security updates from vendors.
Workaround: Monitor vehicle systems for unusual behavior.
Detection: Implement intrusion detection systems to identify potential exploits.

Relevant professional terms

Zero-day Vulnerability: A software vulnerability that is unknown to the vendor and for which no patch is yet available.
Buffer Overflow: An anomaly where a program writes data beyond the allocated buffer, which can lead to crashes, data corruption, or arbitrary code execution.

Source: Dark Reading

Millions of Credentials Leak Sparks Global Alarm

Executive Summary

A massive, unsecured database containing 149 million unique logins and passwords has been exposed, raising concerns about widespread credential theft and the use of infostealer malware. The exposed data includes credentials for various online services, including social media, financial platforms, and government domains, impacting users worldwide.

Attack Overview

Attack Path: The database was exposed due to a misconfigured cloud repository without password protection or encryption, likely populated by infostealer malware.

Impact Assessment

Data Stolen: 96GB of raw credential data, including 149 million unique logins and passwords for Gmail, Facebook, Instagram, Netflix, and other services.

Strategic Takeaway

The incident highlights the persistent threat of credential-stealing malware and the critical need for robust security measures, including encryption and access controls, to protect sensitive data.

Relevant professional terms

Infostealer: A type of malware designed to secretly infect devices and harvest credentials, such as usernames, passwords, and financial information.
Credential Theft: The act of stealing login information, such as usernames and passwords, to gain unauthorized access to accounts and systems.

Source: Security Magazine

Sandworm Targets Poland With DynoWiper

Executive Summary

The Russia-aligned Sandworm APT group targeted Poland's power grid in late 2025, deploying a new data-wiping malware called DynoWiper. The attack, which ESET researchers attribute to Sandworm with medium confidence, aimed to disrupt the energy system but was ultimately unsuccessful.

Key TTPs

Execution: The attackers deployed DynoWiper malware to destroy files on targeted systems.
Defense Evasion: Sandworm has shown persistence over the years, iterating on its tactics and tooling with each operation to evade detection and maximize damage.

Campaign Analysis

The attack occurred on the 10th anniversary of Sandworm's attack on the Ukrainian power grid, highlighting the group's continued focus on critical infrastructure. The incident underscores the increasing sophistication and global nature of cyber threats targeting energy grids.

Targeting & Infrastructure

Target Profile: The attack targeted Poland's energy generator and distribution infrastructure, including two heat and power plants, and systems managing renewable energy sources.
Infrastructure: The attack targeted critical facilities and communication links connecting wind turbines to Poland's distribution network.

Relevant Terms

APT (Advanced Persistent Threat): A sophisticated, long-term cyberattack campaign conducted by a skilled actor, often a nation-state, to gain access to a network and steal sensitive data.
Wiper Malware: A type of malware designed to erase data from a system, rendering it unusable.

Source: ESET Research

Malicious Extensions Steal Developer Data

Executive Summary

Malicious extensions on the VSCode Marketplace, with over 1.5 million installations, exfiltrated developer data to servers in China. These extensions pose a significant threat to software developers by stealing sensitive information and potentially compromising their systems.

Key TTPs

Initial Access: Malicious extensions are published on the VSCode Marketplace, impersonating legitimate tools to trick developers into installing them.
Execution: Once installed, the extensions automatically activate on every VS Code launch, running with the same OS privileges as the user.
Defense Evasion: The malicious code is often hidden within the extension, using obfuscation techniques to avoid detection.

Campaign Analysis

The use of malicious VSCode extensions highlights a growing blind spot in software supply chains, exploiting the trust developers place in third-party tools. These extensions can steal intellectual property, hijack system resources, and maintain persistent backdoors for remote access.

Targeting & Infrastructure

Target Profile: Software developers and organizations that rely on VSCode and third-party extensions.
Infrastructure: The extensions exfiltrate data to attacker-controlled servers, including those based in China.

Actionable Intelligence

IPs: syn1112223334445556667778889990[.]org

Relevant Terms

Data Exfiltration: The unauthorized transfer of data from a computer or network to an external location.
Supply Chain Attack: A cyberattack that targets vulnerabilities in the software supply chain to compromise end-users.

Source: Bleeping Computer

AI Honeypot Reveals Hidden Vulnerabilities

Executive Summary

An AI-written honeypot by Intruder unveiled that AI-generated code can introduce subtle security flaws due to over-trust in automated outputs, leading to exploitable vulnerabilities. The honeypot inadvertently included logic that made it vulnerable to IP spoofing and payload injection.

Key Findings

AI added logic to pull client-supplied IP headers, treating them as the visitor's IP, which is unsafe without a trusted proxy.
Attackers could spoof IP addresses or inject payloads via headers, influencing program behavior.
The AI-introduced vulnerability could have led to Local File Disclosure or Server-Side Request Forgery if the IP address had been used differently.

The Bottom Line

The incident underscores the risks of over-reliance on AI-generated code, which can introduce unexpected vulnerabilities even with code review. Organizations should implement thorough testing and validation processes, and avoid complacency when using AI-assisted coding tools. A recent study found that 62% of AI-generated code solutions contain design flaws or known security vulnerabilities. This highlights the need for developers to maintain a critical perspective and not blindly trust AI outputs, especially in security-sensitive contexts.

Relevant Terms

Honeypot: A security mechanism designed to lure attackers, detect, and study hacking attempts by simulating a vulnerable system or network.
Server-Side Request Forgery (SSRF): A vulnerability that allows an attacker to make requests from the server to unintended locations, potentially accessing sensitive data or internal systems.

Source: Bleeping Computer

ATM Hackers Face Deportation After Guilty Plea

Executive Summary

Two Venezuelan nationals will be deported from the U.S. after being convicted of conspiracy and computer crimes related to an ATM jackpotting scheme. The individuals targeted older ATMs, installing malware to dispense cash.

The Scheme

TTP 1: Remove ATM casing at nighttime.
TTP 2: Connect a laptop to install malware.
TTP 3: Overcome ATM security protocols to dispense cash.

The Players

Facilitators Arrested:Luz Granados, Johan Gonzalez-Jimenez

The Consequence

Outcome: Guilty pleas; Granados sentenced to time served, Gonzalez-Jimenez to 18 months.
Assets Seized/Forfeited: Granados ordered to pay $126,340, Gonzalez-Jimenez $285,100 in restitution.

Strategic Takeaway

This case highlights the continued effectiveness of ATM jackpotting attacks, especially against machines lacking updated security.

Relevant Terms

ATM Jackpotting: A cyber-physical attack where criminals force an ATM to dispense all of its cash by exploiting software vulnerabilities or gaining physical access.
Malware: Software that is intended to damage or disable computers and computer systems.

Source: Bleeping Computer