Microsoft has released an emergency out-of-band patch for CVE-2026-21509, a high-severity security feature bypass vulnerability in Microsoft Office. The zero-day flaw is confirmed to be actively exploited in targeted attacks and has been added to CISA's Known Exploited Vulnerabilities catalog.
Vulnerability Details
Affected Product: Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise
Identifier: CVE-2026-21509
CVSS Score: 7.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent; immediate patching or mitigation is required due to active exploitation.
Attack Vector: The vulnerability is exploited by convincing a user to open a specially crafted malicious Office file. This allows an attacker to bypass OLE mitigations designed to protect users from vulnerable COM/OLE controls. The Preview Pane is not an attack vector.
Ease of Exploit: Low complexity; requires user interaction but is not considered difficult to execute once the user opens the malicious file.
Action Plan
Immediate Action: Apply the out-of-band security updates. Office 2021 and later receive a service-side fix and require an application restart. Patches for Office 2016 and 2019 are pending and will be released as soon as possible.
Workaround: For systems where patches cannot be immediately applied (like Office 2016/2019), Microsoft advises making a Windows Registry change to block vulnerable COM/OLE controls.
Detection: Microsoft has not released specific Indicators of Compromise (IOCs). Detection should focus on identifying attempts to exploit COM/OLE controls and monitoring for the delivery of suspicious Office files.
Relevant professional terms
Zero-Day Vulnerability
A flaw in software or hardware that is unknown to the party responsible for patching it. Because the vendor is unaware, no patch exists, making attacks that use the zero-day exploit highly likely to succeed.
Security Feature Bypass
A vulnerability that allows an attacker to circumvent a security control or mechanism that is in place to protect a system or data. In this case, the flaw allows bypassing OLE mitigations.
Project Zero Discloses WhatsApp Group Chat Vulnerability
Executive Summary
Google’s Project Zero has disclosed a zero-click vulnerability in WhatsApp for Android involving malicious media files in group chats. Attackers can add a target to a new group and send a malicious file that automatically downloads, serving as an attack vector without user interaction. Meta applied a partial server-side fix in November 2025 but is still working on a comprehensive solution.
Vulnerability Details
Affected Product: WhatsApp for Android
Disclosure Source: Google Project Zero (January 2026)
Exploitation Status: Likely to be used in targeted campaigns where the attacker knows the target's phone number.
Risk & Impact
Triage: High; requires configuration changes to mitigate fully until a final patch is released.
Attack Vector: "Zero-Click" Media Download. The user is added to a hostile group, and a malicious media file is pushed to their device storage automatically.
Ease of Exploit: Moderate complexity; requires the attacker to possess the target's phone number and successfully add them to a group.
Action Plan
Immediate Action:
Disable Auto-Download: Go to Settings > Storage and data > Media auto-download. Uncheck all media types (Photos, Audio, Videos, Documents) for Mobile Data, Wi-Fi, and Roaming.
Restrict Group Adds: Go to Settings > Privacy > Groups and change "Who can add me to groups" to "My contacts" or "My contacts except...".
Sandboxing: Go to Settings > Chats and turn off "Media visibility" to prevent WhatsApp media from leaking into the general Android gallery.
Relevant professional terms
Zero-Click Exploit
A highly sophisticated attack that requires no user interaction (such as clicking a link or opening a file) to compromise a device. In this case, the mere receipt and auto-download of a file triggers the threat.
Sandboxing
A security mechanism that separates running programs to prevent system failures or software vulnerabilities from spreading. Disabling "Media visibility" in WhatsApp helps enforce this by keeping media files isolated within the app's storage.
The World Leaks ransomware group has claimed a major data breach against Nike, publishing 1.4TB of allegedly stolen internal files. Nike has confirmed it is investigating the potential cybersecurity incident.
Attack Overview
Attack Path: The initial access vector has not been publicly disclosed, though rumors suggest it may have stemmed from vulnerabilities in Nike's supply chain.
Attacker: World Leaks (a rebrand of the Hunters International group).
Impact Assessment
Data Stolen: 1.4 TB of corporate data, including product schematics, design files, factory audits, and other strategic documents. No customer or employee PII appears to have been compromised.
Strategic Takeaway
This incident underscores a shift in extortion tactics, where attackers prioritize high-value intellectual property for exfiltration and public release over system encryption.
Relevant professional terms
Ransomware
Malicious software that threatens to publish a victim's data or perpetually block access to it unless a ransom is paid.
Data Exfiltration
The unauthorized copying, transfer, or retrieval of data from a computer or server.
The HoneyMyte (aka Mustang Panda) APT group has updated its CoolClient backdoor and is deploying multiple new browser data stealers in recent campaigns aimed at government and military organizations in Asia. The primary goal is espionage and exfiltration of sensitive information.
Key TTPs
Initial Access: Spear-phishing emails with malicious links or attachments, and the use of infected USB drives are common vectors.
Execution: Relies on DLL side-loading to execute malicious payloads from legitimate, signed binaries.
Defense Evasion: Employs kernel-mode rootkits to inject backdoors and protect malicious files, processes, and registry keys from detection.
Campaign Analysis
This campaign marks an evolution in HoneyMyte's tactics, incorporating updated backdoors and new stealer variants to enhance data exfiltration. The use of kernel-mode drivers signifies a focus on increased stealth and resilience against security tools.
Targeting & Infrastructure
Target Profile: Government, military, and non-governmental organizations (NGOs) across Southeast and East Asia, with specific activity noted in Myanmar and Thailand.
Relevant Terms
Backdoor: A type of malware that bypasses normal authentication to grant an attacker remote access and control over an infected system.
DLL Side-Loading: An attack technique where a legitimate application is tricked into loading a malicious DLL, allowing the malware to execute under a trusted process.
A new Malware-as-a-Service (MaaS) named 'Stanley' is being sold on Russian-language cybercrime forums, offering malicious Chrome extensions that are guaranteed to be published on the official Chrome Web Store. The service aims to facilitate phishing attacks by spoofing legitimate websites to steal user credentials and data.
Key TTPs
Initial Access: Malicious extension installed from the official Chrome Web Store.
Execution: Intercepts website visits and overlays a full-screen iframe containing a phishing page.
Defense Evasion: The browser's URL bar continues to display the legitimate domain, deceiving the user. The service also uses backup domain rotation for C2 resilience.
Campaign Analysis
The Stanley MaaS significantly lowers the barrier for threat actors to conduct sophisticated phishing campaigns by shifting the risk of bypassing Google's review process to the service provider. This model enables the widespread distribution of credential-harvesting malware through a trusted channel, increasing threats to both individuals and organizations.
Targeting & Infrastructure
Target Profile: General users of Chrome, Edge, and Brave browsers.
Infrastructure: A MaaS toolkit sold on cybercrime forums with a web-based management panel for operators.
Relevant Terms
Malware-as-a-Service (MaaS): A business model where cybercriminals rent or buy malware and its supporting infrastructure from a provider, making it easier to launch attacks.
Iframe (Inline Frame): An HTML element used to embed another document within the current web page. In this attack, it's used to overlay a malicious phishing page on top of a legitimate site.
A Cloudflare policy misconfiguration led to a significant Border Gateway Protocol (BGP) route leak, disrupting IPv6 traffic for 25 minutes and causing substantial data loss.
Key Findings
The incident was a BGP route leak affecting IPv6 traffic.
Disruptions, including congestion and packet loss, lasted for 25 minutes.
The leak resulted in approximately 12 Gbps of dropped traffic.
The Bottom Line
This incident underscores the fragility of core internet infrastructure, where a single configuration error at a major provider can have immediate, widespread consequences. It highlights the critical need for automated safeguards and rigorous change management protocols to prevent human error from causing significant network disruptions.
Relevant Terms
BGP (Border Gateway Protocol): The protocol that manages how data is routed across the internet by exchanging reachability information between different networks (Autonomous Systems).
Route Leak: An event where a network incorrectly advertises routes, causing traffic to be misdirected through unintended paths, often leading to congestion or data loss.
The UK High Court ordered Saudi Arabia to pay over £3 million in damages to Ghanem Al-Masarir, a London-based satirist. The court found the kingdom responsible for hacking his phones with Pegasus spyware and orchestrating a physical assault against him in London.
The Scheme
TTP 1: Deployed NSO Group's Pegasus spyware to infect the target's iPhones, enabling total device monitoring.
TTP 2: Used infected text messages mimicking legitimate entities to deliver the spyware payload.
TTP 3: Conducted physical surveillance and a planned assault on the target in a foreign country.
The Players
Threat Actor: Kingdom of Saudi Arabia (KSA)
The Consequence
Outcome: The High Court entered a summary judgment against Saudi Arabia after it failed to provide a defense.
Assets Seized/Forfeited: £3,025,662 awarded in damages
Strategic Takeaway
This ruling sets a significant legal precedent, affirming that state immunity does not protect foreign governments from civil liability for cyberattacks and physical intimidation on UK soil.
Relevant Terms
Pegasus Spyware: A powerful surveillance tool for mobile devices, developed by NSO Group, that can access all data on an infected phone.
State Immunity: A legal principle that typically shields a sovereign state from being sued in the courts of another country.
