Find what you’re looking for

Introducing Julius: Enhancing AI Security with LLM Service Fingerprinting

In January 2026, Praetorian released Julius, an open-source tool designed to identify and fingerprint Large Language Model (LLM) services across corporate networks. Julius enables security teams to detect various LLM services, such as Ollama, LiteLLM, and Open WebUI, by analyzing endpoints and extracting information about the models in use. This tool addresses the growing challenge of unmanaged and potentially insecure LLM deployments within organizations, which can be exploited by attackers for unauthorized access, data exfiltration, or lateral movement within networks. The release of Julius is particularly timely given the increasing integration of LLMs into enterprise environments and the associated security risks. Recent incidents have highlighted vulnerabilities in LLM applications, including prompt injection attacks and data leakage, underscoring the need for robust detection and monitoring tools like Julius to enhance organizational security postures.

ServiceNow's 'BodySnatcher' Vulnerability: A Wake-Up Call for AI Security

In October 2025, ServiceNow identified and patched a critical vulnerability, CVE-2025-12420, in its AI Platform. Dubbed 'BodySnatcher,' this flaw allowed unauthenticated attackers to impersonate legitimate users, potentially granting unauthorized access to sensitive enterprise data. The vulnerability affected components such as Now Assist AI Agents and the Virtual Agent API, with ServiceNow deploying security updates to hosted instances and providing patches for self-hosted customers. ([techradar.com](https://www.techradar.com/pro/security/servicenow-patches-critical-security-flaw-which-could-allow-user-impersonation?utm_source=openai)) This incident underscores the growing security challenges associated with AI-driven platforms. Organizations are urged to promptly apply security updates and review their AI system configurations to mitigate similar risks. ([techradar.com](https://www.techradar.com/pro/security/servicenow-patches-critical-security-flaw-which-could-allow-user-impersonation?utm_source=openai))

Critical Zero-Day Vulnerabilities in Ivanti EPMM Exploited

In January 2026, Ivanti disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) software, identified as CVE-2026-1281 and CVE-2026-1340, each with a CVSS score of 9.8. These code injection flaws allow unauthenticated remote attackers to execute arbitrary code on affected systems, potentially leading to unauthorized access to sensitive data and system configurations. Ivanti confirmed active exploitation of these vulnerabilities in a limited number of customer environments at the time of disclosure. ([crn.com](https://www.crn.com/news/security/2026/ivanti-critical-mobile-management-vulnerabilities-seeing-exploitation?utm_source=openai)) The exploitation of these vulnerabilities underscores the persistent threat posed by zero-day attacks targeting enterprise management systems. Organizations are urged to apply the available patches promptly to mitigate the risk of unauthorized access and potential data breaches. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ivanti-warns-of-two-epmm-flaws-exploited-in-zero-day-attacks/?utm_source=openai))

Sandworm's DynoWiper Targets Poland's Energy Sector in 2025 Cyberattack

In late December 2025, Poland's energy infrastructure was targeted by a cyberattack involving a data-wiping malware named DynoWiper. The attack aimed to disrupt operations at two combined heat and power plants and several renewable energy facilities. ESET researchers attributed the attack to the Russian state-sponsored group Sandworm, noting similarities to previous incidents involving the group. Fortunately, the malware was intercepted before causing any substantial damage, and no operational disruptions were reported. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors to critical infrastructure. The timing, coinciding with the tenth anniversary of Sandworm's first known assault on Ukraine’s power grid in 2015, highlights the group's continued focus on energy sector targets and disruptive operations. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai))

Critical Privilege Escalation Vulnerability Discovered in Iconics Suite

In early 2024, a security assessment revealed a vulnerability in the Iconics Suite, a SCADA system used across various industries. Tracked as CVE-2025-0921, this flaw allows local authenticated attackers to exploit privileged file system operations, potentially leading to a denial-of-service (DoS) condition by corrupting critical system binaries. The vulnerability affects all versions of GENESIS64, MC Works64, and GENESIS version 11.00. Mitsubishi Electric has released advisories detailing measures to address the issue. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/?utm_source=openai)) This incident underscores the critical importance of securing SCADA systems, especially given their role in industrial operations. The discovery of CVE-2025-0921 highlights the need for continuous security assessments and prompt application of vendor-released patches to mitigate potential threats.

Equifax 2017 Data Breach: Lessons in Cybersecurity

Between May and July 2017, Equifax, a major credit reporting agency, experienced a significant data breach due to unpatched vulnerabilities in their Apache Struts framework. Attackers exploited these weaknesses to access sensitive personal information, including names, Social Security numbers, birth dates, addresses, and, in some cases, driver's license numbers of approximately 147.9 million Americans. The breach also affected millions of individuals in the UK and Canada. Equifax discovered the intrusion on July 29, 2017, but did not publicly disclose it until September 7, 2017. The incident led to widespread criticism, legal actions, and regulatory scrutiny, culminating in a settlement of up to $700 million to address the fallout and implement corrective measures. ([en.wikipedia.org](https://en.wikipedia.org/wiki/2017_Equifax_data_breach?utm_source=openai)) This breach underscores the critical importance of timely software updates and robust cybersecurity practices. The exploitation of known vulnerabilities highlights the necessity for organizations to maintain vigilant patch management and comprehensive security protocols to protect sensitive consumer data.

Google's 2026 Disruption of IPIDEA Proxy Network

In January 2026, Google’s Threat Intelligence Group (GTIG) disrupted IPIDEA, a China-based residential proxy network that covertly enrolled millions of consumer devices into its infrastructure. By embedding malicious software development kits (SDKs) into various applications, IPIDEA transformed devices into proxy nodes without user consent, facilitating cybercriminal activities such as password spraying and unauthorized access to cloud environments. Google’s intervention, which included legal actions to seize control domains and collaboration with partners like Cloudflare and Lumen’s Black Lotus Labs, resulted in a significant reduction of IPIDEA’s operational capacity, removing millions of devices from the network. ([blog.google](https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/gtig-ipidea-disrupted/?utm_source=openai)) This incident underscores the escalating misuse of residential proxy networks by cybercriminals and state-sponsored actors. The proliferation of such networks highlights the urgent need for enhanced vigilance among developers and consumers regarding the integration and use of third-party SDKs, as well as the importance of industry-wide collaboration to dismantle malicious infrastructures.

Microsoft Announces Deprecation of NTLM Authentication Protocol

In June 2024, Microsoft announced the deprecation of the NTLM authentication protocol, ceasing its active development and urging organizations to transition to more secure alternatives like Kerberos. This decision was driven by NTLM's inherent security vulnerabilities, including susceptibility to relay attacks and lack of support for modern cryptographic methods. The deprecation process began in early 2025, with phased reductions in support throughout the year, aiming for complete removal by the end of 2027. Organizations relying on NTLM are advised to assess their authentication mechanisms and plan migrations to more secure protocols to mitigate potential security risks. ([threatdown.com](https://www.threatdown.com/blog/microsoft-calls-time-on-ntlm-so-should-you/?utm_source=openai)) The deprecation of NTLM underscores a broader industry shift towards enhancing authentication security. As cyber threats evolve, legacy protocols like NTLM become prime targets due to their known weaknesses. This move aligns with Microsoft's Secure Future Initiative, emphasizing the importance of adopting robust authentication methods to safeguard against emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2024/12/mitigating-ntlm-relay-attacks-by-default?utm_source=openai))

Bybit's 2025 Security Breach: A Deep Dive into the $1.4 Billion Ethereum Theft

In February 2025, Dubai-based cryptocurrency exchange Bybit suffered a significant security breach, resulting in the theft of approximately 401,000 Ethereum (ETH), valued at over $1.4 billion. The attackers exploited vulnerabilities in Bybit's multi-signature cold wallet system, facilitated by compromised infrastructure at Safe{Wallet}, a third-party provider. This incident stands as the largest cryptocurrency exchange hack to date. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Bybit?utm_source=openai)) The breach was attributed to the North Korean state-sponsored Lazarus Group, known for their sophisticated cyber operations targeting financial institutions. The stolen funds were laundered through various channels, including privacy-focused platforms, complicating recovery efforts. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Lazarus_Group?utm_source=openai))

Critical Ivanti EPMM Zero-Day Vulnerabilities Exploited in 2026

In January 2026, Ivanti disclosed two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in its Endpoint Manager Mobile (EPMM) platform, both with a CVSS score of 9.8. These code injection flaws allow unauthenticated remote code execution, enabling attackers to gain full control over affected systems. Exploitation in the wild has been confirmed, with a limited number of customers compromised prior to disclosure. The vulnerabilities affect EPMM versions up to 12.7.0.0, and Ivanti has released RPM patches to address them. Organizations are urged to apply these patches immediately and monitor for signs of compromise. ([ivanti.com](https://www.ivanti.com/blog/january-2026-epmm-security-update?utm_source=openai)) The inclusion of CVE-2026-1281 in CISA's Known Exploited Vulnerabilities catalog underscores the severity and active exploitation of these flaws. This incident highlights the ongoing threat posed by zero-day vulnerabilities in widely used enterprise solutions, emphasizing the need for proactive vulnerability management and rapid response strategies.

Critical Unauthenticated RCE Vulnerability in SmarterMail (CVE-2026-24423) Discovered

In January 2026, a critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-24423, was discovered in SmarterTools SmarterMail versions prior to build 9511. This flaw resided in the ConnectToHub API method, allowing attackers to direct the SmarterMail server to a malicious HTTP server that delivers harmful OS commands, which the vulnerable application would then execute. The vulnerability was independently identified by multiple researchers, including those from VulnCheck and CODE WHITE GmbH. SmarterTools addressed this issue by releasing build 9511 on January 15, 2026, which patches the vulnerability. Organizations using affected versions are strongly advised to update to the latest build to mitigate potential exploitation risks. ([vulncheck.com](https://www.vulncheck.com/blog/smartermail-connecttohub-rce-cve-2026-24423?utm_source=openai)) The discovery of CVE-2026-24423 underscores the persistent threat posed by unauthenticated RCE vulnerabilities in widely used software. Such vulnerabilities can lead to complete system compromise, data exfiltration, and service disruption. The incident highlights the critical importance of timely software updates and vigilant monitoring of security advisories to protect organizational infrastructure from emerging threats.

Google Engineer Convicted of AI Trade Secrets Theft for China Startup

In January 2026, former Google engineer Linwei Ding was convicted on seven counts of economic espionage and seven counts of theft of trade secrets. Between May 2022 and April 2023, Ding illicitly transferred over 2,000 confidential documents related to Google's AI technology to his personal Google Cloud account. These documents detailed proprietary information about Google's supercomputing data center infrastructure, including custom Tensor Processing Unit chips, Graphics Processing Unit systems, and the Cluster Management System software. During this period, Ding secretly affiliated with two China-based technology companies, including founding Shanghai Zhisuan Technologies Co., while still employed at Google. He employed deceptive tactics to conceal his activities, such as copying data into the Apple Notes application and converting them to PDFs before uploading them to his personal account. The scheme was uncovered when Google discovered Ding's public presentation in China to potential investors about his startup. This case underscores the persistent threat of insider threats and economic espionage, particularly in the competitive field of artificial intelligence. Organizations must remain vigilant in protecting their intellectual property and sensitive information from both internal and external threats. The incident highlights the importance of robust security measures and monitoring systems to detect and prevent unauthorized access and data exfiltration.