Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
Cybersecurity researchers have discovered two malicious Google Chrome extensions with the same name and published by the same developer that come with capabilities to intercept traffic and capture user credentials. The extensions are advertised as a “multi-location network speed test plug-in” and, once users subscribe, route traffic from more than 170 domains through attacker-controlled infrastructure, enabling large-scale data exfiltration.
Source: The Hacker News

Microsoft Teams Strengthens Messaging Security by Default in January
Microsoft announced that Teams will automatically enable messaging safety features by default starting January 12, 2026, for tenants using default configurations. The update activates protections against weaponizable file types, malicious URLs, and introduces a system for reporting false positives, improving defenses against malicious content shared in chats.
Source: BleepingComputer

Ransomware Hits Romanian Water Authority, 1000 Systems Knocked Offline
Romania’s national water authority is recovering from a ransomware attack that began on December 20, 2025, impacting approximately 1,000 systems, including workstations, email services, and web servers. Authorities classify the incident as a national security concern due to the critical infrastructure role of water management.
Source: Hackread

Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances
A critical vulnerability tracked as CVE-2025-68613 has been disclosed in the n8n workflow automation platform. Under specific conditions, expressions supplied during workflow configuration may be evaluated in an insufficiently isolated execution context, potentially leading to arbitrary code execution.
Source: The Hacker News

Zero-Day Alert: Linksys Auth Bypass Lets Hackers Hijack Routers Without Passwords
Researchers disclosed a zero-day vulnerability (CVE-2025-52692) in the Linksys E9450-SG router that allows attackers on the local network to bypass authentication and gain full control of the device. The flaw enables activation of a hidden Telnet service without requiring a password, highlighting ongoing risks in consumer router security.
Source: Security Online