Here’s your Cybersecurity Newsletter
- Jan 28
- 3 min read
January 2026 with key global incidents, vulnerabilities, trends, industry news, and learning resources — all backed by linked sources you can click through:
Top Cybersecurity Incidents & Vulnerabilities
Microsoft Office Zero-Day Actively Exploited
Microsoft released an emergency fix for a high-severity zero-day vulnerability (CVE-2026-21509) in Office that’s being actively exploited in the wild. This bypasses key security controls and can lead to remote code execution if a user opens a crafted file — attackers are already using it in targeted attacks globally. Admins must patch immediately.
Fortinet FortiCloud SSO Bypass Zero-Day
Fortinet disclosed a critical authentication bypass flaw (CVE-2026-24858) affecting FortiCloud SSO that allowed unauthenticated administrative access to FortiGate and related device families. The issue was actively exploited in January and forced Fortinet to disable and later reconfigure SSO management.
Automated FortiGate Attacks Alter Firewalls
Security researchers report automated attacks exploiting FortiGate/ FortiCloud configurations to change administrative firewall settings — highlighting the risk of cloud-managed device vulnerabilities and the importance of monitoring configuration drift.
Malicious VS Code Extensions Steal Developer Data
The “MaliciousCorgi” campaign inserted two AI-style extensions into the VS Code Marketplace that stole files and developer data from ~1.5 million installs, underscoring supply chain risks in developer tools.
Belgian Hospital Cyberattack Disrupts Operations
The AZ Monica hospital in Antwerp suffered a major cyberattack, forcing system shutdowns and cancellation of surgeries due to IT outages. This case drew attention to the consequences of cyber incidents on critical health services.
Breach & Credential Theft Alerts
SoundCloud Data Exposure — ~30 Million Affected
SoundCloud confirmed a significant data breach affecting ~29.8 million users’ personal information, including emails and account details — a reminder that consumer platforms remain attractive targets.
ownCloud Credential Theft Warning
ownCloud identified a widespread credential-theft campaign targeting self-hosted file-sharing instances. Users are urged to enable MFA and review logs for unusual access.
Patch & Security Advisory Highlights
Microsoft Patch Tuesday — 100+ Fixes
Microsoft’s January update addressed over 100 vulnerabilities, including several actively exploited zero-days and critical remote code execution flaws, reflecting how fast attackers are weaponizing new weaknesses.
Trend Reports & Strategic Insights
Top Cybersecurity Trends for 2026
INE Security released its “Top 5 Cybersecurity Trends for 2026”, highlighting:
Escalation of AI-powered attacks and defenses
Identity security as the core attack surface
Zero Trust as a comprehensive strategy
Ransomware becoming faster and more disruptive
Cross-trained teams essential for resilience Organizations must rethink silos and focus on coordinated defense.
Notable Industry & Community Updates
Data Privacy Week 2026
The National Cybersecurity Alliance launched Data Privacy Week (Jan 26–30, 2026), promoting education on data privacy and responsible practices for individuals and organizations.
Privacy & Cybersecurity Legal Bulletin
Legal teams in North America and the EU published their January privacy and cybersecurity updates, covering regulatory changes and compliance considerations — a valuable resource for governance teams.
Community & Research Highlights
Ransomware Trends: Threat intelligence teams continue tracking ransomware activity globally, noting persistent targeting across industries including healthcare, manufacturing, and professional services.
Cyber Workforce Signals: Weekly job board data reflects strong demand for cybersecurity roles — defense managers, incident responders, and senior engineers — indicating expanded security operations hiring worldwide.
AI-Risk Discussions: Industry analysts underscore that AI-related vulnerabilities and risks are now among the fastest-growing concerns for 2026, with organizations wrestling with both promise and peril of AI in security.
Key Takeaways & Actions
Patch Now Ensure emergency patches — especially for Microsoft Office and Fortinet devices — are applied without delay.
Strengthen Identity Controls Enable multi-factor authentication everywhere, especially on cloud, file-sharing, and admin portals.
Vet Developer Tools Audit extensions, packages, and tools from public repositories to reduce supply chain attack exposure.
Embrace Cross-Team Security Invest in training and cross-domain collaboration — defenders need combined system, identity, and incident-response skills.
Educate & Prepare Participate in initiatives like Data Privacy Week to improve awareness across users and teams.
Comments