Good morning. This is your security briefing for Saturday, February 07, 2026, covering 15 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
S12 Dark Development published research on a technique for disabling Windows Protected Process Light security using a custom kernel driver that modifies the PS_PROTECTION field in the EPROCESS structure. The method allows attackers with kernel access to remove PPL protections from critical processes like LSASS and anti-malware services, enabling privilege escalation and credential theft.
S2W TALON reports that North Korean APT group ScarCruft has modified its ROKRAT malware distribution methods, shifting from LNK-based attacks to using OLE objects embedded in Hangul documents. The new approach deploys Dropper and Downloader malware that execute ROKRAT directly in memory, utilizing ROR13-based API resolving, XOR decryption, and C2 communication through legitimate cloud services like pCloud and Yandex.
According to research from yi-barrack, security researchers discovered a pre-authentication remote code execution vulnerability chain in TP-Link Omada ER605 VPN routers affecting firmware versions prior to 2.2.4. The exploit chains buffer overflow vulnerabilities in the cmxddnsd daemon to bypass ASLR and achieve root-level control, though TP-Link has patched these vulnerabilities in firmware version 2.2.4.
MrBruh's Epic Blog disclosed a Remote Code Execution vulnerability in AMD AutoUpdate software that allows attackers to perform man-in-the-middle attacks and replace legitimate executable downloads with malicious ones due to the use of HTTP and lack of validation. AMD has classified this as out of scope and will not provide a patch, leaving users vulnerable to complete system compromise.
WatchGuard Technologies announced an LDAP Injection vulnerability in Fireware OS versions 12.0 through 12.11.6 and 2025.1 through 2025.1.4. The vulnerability allows remote, unauthenticated attackers to retrieve sensitive information from connected LDAP authentication servers and potentially authenticate as valid users, with patches now available in versions 12.11.7, 12.5.16, and 2026.1.
Decalage2 reports that CVE-2026-21509 is a zero-day vulnerability in Microsoft Office that was exploited in the wild before patching on January 26, 2026. Attackers used specially crafted RTF documents containing Shell.Explorer.1 OLE objects to embed malicious LNK files that execute automatically via the legacy Internet Explorer engine, with defenders able to detect exploitation using YARA rules targeting the specific CLSID pattern.
Microsoft has released tools and guidance for organizations to update Secure Boot certificates before their expiration in June 2026. The updates are necessary to address the BlackLotus UEFI bootkit vulnerability and maintain boot process integrity, with organizations running Windows devices manufactured before 2024 needing to install updated 2023 certificates to prevent boot failures.
The Mysterium VPN research team identified approximately 4.96 million web servers exposing Git repository metadata due to misconfigurations, with the United States, Germany, and France most affected. Critically, 252,733 git config files contained deployment credentials providing unauthorized access, enabling attackers to perform repository takeovers, supply chain attacks, and lateral movement within cloud infrastructure.
Microsoft announced it is evolving its Secure Development Lifecycle to address AI-specific security challenges including expanded attack surfaces, collapsed trust boundaries, and novel attack vectors like prompt injection and data poisoning. The updated SDL framework targets developers, security professionals, and organizations building AI systems to mitigate risks from non-deterministic outputs, model exploits, and training data integrity issues.
Researchers at Ben Gurion University developed Peacock, a UEFI firmware runtime observability framework that monitors and detects bootkit activity before OS load. The system successfully detected known UEFI bootkits including BlackLotus, Glupteba, LoJax, and MosaicRegressor by logging firmware service calls with TPM-protected attestation and integrating telemetry into SIEM systems.
Black Lantern Security released MANSPIDER, an open-source tool designed to crawl SMB shares across networks to discover sensitive files through filename and content searches with regex support. The tool can extract data from multiple file formats including documents and images with OCR capabilities, presenting both a legitimate security assessment capability and a potential threat for unauthorized data discovery.
FuzzySecurity introduced Kahlo MCP, a Frida-based server that enables AI agents to autonomously perform Android dynamic instrumentation tasks. The tool allows AI systems to attach to processes, inject code, and collect data for security analysis, automating Android application security research and vulnerability discovery through AI-driven instrumentation.
The Windows Insider Program Team released Windows 11 Insider Preview Build 26220.7752 to the Beta Channel with native integration of Sysmon. The system monitoring tool captures detailed system events and logs them to Windows event log for security analysis, though it remains disabled by default and requires manual activation.
FalconForce discusses the implementation of near-real-time detection rules in cybersecurity environments to combat increasingly faster and sophisticated threat actors. The approach enables security teams to identify malicious activities as they occur, reducing adversary dwell time and representing a technical shift from traditional slower detection methods to real-time security telemetry processing.
Gyp the Cat describes the integration of external Kusto tables into Microsoft security platforms including Defender for Endpoint, Sentinel, and Azure Monitor to enrich threat intelligence data. These tables include threat feed sources like ASN data, blocklist.de, Spamhaus, Tor exit nodes, and geo IP information that can be queried using KQL to enhance threat detection and analysis capabilities.
That concludes today's briefing.