The Hacker News

⚠️ A previously unseen backdoor called Dohdoor is being deployed against U.S. schools and healthcare orgs. Tracked as UAT-10027, the campaign chains phishing → PowerShell loaders → DLL side-loading → DoH C2 (via Cloudflare) → final Cobalt Strike payload. 🔗 Details → https://thehackernews.com/2026/02/uat-10027-targets-us-education-and.html

Visibility empowers teams to see everything. Actionability empowers teams to do anything. That's the foundation of The 2026 Actionability Report, new research from Axonius and the Ponemon Institute. They're shifting the conversation from the "Visibility Gap" to the "Actionability Opportunity." Because here's what the data shows: 📊 45% of organizations consolidate assets—but only 1/3 keep inventories current 📊 51% lose critical context during remediation when it matters most 📊 37% remain stuck in manual workflows despite the AI revolution The most effective security programs aren't just collecting more data. They're building systems that turn exposure intel into decisive execution. Download the full report: https://thn.news/axonius-actionability

Attackers are breaking in faster and hiding better than before. ⚡ 4-min breakout 🖥️ ActiveMQ → LockBit 🧩 Crash-to-command Chrome 📦 WinRAR wide exposure 🔐 723K weak crypto defaults 📢 Google Ads cloaking 💬 Teams → macOS malware 🧪 AI smart contract benchmark 🌍 Judicial Rust RAT 🔗 Full ThreatsDay Bulletin live: https://thehackernews.com/2026/02/threatsday-bulletin-kali-linux-claude.html

Attackers are stealing encrypted data under a “Harvest Now, Decrypt Later” strategy. Store it now. Decrypt it when quantum machines mature, possibly between 2030 and 2035. Security Navigator 2026 outlines a five-step PQC migration plan and breach data. 🔗 Read → https://thehackernews.com/2026/02/expert-recommends-prepare-for-pqc-right.html

⚠️ Microsoft says fake Next.js job repos are being used to gain persistent access to developer machines. Opening a VS Code project or running npm run dev can trigger hidden loaders that pull JavaScript into memory, profile the host, and connect to C2. GitLab banned 131 linked accounts and tracked heavy abuse of Vercel. 🔗 Read → https://thehackernews.com/2026/02/fake-nextjs-repos-target-developers.html

🚨 Cisco is warning of active exploitation of a CVSS 10.0 flaw in Catalyst SD-WAN controllers. CVE-2026-20127 lets unauthenticated attackers bypass auth and gain admin access. Exploitation tied to UAT-8616 dates back to 2023, including rogue peers in the control plane and root escalation. 🔗 Read → https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html

🛡️ Google exposes China-linked UNC2814 for breaching 53 orgs across 42 countries. They used GRIDTIDE to hide C2 in Google Sheets, moved with stolen service accounts, and persisted via systemd. Google has nuked 🔥 the attacker’s infrastructure. 🔗 Read: https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html

🛑 Researchers found 3 vulnerabilities in Anthropic’s #ClaudeCode allowing remote code execution and API key theft. Simply opening a malicious repo could trigger commands or leak credentials before trust prompts appeared. 🔗 Read details here: https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html

👨🏻‍💻 SOC triage usually relies on guesswork, driving up risk. @anyrun_app changes that: its interactive sandbox reveals the full attack chain in ~60 seconds for 90% of cases. The result? 21 minutes shaved off MTTR and 30% fewer escalations to Tier 2. 🔗 See execution-based triage in action: https://thehackernews.com/2026/02/top-5-ways-broken-triage-increases.html

🎙️💰 Cybercriminals linked to Scattered LAPSUS$ Hunters are paying women $500–$1,000 per call to do vishing attacks. They supply scripts, target IT help desks to reset passwords, bypass MFA & drop remote tools. 🔗 Help desk attack chain → https://thehackernews.com/2026/02/slh-offers-5001000-per-call-to-recruit.html

AI agents aren't taking over humanity… yet. But they are accessing your corporate data in ways you probably can't see. The Model Context Protocol (MCP) is unlocking agentic AI, and your employees are already using it to connect AI tools to SaaS apps—working smarter and faster with tools they already know. But each MCP connection creates a new data highway with expansive permissions and scopes. Which is why Nudge Security built automatic discovery for risky MCP connections. Now you can see: • Which MCP server connections exist in your environment • Which apps and data they're accessing Their full permissions and scopes • With clear visibility into every connection, you can stay ahead of emerging risks and start governing your agent workforce. Learn more about AI governance with Nudge: https://thn.news/nudge-ai-risk

🚨 Over 50,000 npm and 4,500 NuGet users were hit by malicious packages before they were pulled. The NuGet attack rewrote ASP_NET authorization for instant admin access, while the npm variant used preinstall hooks to deploy OS-specific malware and exfiltrate data. 🔗 Read → https://thehackernews.com/2026/02/malicious-nuget-packages-stole-aspnet.html