In today’s cybersecurity news…

Tesla hacked at Pwn2Own Automotive

Security researchers at Pwn2Own Automotive 2026 demonstrated 37 zero-day exploits across EV chargers and infotainment systems, earning $516,500 in day-one awards. Synacktiv gained root access on Tesla’s Infotainment System via chained flaws. Teams also compromised chargers from Alpitronic, Autel, ChargePoint, and others. Vendors have 90 days to develop and release security fixes before TrendMicro’s Zero Day Initiative publicly discloses them. (BleepingComputer)

Everest sitting on Under Armour data?

The Everest ransomware group allegedly stole data from 72.7 million Under Armour customer accounts in November, then posted it online on January 18th. This includes names, emails, dates of birth, genders, locations, and purchase history, with claims that phone numbers, addresses, loyalty details, and preferred stores were also exposed. Everest, active since 2020, uses double extortion, network access sales, and insider recruitment to generate revenue while keeping a low profile. (The Register)

PurpleBravo fake job campaign targeted IP addresses

Recorded Future’s Insikt Group says North Korea-linked “PurpleBravo” used fake developer job interviews to target 3,136 IP addresses and 20 organizations across AI, crypto, financial services, IT, and software sectors from August 2024 to September 2025. Candidates were tricked into running malicious code during coding tests on company devices, exposing employers and creating supply-chain risk. Insikt Group links the activity to the broader “Contagious Interview” cluster and notes overlap with North Korean IT-worker espionage and financial theft operations. (The Hacker News)

TikTok Canada can continue to operate

A federal court has overturned the Canadian government’s 2024 order to shutter TikTok Canada’s business operations over national security concerns, letting the company keep its offices open while the Industry Minister reconsiders the case. TikTok Canada says keeping its team in place preserves hundreds of jobs and ongoing investment. The wind-down order wouldn’t have banned the app for the more than 14 million Canadians who use it, but would have forced the company to exit its Canadian business footprint. (Politico)

Huge thanks to our sponsor, Dropzone AI

Fortinet reports patched FortiGate firewalls hacked

Admins running FortiGate firewalls report that attackers are still exploiting the FortiCloud vulnerability, which started back in December, by using a patch bypass. Fortinet devs appear to have confirmed that version 7.4.10 didn’t fully fix the flaw and are preparing further updates. CISA listed the bug as actively exploited and told agencies to patch within a week. Shadowserver recently counted more than 11,000 devices still exposed online. (BleepingComputer)

Phishing and spoofed sites are Olympics entry points

Palo Alto Networks reports that phishing and spoofed websites remain the top entry points for attackers targeting the Milano-Cortina 2026 Winter Games..highlighting how criminal groups, state-backed actors, and hacktivists exploit large sporting events, drawing on prior Olympics: WiFi disruptions at Pyeongchang 2018, Russian-linked interference before Tokyo 2021, and phishing and DDoS spikes at Paris 2024. Business email compromise is said to drive 76% of observed phishing attacks, while ransomware gangs, espionage actors, and hacktivists target ticketing, payments, and event systems. (Infosecurity Magazine)

LastPass ‘create backup’ link deemed a scam

A phishing campaign is spoofing LastPass maintenance notices and urging users to “create backup” within 24 hours in order to steal master passwords. Clicking the link sends victims to a fake LastPass site designed to harvest vault credentials. LastPass issued an advisory saying it never asks users to back up vaults or reveal master passwords and listed malicious domains and indicators. The company has not responded to questions from The Register about how many customers received or fell for the scam. (The Register)

Chainlit bugs let hackers breach cloud environments

Two critical vulnerabilities in the Chainlit AI framework, dubbed ‘ChainLeak’, can let attackers read any file on a server and exfiltrate internal data. One allows arbitrary file reads via the /project/element endpoint, the other is an SSRF flaw affecting SQLAlchemy-backed deployments. Together, they allow full-system compromise and lateral movement in cloud environments. Zafran Labs reported the issues back in November; they were fixed in Chainlit 2.9.4 on December 24th, and organizations are urged to upgrade immediately. (BleepingComputer)