Oktacron - Cyber Security RSS Feeds History

Critical Security Flaws Discovered in Four VS Code Extensions Affecting Millions

cyberexpress Feb 19, 2026 Firewall Daily

Researchers have uncovered vulnerabilities in four widely used VS Code extensions, collectively installed more than 125 million times, raising renewed concerns about the security of the modern software development supply chain. The affected extensions, Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft show more ...

Live Preview, integrate directly into the Microsoft Visual Studio Code IDE, a development environment relied upon by millions of programmers worldwide. The findings were disclosed by OX Security researchers, who warned that the risks extend far beyond individual developer machines. “Our research demonstrates that a hacker needs only one malicious extension, or a single vulnerability within one extension, to perform lateral movement and compromise entire organizations,” they said in a report detailing the flaws. According to Bustan and Zadok, development environments represent a critical weakness in enterprise defenses. “IDEs are the weakest link in an organization’s supply chain security, and extensions are often a blind spot for security teams. Developers store their most sensitive information, business logic, API keys, database configurations, environment variables, and sometimes even customer data, on their local file systems, all accessible through the IDE.” High-Risk VS Code Extensions Expose Millions of IDE Installations The research team identified vulnerabilities in four popular VS Code extensions, findings that were later confirmed on Cursor and Windsurf. Three of the flaws were assigned Common Vulnerabilities and Exposures (CVE) identifiers: CVE-2025-65717: Live Server – CVSS score of 9.1 – more than 72 million downloads – Remote file exfiltration – All versions affected CVE-2025-65715: Code Runner – CVSS score of 7.8 – more than 37 million downloads – Remote code execution – All versions affected CVE-2025-65716: Markdown Preview Enhanced – CVSS score of 8.8 – more than 8.5 million downloads – JavaScript code execution leading to local port scanning with potential data exfiltration – All versions affected A fourth issue impacted Microsoft Live Preview, which has over 11 million downloads. No CVE was issued for this flaw. Researchers described it as a “One-Click XSS to full IDE files exfiltration” vulnerability. The issue was fixed in version 0.4.16 and later, though no CVE identifier was assigned, and the researchers stated they did not receive proper credit. Altogether, the three CVE-tracked vulnerabilities account for more than 120 million downloads. Including Microsoft Live Preview, the total exposure surpasses 128 million installations. Why IDE Extensions Are a Weak Link in the Software Supply Chain Extensions inside an IDE operate with extensive privileges. They can read and modify files, execute code, and interact with local servers. While these capabilities improve productivity, they also expand the attack surface. Poorly written, overly permissive, or malicious VS Code extensions can allow attackers to execute arbitrary code, extract sensitive data, or take control of a developer’s system. The researchers emphasized that keeping vulnerable extensions installed presents an immediate threat to organizational security posture. In some scenarios, exploitation could require nothing more than opening a malicious HTML file while a localhost server is running or downloading a compromised repository. Because development machines often connect to internal systems, a single compromised IDE could enable lateral movement across corporate networks, amplifying the impact across the broader supply chain. The potential consequences outlined in the report include: Lateral movement within connected networks. Data exfiltration and system takeover when exploited on a development machine running a localhost server. Exposure of sensitive assets such as API keys, database credentials, proprietary code, and configuration files. Given the central role developers play in building and maintaining applications, a breach originating from vulnerable VS Code extensions can ripple outward, affecting production systems and customers. Responsible Disclosure Raises Questions The researchers disclosed the three CVE-tracked vulnerabilities in July and August 2025. According to the team, none of the maintainers responded to their outreach. They reported attempting contact through direct email, GitHub pages, and social networks, but received no response. The lack of engagement highlights what the researchers describe as a systemic issue: no clear accountability framework for extension security and no enforceable requirements for timely remediation. Without structured oversight, organizations remain dependent on individual maintainers to address flaws in widely adopted VS Code extensions that directly impact supply chain security. To mitigate risk, the researchers advised developers to avoid opening untrusted HTML files while localhost servers are running and to refrain from operating unnecessary local servers. They also cautioned against applying untrusted configurations, particularly snippets pasted into global settings.json files from emails, chats, or unverified sources. Organizations should limit extension-related exposure by installing only trusted extensions, monitoring or backing up settings.json files to detect unexpected changes, disabling non-essential tools, hardening local networks with properly configured firewalls, and maintaining a rigorous update schedule for the IDE, extensions, operating systems, and development dependencies.

Mozilla Firefox Issues Emergency Patch for Heap Buffer Overflow in Firefox v147

cyberexpress Feb 19, 2026 Firewall Daily

Mozilla has released an out-of-band security update to address a critical vulnerability affecting its browser. The update, issued as Firefox v147.0.4, resolves a high-impact Heap buffer overflow flaw in the libvpx video codec library. The issue is tracked under CVE-2026-2447 and was identified by security show more ...

researcher jayjayjazz. Although some users initially referenced Firefox v147 in discussions of the flaw, the patched build is officially version 147.0.4. Alongside this release, Mozilla also pushed updates for its Extended Support Release (ESR) channels: Firefox ESR 140.7.1 and Firefox ESR 115.32.1. The coordinated rollout reflects the seriousness of the vulnerability and its potential exposure across supported platforms. Details of the Heap Buffer Overflow Vulnerability CVE-2026-2447 CVE-2026-2447 is classified as a Heap buffer overflow vulnerability in the libvpx library, which Firefox relies on to process VP8 and VP9 video formats. These codecs are widely used for web-based multimedia content. A Heap buffer overflow occurs when software writes data beyond the bounds of allocated memory in the heap, the area of memory reserved for dynamic operations during runtime. When this happens, adjacent memory regions may be overwritten. In practical terms, attackers can exploit such behavior by supplying malformed or oversized input, such as specially crafted video data. If successful, the exploit can lead to arbitrary code execution, browser crashes, or even full system compromise. In the case of CVE-2026-2447, malicious actors could embed exploit payloads within seemingly legitimate media streams or web pages. A victim might only need to visit a compromised or malicious website or open rigged video content for the Heap buffer overflow to be triggered. Because Firefox v147 and earlier affected builds handle video decoding automatically, exploitation could occur without obvious warning signs beyond routine browsing activity. Mozilla classified CVE-2026-2447 as “high” severity. The advisory notes that the vulnerability carries a high impact rating, although a CVSS score was not listed at the time of disclosure. Affected and Patched Versions Mozilla confirmed the following version details: Firefox versions earlier than 147.0.4 are vulnerable; the issue is fixed in 147.0.4. Firefox ESR versions earlier than 140.7.1 are vulnerable; the issue is fixed in 140.7.1. Firefox ESR versions earlier than 115.32.1 are vulnerable; the issue is fixed in 115.32.1. Users running Firefox v147 prior to the 147.0.4 patch are advised to update immediately. Enterprises maintaining ESR branches should prioritize deployment, as ESR editions are often used in managed corporate environments where delayed patching can increase exposure. Exploitation Risk and Broader Context At the time of disclosure, there were no confirmed reports of widespread exploitation in the wild. However, security experts note that Heap buffer overflow flaws are frequently targeted due to their reliability and potential for remote code execution. Because CVE-2026-2447 can be triggered remotely through malicious web content, it presents an attractive vector for drive-by attacks. The libvpx library plays a central role in multimedia-heavy browsing sessions. As web platforms rely on embedded video and streaming formats such as VP8 and VP9, vulnerabilities in codec handling can have broad consequences. Past campaigns have highlighted how similar memory corruption flaws in media processing components can be weaponized quickly after public disclosure. Update Guidance Mozilla recommends that users update through the browser’s built-in mechanism by navigating to Help > About Firefox, which automatically checks for and installs updates. Alternatively, fresh installers can be obtained from Mozilla’s official website. Systems administrators overseeing ESR deployments should ensure that Firefox v147 environments and corresponding ESR branches are patched without delay. The release of Firefox v147.0.4 highlights the ongoing need for timely patch management. CVE-2026-2447, rooted in a Heap buffer overflow within libvpx, highlights how low-level memory handling issues can cascade into high-severity security threats when embedded in widely used software.

First Android Malware Weaponizes Gemini AI to Evade Detection, Maintain Persistence

cyberexpress Feb 19, 2026 Cyber News

ESET researchers discovered PromptSpy, the first known Android malware to integrate generative AI directly into its execution flow, marking a new evolution in mobile threats that leverage artificial intelligence for context-aware user interface manipulation. The malware prompts Google's Gemini to analyze current show more ...

screen layouts and provide step-by-step instructions for keeping itself locked in Android's recent apps list, preventing users from easily closing or killing the malicious process. PromptSpy represents the first deployment of generative AI for UI automation in malicious applications. The discovery follows ESET's August 2025 identification of PromptLock, the first known AI-powered ransomware, demonstrating accelerating criminal adoption of generative AI capabilities. The malware primarily targets users in Argentina through financial fraud campaigns. ESET shared findings with Google, and Android users with Google Play Services are automatically protected through Play Protect, which blocks known versions. However, PromptSpy never appeared on Google Play, instead distributing through dedicated phishing websites impersonating Chase Bank. PromptSpy's AI implementation remains narrowly focused—Gemini handles only the persistence mechanism while traditional techniques power the core functionality. Yet the integration demonstrates how generative AI enables malware to adapt across device manufacturers, operating system versions and user interface variations that would break traditional hardcoded screen automation. Also read: New Android Malware Locks Device Screens and Demands a Ransom Android malware typically relies on fixed coordinates or UI element identifiers that fragment across Samsung's One UI, Xiaomi's MIUI, OnePlus' OxygenOS and dozens of other manufacturer customizations. The "lock app in recent apps" gesture varies significantly between devices, making automation through traditional scripts nearly impossible without maintaining separate codebases for each manufacturer. PromptSpy sidesteps this complexity by sending Gemini natural language prompts alongside XML dumps capturing the complete UI hierarchy—every element's text, type, class name and exact screen coordinates. Gemini processes this contextual snapshot and returns JSON-formatted instructions specifying precise actions and coordinates for the malware to execute through Android's Accessibility Services. The system maintains conversation history, allowing Gemini to understand multi-step interactions. PromptSpy continues prompting until the AI confirms successful app locking, creating a feedback loop where malware waits for validation before proceeding. This represents fundamentally different architecture from traditional malware's rigid if-then logic. The malware's core payload deploys a VNC module granting attackers remote access to compromised devices. PromptSpy communicates with its command-and-control server at 54.67.2.84 using VNC protocol with AES-encrypted messages. Through this channel, attackers can receive Gemini API keys, upload installed app lists, intercept lockscreen credentials, capture pattern unlock screens as video, report screen status and foreground applications, record screens for specified apps and capture screenshots on demand. Distribution occurred through mgardownload[.]com, which redirected victims to m-mgarg[.]com—a phishing site impersonating Chase Bank with Spanish language login prompts. Google's cache revealed the site used branding nearly identical to legitimate Chase interfaces. The malware itself uses the app name "MorganArg" with Chase-inspired iconography, suggesting "Morgan Argentina" as shorthand targeting the region. Analysis revealed the dropper contains embedded simplified Chinese debug strings and disabled code handling various Chinese Accessibility event types. ESET assesses with medium confidence that PromptSpy was developed in a Chinese-speaking environment, though campaigns target Argentina specifically. Once installed, PromptSpy requests Accessibility Services permissions—a powerful Android capability allowing apps to read screen content and perform automated interactions. The malware displays a loading screen while background processes communicate with Gemini, gathering UI analysis and executing the locking gesture. The AI conversation follows a structured pattern. Initial prompts provide detailed instructions: "You are an Android automation assistant. The user will give you the UI XML data of the current screen. You need to analyze the XML and output operation instructions in JSON format to achieve the user's goal." The prompt explicitly warns against guessing task completion, requiring visual confirmation before declaring success. Gemini responds with action instructions including tap coordinates, swipe gestures and navigation commands. PromptSpy executes these through Accessibility Services, then returns updated screen state for the next iteration. This continues until Gemini confirms the malware achieved its persistence goal. PromptSpy also weaponizes Accessibility Services for anti-removal protection. When users attempt uninstallation or disabling Accessibility Services, the malware overlays invisible rectangles over critical buttons containing substrings like "stop," "end," "clear" and "Uninstall." These transparent overlays intercept user interactions, making removal nearly impossible through normal means. The only reliable removal method requires booting into Safe Mode, where third-party apps are disabled. Users typically access Safe Mode by long-pressing the power button, then long-pressing "Power off" and confirming "Reboot to Safe Mode." Once restarted, Settings → Apps → MorganArg allows clean uninstallation without malware interference. ESET has not observed PromptSpy in telemetry data, suggesting it may remain a proof-of-concept. However, the existence of distribution domains and companion phishing applications indicates at least limited deployment targeting Argentina. The researchers discovered a related phishing trojan (Android/Phishing.Agent.M) signed with identical developer certificates, functioning as a potential initial stage leading victims toward PromptSpy installation. Traditional malware detection focuses on known malicious behaviors or signatures. PromptSpy's use of legitimate cloud AI services for automation creates detection challenges since the malicious logic exists partially in prompts rather than compiled code.

AI Has Entered Schools—But What About Its Responsible Use?

cyberexpress Feb 19, 2026 Cyber Essentials

On the third day of the India AI Impact Summit 2026, global leaders gathered to explore how AI in education can move beyond pilot programs toward widespread classroom adoption. The session, titled “AI and Education: From Innovation to Impact,” hosted in collaboration with the Estonian Embassy, focused on the show more ...

responsible, ethical, and equitable deployment of AI in public education. While AI tools are already present in schools, experts emphasized that their success depends on empowering teachers, fostering inclusive learning, and building trust through ethical implementation—not simply on technology itself. Trends of AI Adoption in Classrooms The adoption of AI in education is accelerating worldwide. Industry estimates predict that the AI in education market will grow at a CAGR of 37.2% between 2024 and 2032. Today, 60% of educators have integrated AI into classrooms, with 44% using AI for research purposes. Educational games powered by AI are also gaining popularity, with 51% of teachers using these tools more than other AI applications. Despite growing adoption, challenges remain. 65% of teachers cite plagiarism in essays as a concern, while public perception is divided: 33% of adults in the U.S. believe AI adoption has negatively impacted education, compared to 32% who see positive outcomes. Nonetheless, 60% of teachers believe AI use in classrooms will expand significantly in the next decade, signaling a long-term commitment to integrating AI responsibly. AI in Education: Responsible and Equitable Scaling of AI Alar Karis, President of the Republic of Estonia, stressed the importance of education in making AI effective. “AI has already arrived in our schools, students and teachers are using it on a daily basis. The question, therefore, is not whether AI is to be used, but whether it is being used knowingly, critically, and responsibly by everyone. In this AI era, it is not how smart machines are that matters most, but how smart the people who use them are. Education is the key to this, and in Estonia we are bringing AI into schools and education with a dedicated policy at speed and scale.” President Karis also emphasized the role of AI literacy in democratic participation. “We are working as per policy to make sure that the majority of the population of Estonia gain basic AI tools’ knowledge and half at least intermediate to international level AI skills. Our AI push in education will focus on serving the learning, just like our digital AI in governance helps us serve people better. Above all, AI education needs to be transparent and ethical; this will generate trust, which will lead to willingness to learn.” Teachers at the Heart of Ethical AI Mary N. Kerema, OGW Secretary ICT, E-Government and Digital Economy, Republic of Kenya, underlined that teachers are central to successful AI adoption. “We have realised that without embracing technology, we will be left behind. But the most stable and capable infrastructure in education is the teacher. You may have limited connectivity and limited devices, but you will always find a teacher in the classroom. That is why AI training for teachers must come first. If we empower the teacher, then there will be clear ethical AI use, because it all starts in the classroom.” Dr. Pia Rebello Britto, Global Director of Education at UNICEF, emphasized that AI must strengthen public education rather than bypass it. “In most lower/middle income countries, almost 70% of 10-year-olds cannot read or understand a simple text. Hundreds of millions of children are at risk of being left behind due to enormous progress in technologies like AI. When we speak about AI and education, we have to talk not about marginal gains. We have to talk about how innovation can reverse structural inequity. What creates equity is an ecosystem that supports teachers, protects children, and is accountable to public systems.” Learning Outcomes Over Automation Professor Petri Myllymäki of the Finnish Center for Artificial Intelligence highlighted the need to prioritize learning. “When ChatGPT was launched, there was panic. Everyone thought that AI will write all the essays and students will learn nothing. But we realised that outsourcing essays was always possible; it just became easier. The point of education is not to produce another essay in the world, it is to learn something in the process. By all means, use AI tools, but make sure learning happens.” Ivo Visak, CEO of AI LEAP, Estonia, added that public trust and structured pedagogy are crucial. “It is not only the Ministry of Education and Research concern; it is a whole nation's question. We have Estonian companies supporting the initiative, and there is general public trust toward such programs. If you have trust, people will follow. But you cannot break that trust; you have to deliver. That is why we have a strong pedagogical plan behind it, which is supported by technology, not a technological program supported by pedagogy.” 2026: A Year of Implementation The panel concluded that 2026 must be a year of action for AI in education, with coordinated national strategies, teacher-centric capacity building, interoperable digital infrastructure, and strong public governance. With growing adoption and a booming market, the focus is clear: AI should empower teachers, protect learners, and drive equitable learning outcomes. As global leaders emphasized, AI in education is not just about technology—it is about people, pedagogy, and trust. How effectively these elements are combined will determine whether AI becomes a transformative force in classrooms worldwide or a tool that deepens existing gaps.

Advantest Cyberattack Triggers Ransomware Investigation Across Internal Network

cyberexpress Feb 19, 2026 Firewall Daily

Advantest Corporation has confirmed that it is responding to a cybersecurity incident that may have affected portions of its internal network. The company, listed on the Tokyo Stock Exchange, disclosed the cyberattack in an official statement today, noting that the situation remains under active investigation and show more ...

that details could change as new information emerges. The Advantest cyberattack was first detected on February 15, when the company identified unusual activity within its IT environment. Upon discovering the suspicious activity, Advantest immediately activated its incident response protocols. The affected systems were isolated, and leading third-party cybersecurity experts were engaged to assist with the investigation and containment efforts. Investigations into the Advantest Cyberattack According to preliminary findings, an unauthorized third party may have gained access to portions of the company’s network and deployed ransomware. While the full scope of the Advantest cyberattack has not yet been determined, investigators are working to establish how the intrusion occurred and what systems were compromised. The company shared the incident in an official press release. Koichi Tsukui, Representative Director, Senior Executive Officer, and President, Group COO, shared the details about the Advantest cyberattack, stating that the information in the report remains subject to change if new facts are confirmed as the investigation continues. Unauthorized Network Access, Entry Point of Advantest Cyberattack According to the statements, Advantest indicated that current findings “appear to indicate that an unauthorized third party may have gained access to portions of Advantest’s network and deployed ransomware.” The investigation remains ongoing and is being conducted in close collaboration with external cybersecurity specialists. As part of the response, the company emphasized that it is working to understand the full extent of the incident while reinforcing all possible defenses. If it determines that customer or employee data was affected, the company said it will notify impacted individuals directly and provide guidance on protective measures. At this stage, no definitive conclusions have been announced regarding whether sensitive information was accessed or exfiltrated. The company has committed to transparency and stated that it will provide regular updates through its official news page. Advantest Cybersecurity Review Beyond technical containment, the company is also reviewing the potential business implications of the Advantest cyberattack. Under the section titled “Impact on business performance,” the press release states that the financial effect of the incident is currently under examination. Should it be determined that the cybersecurity incident will have a material impact on future financial performance, Advantest has pledged to make a prompt announcement. For now, the assessment is ongoing. The Advantest cybersecurity incident highlights the persistent risks facing global semiconductor and technology companies. As investigations continue, the company remains focused on containment, forensic analysis, and strengthening its security posture to mitigate future threats. This is an ongoing story, and The Cyber Express will be closely monitoring the situation. We'll update this post once we have more information on the attack or any additional updates or respones from the company.

Phishing via Google Tasks | Kaspersky official blog

kaspersky Feb 19, 2026 Business

We’ve written time and again about phishing schemes where attackers exploit various legitimate servers to deliver emails. If they manage to hijack someone’s SharePoint server, they’ll use that; if not, they’ll settle for sending notifications through a free service like GetShared. However, Google’s vast show more ...

ecosystem of services holds a special place in the hearts of scammers, and this time Google Tasks is the star of the show. As per usual, the main goal of this trick is to bypass email filters by piggybacking the rock-solid reputation of the middleman being exploited. What phishing via Google Tasks looks like The recipient gets a legitimate notification from an @google.com address with the message: “You have a new task”. Essentially, the attackers are trying to give the victim the impression that the company has started using Google’s task tracker, and as a result they need to immediately follow a link to fill out an employee verification form. To deprive the recipient of any time to actually think about whether this is necessary, the task usually includes a tight deadline and is marked with high priority. Upon clicking the link within the task, the victim is presented with an URL leading to a form where they must enter their corporate credentials to “confirm their employee status”. These credentials, of course, are the ultimate goal of the phishing attack. How to protect employee credentials from phishing Of course, employees should be warned about the existence of this scheme — for instance, by sharing a link to our collection of posts on the red flags of phishing. But in reality, the issue isn’t with any one specific service — it’s about the overall cybersecurity culture within a company. Workflow processes need to be clearly defined so that every employee understands which tools the company actually uses and which it doesn’t. It might make sense to maintain a public corporate document listing authorized services and the people or departments responsible for them. This gives employees a way to verify if that invitation, task, or notification is the real deal. Additionally, it never hurts to remind everyone that corporate credentials should only be entered on internal corporate resources. To automate the training process and keep your team up to speed on modern cyberthreats, you can use a dedicated tool like the Kaspersky Automated Security Awareness Platform. Beyond that, as usual, we recommend minimizing the number of potentially dangerous emails hitting employee inboxes by using a specialized mail gateway security solution. It’s also vital to equip all web-connected workstations with security software. Even if an attacker manages to trick an employee, the security product will block the attempt to visit the phishing site — preventing corporate credentials from leaking in the first place.

Supply Chain Attack Secretly Installs OpenClaw for Cline Users

darkreading Feb 19, 2026 Feed

The malicious version of Cline's npm package — 2.3.0 — was downloaded more than 4,000 times before it was removed.

Best-in-Class 'Starkiller' Phishing Kit Bypasses MFA

darkreading Feb 19, 2026 Feed

A user-friendly PhaaS tool beats standard methods for detecting phishing attacks by live-proxying legitimate login sites.

Abu Dhabi Finance Week Exposed VIP Passport Details

darkreading Feb 19, 2026 Feed

Unprotected cloud data sends the wrong signal at a time when the emirate's trying to attract investors and establish itself as a global financial center.

Connected and Compromised: When IoT Devices Turn Into Threats

darkreading Feb 19, 2026 Feed

Reused passwords, a lack of network segmentation, and poor sanitization processes make the Internet of Things' attack surfaces more dangerous.

More Than 40% of South Africans Were Scammed in 2025

darkreading Feb 19, 2026 Feed

Survey underscores the reality that scammers follow "scalable opportunities and low friction," rather than rich targets that tend to be better protected.

UK to require tech firms to remove nonconsensual intimate images within 48 hours or face fines

cyware Feb 19, 2026 News

U.K. Prime Minister Keir Starmer announced a new law that will require tech companies to remove intimate images shared without consent within two days or face large fines and potentially have their services blocked.

Ransomware gang threatens Cheyenne and Arapaho Tribes after shutting down schools

cyware Feb 19, 2026 News

The government of the Cheyenne and Arapaho Tribes in Oklahoma is being extorted by cybercriminals after a ransomware attack shut down its schools and critical systems in January.

Attackers breach France’s national bank account database

cyware Feb 19, 2026 Cybercrime

A spokesperson for the French government said potentially 1.2 million accounts were impacted by the incident.

FBI: More than 700 ATM jackpotting incidents with losses over $20 million occurred in 2025

cyware Feb 19, 2026 Cybercrime

In a flash alert on Thursday, the FBI said it has tracked more than 1,900 ATM jackpotting incidents since 2020 and over 700 in 2025 that involved more than $20 million in losses.

Researchers warn Volt Typhoon still embedded in US utilities and some breaches may never be found

cyware Feb 19, 2026 Cybercrime

Dragos's Rob Lee said Volt Typhoon is "still very active, and they're still absolutely mapping out and getting into embedding in U.S. infrastructure, as well as across our allies.”

West Virginia sues Apple for alleged child sexual abuse material failures

cyware Feb 19, 2026 News

West Virginia sued Apple for allegedly allowing iCloud to be used to disseminate and store child sexual abuse content.