Daily Security Briefing #160

February 9, 2026 | Read Online

Critical RCE Vulnerability, UNC1069 Targets Cryptocurrency Sector, AI-Driven Threats Evolving & More…

Executive Summary

Today’s cybersecurity landscape is marked by a critical vulnerability in BeyondTrust’s Remote Support and Privileged Remote Access products. The threat actor UNC1069 continues to target the cryptocurrency sector with advanced social engineering tactics. Meanwhile, AI-driven threats are evolving rapidly, with large language models becoming increasingly effective at discovering vulnerabilities. Additionally, various organizations have fallen victim to cyberattacks, including the European Commission, which successfully contained a recent incident.

Top Articles

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering

North Korean threat actors continue to evolve their tactics by targeting the cryptocurrency sector. A recent investigation revealed a tailored intrusion resulting in the deployment of seven unique malware families. The threat actor UNC1069 is active since at least 2018 and has been attributed to various financially motivated attacks. Cloud Google | BleepingComputer

CVE-2026-1731: Critical Unauthenticated Remote Code Execution in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

A critical pre-authentication RCE vulnerability affects BeyondTrust’s Remote Support and Privileged Remote Access products. The flaw allows unauthenticated remote attackers to execute arbitrary OS commands with site user context. Assigned CVE-2026-1731, this vulnerability has a near-maximum CVSSv4 score of 9.9. Rapid7 | BleepingComputer

LLMs are Getting a Lot Better and Faster at Finding and Exploiting Zero-Days

Large language models (LLMs) like Opus 4.6 are becoming increasingly effective at discovering high-severity vulnerabilities. Security teams have been automating vulnerability discovery for years, but these AI-powered tools can find bugs out of the box without task-specific tooling or custom scaffolding. Schneier on Security

Vulnerability Found in InsightVM & Nexpose: CVE-2026-1814 (FIXED)

A vulnerability was discovered in Rapid7’s InsightVM and Nexpose, impacting its vulnerability management offerings. A fix has been identified and will be delivered via a Security Console product update with no customer action required. The update is currently being released through the normal gradual release cycle. Rapid7

From Solo to Squad: The Evolution of Cyber Security Training in the AI Era

Generative AI is transforming cyber defense, requiring collective intelligence from the organization’s SOC. A shift from individual courses to team-based subscriptions has been observed, signaling a new approach to workforce development in the age of AI. Checkpoint

Criminal IP Integrates with IBM QRadar to Deliver Real-Time Threat Intelligence Across SIEM and SOAR

Criminal IP has integrated its AI-powered threat intelligence platform with IBM QRadar, bringing external, IP-based threat intelligence directly into the detection, investigation, and response workflows. This enables security teams to identify malicious activity faster. GBHackers

European Commission Mitigates Cyberattack Aimed at Employee Mobile Information

The European Commission successfully contained a cyberattack targeting its mobile device management infrastructure on January 30, 2026. The incident exposed staff names and mobile numbers but was neutralized within nine hours of detection. GBHackers

China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage Campaign

The China-nexus cyber espionage group known as UNC3886 targeted the telecommunications sector in Singapore. The campaign was deliberate, targeted, and well-planned, with all four major operators impacted. The Hacker News

Hackers Exploit SolarWinds WHD Flaws to Deploy DFIR Tool in Attacks

Threat actors are now exploiting SolarWinds Web Help Desk vulnerabilities to gain code execution rights and deploy legitimate tools for persistence and remote control. BleepingComputer

EU Officials Respond After Cyber-Attack Exposes European Commission Mobile Devices

The European Commission quickly contained a cyberattack on its central mobile infrastructure, preventing major damage to staff data. The incident exposed the names and mobile numbers of some staff members but was swiftly detected and responded to. CyberPress

SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers

Microsoft revealed a multi-stage intrusion that involved threat actors exploiting SolarWinds Web Help Desk instances to obtain initial access and move laterally across the network. The activity weaponized recently, but it’s unclear whether the vulnerability was used in attacks. The Hacker News

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.