Table of Contents
Weekly Summary: In the first week of February 2026, global cybersecurity developments included the active exploitation of a Microsoft Office zero-day (CVE-2026-21509) soon after its emergency patch release. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing urgent patching. Additionally, the Kimwolf Android botnet has grown to millions of infected devices, and a critical vulnerability in the n8n workflow automation platform has been disclosed.
🔴 Critical Vulnerability Alerts
1. Microsoft Office Zero-Day (CVE-2026-21509)
- Severity: High (CVSS 7.8)
- Disclosure Date: 26 Jan 2026
- A high-severity security feature bypass in Microsoft Office allows specially crafted documents to bypass OLE protections, leading to code execution when opened. It has been confirmed to be actively exploited in the wild.
- Affected Products: Office 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps.
- In the Wild: Ukrainian CERT reports observed targeted attacks against government entities using malicious DOC files.
- Mitigation: Apply the emergency patches or recommended mitigations immediately.
2. CISA Adds Known Exploited Vulnerabilities
- CISA added five vulnerabilities to the KEV catalog on 26 Jan 2026, reflecting evidence of active exploitation, including CVE-2026-21509.
3. n8n Workflow Automation Critical Flaw (CVE-2026-21858)
- Severity: Critical (CVSS 10.0)
- A content-type confusion vulnerability in the n8n platform allows unauthenticated attackers to take over vulnerable instances.
🌍 Global Threat Landscape
Android Kimwolf Botnet Expansion
- The Kimwolf botnet has infected approximately 2 million Android devices through pre-installed malware on smart TVs and streaming boxes, generating massive DDoS traffic.
🛠️ GitHub Trending Security Tools
Ghost-II
- A cloud-native API shadow discovery tool designed to map APIs using passive traffic analysis and Swagger/OpenAPI scanning.
Deep-Phish-Detector
- An AI-based phishing defense browser plugin with new quishing (QR phishing) detection capability.
📊 Security Observations
- Urgent patching for actively exploited Office zero-day CVE-2026-21509 remains critical.
- The scale of Android device compromises underscores the continuing risks in IoT and embedded platforms.
About Lingtian Lab
We are dedicated to providing the latest cybersecurity intelligence and automated solutions. Standing with you against the threats of the AI era.
Sources: US-CERT, The Hacker News, GitHub Trending (Security).