* Nearly 800,000 Telnet Servers Exposed Globally as Critical Authentication Bypass Vulnerability Faces Active Exploitation

* JavaScript Package Managers Vulnerable to Supply Chain Attacks Despite npm’s Shai-Hulud Security Measures

* WhatsApp Launches Strict Account Settings to Shield High-Risk Users From Advanced Spyware Attacks

* Extortion Group WorldLeaks Claims 1.4 Terabyte Data Theft From Nike in Manufacturing-Focused Breach

* ShinyHunters Targets Approximately 100 Organisations in Okta Single Sign-On Credential Theft Campaign

Hey Everyone, for today’s Cyber Bites we’ll be covering stories about companies being compromised by their own security training tools, GitLab patching a two-factor authentication bypass, researchers saying that AI-powered browsers might be undoing years of web security progress, Zendesk support systems being turned into spam engines worldwide and a look at the popular passwords still being used in 2025.

* Fortune 500 Companies Compromised Through Vulnerable Security Testing Applications

* GitLab Releases Emergency Patches for Two-Factor Authentication Bypass and Denial-of-Service Vulnerabilities

* AI-Powered Browsers Reverse Decades of Web Security Advances, Researchers Warn

* Attackers Weaponise Zendesk Support Systems in Massive Global Spam Campaign

* Predictable Password Patterns Persist as Billions Continue Using Easily Cracked Credentials

Hey everyone, and welcome back to Cyber Bites! After a short three-week break, we’re kicking off 2026 with a fresh batch of cyber news. I hope you had a good break and your new year’s off to a safe and secure start.

* FBI Warns of North Korean Hackers Using Malicious QR Codes in Spear-Phishing Attacks

* WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging

* Notorious BreachForums Hacking Site Hit by Data Breach, Over 324,000 Accounts Exposed

* Instagram Denies Data Breach Amid Claims of 17 Million Account Data Leak

* Thousands of New Zealanders Impacted by Manage My Health Data Breach