[{"data":1,"prerenderedAt":203},["ShallowReactive",2],{"publication:en:D202601":3},{"meta":4,"copy":18,"relatedArticles":158,"terms":195,"term":196,"resourceParent":197,"glossaryParent":200},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202601","\u002Fblog\u002Fvulnerability-digest-2026-01","article","Website vulnerability digest for January 2026","Cybersecurity digest for January 2026","January 2026: vulnerabilities, breaches and cyber incidents","January 2026 security digest: software vulnerabilities, incidents involving Betterment and Manage My Health, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fcare","\u002Fblog\u002Fvulnerability-digest-2026-02","2026-02-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":120,"checklist":121,"faq":124,"sources":134,"links":142,"cta":153},"January's selection covers OpenSSL message parsing, Node.js HTTP\u002F2 availability and token handling in curl. A website may depend on these components through mail processing, an application runtime or an API integration. Start by identifying which of those paths exists in your hosting environment. The issue also covers incidents involving Betterment and Manage My Health, with the reported impact and checks relevant to a business using similar services.",[21,45,54,66,78,97,106,115],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-01-01 to 2026-01-31. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for January 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41],[34,35,36],"2026-01-27","OpenSSL | CVE-2025-15467","3.6.1 \u002F 3.5.5 \u002F 3.4.4 \u002F 3.3.6 \u002F 3.0.19",[38,39,40],"2026-01-13","Node.js | CVE-2025-59465","20.20.0 \u002F 22.22.0 \u002F 24.13.0 \u002F 25.3.0",[42,43,44],"2026-01-07","curl | CVE-2025-14524","8.18.0 \u002F 8.16.1 \u002F 8.14.2",{"title":46,"paragraphs":47,"sources":50},"OpenSSL: CMS message parsing (CVE-2025-15467)",[48,49],"A crafted CMS message using AEAD encryption can overflow a stack buffer, causing a crash or potentially code execution. This concerns applications parsing untrusted CMS or PKCS#7 content, including some S\u002FMIME workflows. Ordinary TLS use alone does not establish that this parser is exposed.","Identify mail or document services that parse these formats. Confirm the library loaded by each service and its distributor patch revision before scheduling a restart.",[51],{"label":52,"url":53},"CVE-2025-15467 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2025-15467",{"title":55,"paragraphs":56,"sources":59},"Node.js: HTTP\u002F2 process crashes (CVE-2025-59465)",[57,58],"Malformed HTTP\u002F2 headers can trigger an unhandled socket error and terminate the Node.js process. The January notice covers the then-active 20, 22, 24 and 25 branches. Exposure depends on where HTTP\u002F2 terminates and how secure-socket errors are handled.","Check whether the runtime or a reverse proxy accepts HTTP\u002F2. Deploy a currently supported patched runtime and test API availability and application restarts.",[60,63],{"label":61,"url":62},"node january","https:\u002F\u002Fnodejs.org\u002Fen\u002Fblog\u002Fvulnerability\u002Fdecember-2025-security-releases",{"label":64,"url":65},"CVE-2025-59465 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2025-59465",{"title":67,"paragraphs":68,"sources":71},"curl: bearer tokens across protocol redirects (CVE-2025-14524)",[69,70],"An HTTP request carrying an OAuth2 bearer token can leak it when redirected to an IMAP, LDAP, POP3 or SMTP URL. The curl advisory was published in January although the CVE identifier starts with 2025. Fixes also exist in the listed older maintenance branches.","Review redirect policies in API clients and identify the embedded libcurl version. Test a normal authorized API request after updating; assess token rotation if logs show an unexpected destination.",[72,75],{"label":73,"url":74},"curl advisory CVE-2025-14524","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2025-14524.html",{"label":76,"url":77},"CVE-2025-14524 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2025-14524",{"title":79,"paragraphs":80,"table":82},"Breaches and cyber incidents reported this month",[81],"These cases were publicly reported during January 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":83,"headers":84,"rows":88},"Incident notices: January 2026",[85,86,87],"Organization","Public notice","Incident",[89,93],[90,91,92],"Betterment","2026-01-09","Unauthorized account access",[94,95,96],"Manage My Health","2026-01-01","Information exposure",{"title":98,"paragraphs":99,"sources":102},"Betterment: fraudulent messages through a marketing platform (2026-01-09)",[100,101],"On 2026-01-09, Betterment reported an unauthorized crypto promotion sent through a third-party communications system. Its January 12 update attributed access to social engineering and identified exposure of some customer contact information; it reported no compromise of customer accounts or passwords.","For a business using mailing and push services, review who can send campaigns and export contacts. Require separate approval for financial promotions and keep a way to revoke the provider's sessions and access tokens.",[103],{"label":104,"url":105},"Betterment: incident notice","https:\u002F\u002Fwww.betterment.com\u002Fcustomer-update",{"title":107,"paragraphs":108,"sources":111},"Manage My Health: a document breach disclosed in January (2026-01-01)",[109,110],"Manage My Health's January 2 notice records discovery on 2025-12-30 and its first public statement on 2026-01-01. The initial investigation concerned a group of patient documents; it had found no evidence of access to user credentials or the core patient database.","Check document storage permissions separately from account login controls. Inventory exported medical or identity files, limit access to staff who need them and preserve access logs for an incident review.",[112],{"label":113,"url":114},"Manage My Health: incident notice","https:\u002F\u002Fmanagemyhealth.co.nz\u002Fmmh-cyber-breach-update-january-2026\u002F",{"title":116,"paragraphs":117},"Coverage and editorial record",[118,119],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[49,58,70,122,123],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[125,128,131],{"question":126,"answer":127},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":129,"answer":130},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":132,"answer":133},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[135,136,137,138,139,140,141],{"label":52,"url":53},{"label":61,"url":62},{"label":64,"url":65},{"label":73,"url":74},{"label":76,"url":77},{"label":104,"url":105},{"label":113,"url":114},[143,145,148,151],{"path":15,"label":144},"Next issue: February 2026",{"path":146,"label":147},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":149,"label":150},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":152},"All articles",{"title":154,"description":155,"button":156,"type":157},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[159,171,179,186],{"id":160,"path":15,"title":161,"description":162,"category":163,"artwork":164,"order":165,"publishedOn":166,"period":167,"related":168},"D202602","Cybersecurity digest for February 2026","February 2026 security digest: software vulnerabilities, incidents involving Odido and BridgePay, sources and practical checks for businesses.","digest","vulnerability-digest",9,"2026-03-03","2026-02",[6,169,146,170],"\u002Fblog\u002Fvulnerability-digest-2026-03","\u002Fblog\u002Fwhy-website-updates-matter",{"id":172,"path":146,"title":173,"description":174,"category":175,"artwork":176,"order":177,"publishedOn":178},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":180,"path":170,"title":181,"description":182,"category":183,"artwork":183,"order":184,"publishedOn":185},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",{"id":187,"path":169,"title":188,"description":189,"category":163,"artwork":164,"order":190,"publishedOn":191,"period":192,"related":193},"D202603","Cybersecurity digest for March 2026","March 2026 security digest: software vulnerabilities, incidents involving Loblaw and Stryker, sources and practical checks for businesses.",8,"2026-04-03","2026-03",[15,194,146,170],"\u002Fblog\u002Fvulnerability-digest-2026-04",[],null,{"path":198,"label":199},"\u002Fresources","Website security resources and templates",{"path":201,"label":202},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058055]