Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: security

Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks.

ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills. It’s an extension to the OpenClaw project, a self-hosted artificial intelligence (AI) assistant formerly known as both Clawdbot and Moltbot.

The analysis, which Koi conducted with the help of an OpenClaw bot named Alex, found that 335 skills use fake pre-requisites to install an Apple macOS stealer named Atomic Stealer (AMOS). This activity set has been codenamed ClawHavoc.

OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link

A high-severity security flaw has been disclosed in OpenClaw (formerly referred to as Clawdbot and Moltbot) that could allow remote code execution (RCE) through a crafted malicious link.

The issue, which is tracked as CVE-2026–25253 (CVSS score: 8.8), has been addressed in version 2026.1.29 released on January 30, 2026. It has been described as a token exfiltration vulnerability that leads to full gateway compromise.

“The Control UI trusts gatewayUrl from the query string without validation and auto-connects on load, sending the stored gateway token in the WebSocket connect payload,” OpenClaw’s creator and maintainer Peter Steinberger said in an advisory.

Russian hackers exploit recently patched Microsoft Office bug in attacks

Ukraine’s Computer Emergency Response Team (CERT) says that Russian hackers are exploiting CVE-2026–21509, a recently patched vulnerability in multiple versions of Microsoft Office.

On January 26, Microsoft released an emergency out-of-band security update marking CVE-2026–21509 as an actively exploited zero-day flaw.

CERT-UA detected the distribution of malicious DOC files exploiting the flaw, themed around EU COREPER consultations in Ukraine, just three days after Microsoft’s alert.

New study unveils ultra-high sensitivity broadband flexible photodetectors

A research team, affiliated with UNIST, has unveiled a flexible photodetector, capable of converting light across a broad spectrum—from visible to near-infrared—into electrical signals. This innovation promises significant advancements in technologies that require simultaneous detection of object colors and internal structures or materials.

Led by Professor Changduk Yang from the Department of Energy & Chemical Engineering, the research team developed perovskite-organic heterojunction photodetectors (POH-PDs) that combine high sensitivity with exceptional accuracy in the near-infrared (NIR) region. The findings have been published in Advanced Functional Materials.

Photodetectors are essential components in numerous applications, including smartphone displays that automatically adjust brightness and security systems that utilize vein recognition.

A Breakthrough That Cuts Blockchain Delays Nearly in Half

The idea of a fully connected digital world is quickly becoming real through the Internet of Things (IoT). This expanding network includes physical devices such as small sensors, autonomous vehicles, and industrial machines that collect and exchange data online.

Protecting this data from tampering is essential, which has led engineers to explore blockchain as a security solution. Although blockchain is widely known for its role in cryptocurrencies, its core function is as a decentralized digital ledger. Instead of data being controlled by a single organization, information is shared and maintained across many computers.

Microsoft links Windows 11 boot failures to failed December 2025 update

Microsoft has linked recent reports of Windows 11 boot failures after installing the January 2026 updates to previously failed attempts to install the December 2025 security update, which left systems in an “improper state.”

The boot failures were first reported earlier this month after users installed the January 2026 Patch Tuesday cumulative update, KB5074109, on Windows 11 versions 25H2 and 24H2.

After installing the update, impacted systems failed to start and displayed a BSOD crash screen with a stop error of “UNMOUNTABLE_BOOT_VOLUME” code.

Researchers Show AI Robots Vulnerable to Text Attacks

“I expect vision-language models to play a major role in future embodied AI systems,” said Dr. Alvaro Cardenas.

How can misleading texts negatively affect AI behavior? This is what a recently submitted study hopes to address as a team of researchers from the University of California, Santa Cruz and Johns Hopkins University investigated the potential security risks of embodied AI, which is AI fixed in a physical body that uses observations to adapt to its environment, as opposed to using text and data, and include cars and robots. This study has the potential to help scientists, engineers, and the public better understand the risks for AI and the steps to take to mitigate them.

For the study, the researchers introduced CHAI (Command Hijacking against embodied AI), which is designed to combat outside threats to embodied AI systems, including misleading text and imagery. Instead, CHAI employs counterattacks that embodied Ais can use to disseminate right from wrong regarding text and images. The researchers tested CHAI on a variety of AI-based systems, including drone emergency landing, autonomous driving, aerial object tracking, and robotic vehicles. In the end, the researchers discovered that CHAI successfully identified incoming attacks while emphasizing the need for enhancing security measures for embodied AI.

New sandbox escape flaw exposes n8n instances to RCE attacks

Two vulnerabilities in the n8n workflow automation platform could allow attackers to fully compromise affected instances, access sensitive data, and execute arbitrary code on the underlying host.

Identified as CVE-2026–1470 and CVE-2026–0863, the vulnerabilities were discovered and reported by researchers at DevSecOps company JFrog.

Despite requiring authentication, CVE-2026–1470 received a critical severity score of 9.9 out of 10. JFrog explained that the critical rating was due to arbitrary code execution occurring in n8n’s main node, which allows complete control over the n8n instance.

/* */