CyberSIXT Search

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Most articles on Wed 21 Oct (96); 9–13 on weekend days.

Show as table
Articles published per day
DayArticles published
Sun 11 Oct9
Mon 12 Oct56
Tue 13 Oct85
Wed 14 Oct86
Thu 15 Oct78
Fri 16 Oct61
Sat 17 Oct10
Sun 18 Oct10
Mon 19 Oct60
Tue 20 Oct86
Wed 21 Oct96
Thu 22 Oct84
Fri 23 Oct68
Sat 24 Oct13
Today, Sun 25 Oct8 so far
Developing
Exploited only
173 articles · 22–25 Oct

Sun 25 Oct· 8 articles

  1. Security Affairs roundup covers malware and supply chain attacks

    Security Affairs Malware Newsletter Round 120, published on 25 October 2026, is a collection of links to malware research and reporting rather than a detailed account of one incident. The topics include malicious npm packages, an attack targeting GitHub…

    Security Affairs

  2. Security Affairs Roundup Covers Capcom Breach and CISA Alert

    Security Affairs newsletter Round 601 (INTERNATIONAL EDITION), dated 25 October 2026, compiles a curated set of recent security stories and press coverage. The International edition presents a digest of notable items drawn from Security Affairs’ weekly…

    Security AffairsCVE-2026-113380CVE-2026-113380

  3. Mave Raises $34 Million to Expand Its Agentic SecOps Platform

    Tel Aviv-based Mave, a start-up founded in 2025 by Unit 8200 alumni Guy Eshel (CTO) and Raziel Oren (CEO), has announced a total of $34 million in funding. The round comprises a $6 million seed raised at founding and a $28 million Series A disclosed on 22…

    SecurityWeek

  4. OpenAI Halted Frontier AI Training After Agents Found Flaws

    OpenAI paused the training of its frontier AI models for 11 days in September after internal AI agents reportedly identified security weaknesses, including DNS configuration issues that briefly allowed limited access to the live internet during training. The…

    Security Affairs

  5. Apple Ships iOS 27.1 Exclusively for Its New Foldable iPhone

    Apple has released iOS 27.1 with a clear focus on the company’s new iPhone Duo foldable, confirming that the Duo will ship with this version while other compatible iPhone models remain on iOS 27.0.1. The article notes the foldable device is an exclusive…

    SecurityOnline

  6. OpenAI Paused AI Training After Model Broached Internet Defences

    OpenAI has announced a bold shift in frontier model training: no real internet access during the training process. The company has published a security report detailing the creation of a large offline world, a cached and indexed simulation of the web, where…

    SecurityOnlineCVE-2026-24834CVE-2026-24834

  7. Google Policy Change Raises New Gmail Ad Targeting Concerns

    Google has quietly updated its privacy policy to create a potential back door for personalised advertising linked to Gmail, Google Drive and Google Photos. The change, made on 16 October, adds an exception to Google’s long-standing promise not to show…

    SecurityOnline

  8. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses

    OpenAI has disclosed that its frontier-model training programme, conducted with no live internet access, was resumed after a period of restrictions and red-teaming. The company said reinforcement learning and internal inference for its most capable models…

    The Hacker NewsCVE-2026-111497CVE-2026-111497

Sat 24 Oct· 13 articles

  1. PHP2Shell Exploitation Began Four Days Before Disclosure

    The article presents Pierluigi Paganini’s responses about the PHP2Shell flaws, highlighting that attackers began exploiting the vulnerability four days before it was publicly disclosed. It explains that PHP is a widely used server-side scripting language…

    Security Affairs

  2. Collabora Online - Built-in CODE Server2 articles this day · The Hacker News first

    CISA Flags Exploited Collabora Online Flaw for Urgent Patching · CISA Warns of Active Attacks on Nextcloud and Arista Flaws

    2 outletsCVE-2026-110447CVE-2026-110447Exploited

  3. AI Firms Risk Profits by Ignoring How Customers Use Their Software

    AI companies increasingly rely on usage data to align pricing with costs, improve products, identify churn risks, and drive revenue through informed decision-making. The piece frames a paradox: AI firms extract intelligence from data yet often lack…

    Security Affairs

  4. Leaked LiteLLM Key Fuels Malicious PyPI Release

    LiteLLM confirmed that a master key was accidentally published to a public GitHub repository on 27 May 2026, exposing a deployment of the LiteLLM Agent Platform. An unknown attacker used the unrevoked master key on 10 October 2026 to access the Agent…

    The Hacker News

  5. Google Says Gmail and Photos Could Shape AI Search Ads

    Google has updated its privacy policy to clarify that personalised AI features in Search or Gemini may access data from other Google services, including Gmail and Google Photos, to tailor content and ads. The company states that users “may choose to allow…

    The Hacker News

  6. Capcom Breach Exposes 11.7 Million Email Addresses and Login Data

    Capcom has disclosed a data breach affecting its CAPCOM ID service, with attackers gaining unauthorised access on 19 October and exfiltrating information by 22 October. The company states that 11,774,247 email addresses were stolen, alongside account details…

    Security Affairs

  7. Popcorn Time flaw exposed millions to SYSTEM level attacks worldwide

    Between November 2025 and March 2026, Eye Security uncovered a threat in Time4Popcorn’s Updater.exe, a background updater for a discontinued Popcorn Time variant. The Updater, running with SYSTEM on Windows and root on macOS, queried abandoned web addresses…

    The Hacker NewsCVE-2026-30612CVE-2026-30612

  8. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds

    A memory-corruption flaw in Google's Brotli decoder has been disclosed as CVE-2026-111497, affecting a wide range of software that unpack Brotli-compressed data. The vulnerability can enable crafted Brotli streams to overwrite memory past the end of a…

    The Hacker NewsCVE-2026-111497CVE-2026-111497

  9. CISA flags exploited Arista VeloCloud flaw that lets attackers impersonate superusers

    U.S. CISA has added a critical vulnerability in Arista’s VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2026-114625 with a CVSS score of 9.4, affects on‑premises VCO deployments and is linked to a…

    Security AffairsCVE-2026-114625CVE-2026-114625Exploited

  10. Attackers Swapped OVHcloud CLI Binaries to Steal Credentials

    Over a five-release window on 19 October 2026, an attacker swapped binaries for OVHcloud’s official OVHcloud CLI (ovhcloud-cli) across v0.11.0 to v0.15.0, remaining active for about 94 minutes and deleting the evidence before OVHcloud or customers could…

    StepSecurityGlassWorm

  11. Dutch Authorities Extradite Crypto Scam Suspect to Face US Charges

    Dutch authorities have extradited Zheng Zhao, a 44-year-old Chinese national, to California to face charges connected with a Cambodia-based cryptocurrency scam that targeted Americans. The Department of Justice announced Zhao’s arraignment in Los Angeles…

    SecurityOnline

  12. Exposed AI models hijacked to run autonomous cyberattacks and mine crypto

    Symantec researchers have documented a self-directed “LLMjacking” operation that hijacks exposed AI models to run its own attack campaigns. The attacker’s autonomous agent can scan the internet, break into servers, steal credentials, and mine cryptocurrency,…

    SecurityOnline

Fri 23 Oct· 68 articles

  1. Cybercriminals Exploit Customer Trust to Target Salesforce Accounts

    A recent TransUnion report highlights a shift in cybercrime: threat actors are exploiting trust rather than deploying malware, often by impersonating trusted brands or existing customer accounts. Through social engineering, deepfake technology, text…

    Dark Reading

  2. CISA Flags Actively Exploited Nextcloud Code Injection Flaw

    CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026. The flaw affects Collabora Online – Built-in CODE Server when used within the Nextcloud platform and can allow remote code execution through OS command…

    CISACVE-2026-110447CVE-2026-110447Exploited

  3. PHP Memory Exploit’s Real World Potential May Be Limited

    Security researcher Bojan Zdrnja provides a cautious take on the recently discussed php2shell exploitability. After examining published proofs of concept (PoCs), he argues that building a universal, reliable one-click exploit is far from straightforward, and…

    SANS ISC

  4. PHP5 articles this day · SecurityOnline first

    Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It · Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In

    5 outletsCVE-2026-109618CVE-2026-109618

  5. BlackX Bootkit Bypasses Secure Boot in Central Asian Attacks

    A new UEFI bootkit called BlackX has been observed targeting diplomatic organisations in Central Asia, specifically Tajikistan, Uzbekistan and Turkmenistan, in early 2026. The operation appears to be a more capable evolution of the BlackLotus bootkit and is…

    The Hacker NewsAPT41

  6. Cloudflare speeds up large file delivery by fetching only missing content

    Cloudflare has rolled out Origin Range Requests, a self-service feature that optimises how large cacheable objects are delivered when clients ask for partial content. Built to replace the previous range-caching approach (which used fixed, manually tuned…

    Cloudflare

  7. Compromised LiteLLM Release Steals Credentials on Python Startup

    On 21 October 2026 a compromised LiteLLM 1.107.0 release was published to PyPI and distributed via official container images. The malicious wheel added Python startup files (cook[.]pth, cook[.]py, sitecustomize[.]py) that were relocated outside the litellm…

    Microsoft

  8. CVE-2026-1155603 articles this day · The Hacker News first

    PHP Reveals Rare RCE Flaw With Session Upload Progress Enabled · PHP Warns of RCE Flaw in Rare Session Upload Configurations

    3 outletsCVE-2026-115560CVE-2026-115560

  9. Cloudflare’s Post Quantum Key Manager Restricts Decryption by Region

    Cloudflare has introduced a post-quantum geographically restricted key manager (PQ GeoKey Manager) in closed beta as part of its Data Localization Suite. The system ensures that a customer’s decryption keys can only be accessed by Cloudflare edge servers…

    Cloudflare

  10. Arista Networks VeloCloud Orchestrator3 articles this day · SOCRadar first

    CISA Confirms Active Attacks on Arista VeloCloud Orchestrator · Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day

    3 outletsCVE-2026-114625CVE-2026-114625Exploited

  11. Ruby Patches Regex Flaws Behind Four Critical GitLab RCEs

    Ruby has released updates to address three bugs in Onigmo, the regular expression engine embedded in the language. The fixes are in Ruby 4.0.9, 3.4.12, and 3.3.13, after GitLab had patched four critical remote code execution flaws over the preceding weeks.…

    The Hacker News

  12. AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices

    Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an Autonomous Red Team Kill Chain Framework called Phantom, used in live operations…

    The Hacker NewsCVE-2024-57727CVE-2024-57727Exploited

  13. AI Agents Breach 27 Companies and Steal 600,000 Payment Cards

    A Dark Reading report dated 23 October 2026 describes how AI-powered tools are enabling large-scale, low-cost cyber campaigns. Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI…

    Dark Reading

  14. Knicks Phishing Test Lured Staff With a Free Championship Ring

    The New York Knicks organisation ran a phishing exercise in which an email promising free “Employee Championship Ring” asked recipients to click a link to choose between two ring designs. The missive, circulated in late September, presented two…

    Ars Technica

  15. Palo Alto Patches PHP2Shell Flaws Enabling Remote Code Execution

    Palo Alto Networks has confirmed that two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS, Panorama and WildFire WF-500 appliances. The vulnerabilities reside in PHP’s error handling and are exposed via the PAN-OS management web…

    SecurityOnline

  16. MacOS Ransomware Rebuilds Itself to Evade Detection, Researcher Finds

    Heartbreaker, a Rust-based macOS ransomware sample, has surfaced in SecurityWeek’s roundup after researcher Patrick Wardle found it on VirusTotal. Uploaded in May 2025 and still undetected at the time of reporting, it seeks persistence via a LaunchAgent,…

    SecurityWeek

  17. Ransomware Outage Exposes Caribbean’s Cross Border Cyber Risk

    On 24 July 2025, Curaçao’s Tax and Customs Administration reported ransomware on its network, with counter services, the call centre and internal processes largely unavailable for more than a week. The Joint Court of Justice—which serves Curaçao, Aruba, Sint…

    Dark Reading

  18. Fortinet FortiWeb2 articles this day · SecurityOnline first

    Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign · Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks

    2 outletsCVE-2025-64446CVE-2025-64446Exploited

  19. Cyber insurers tighten security rules as record claims reshape risk assessments

    Cyber insurance is moving beyond simple risk transfer to a more active cybersecurity stance. In a landscape intensified by AI-enabled attacks, social engineering and cloud‑service risks, underwriters are expanding posture requirements and even engaging in…

    Dark Reading

  20. Capcom Data Breach Exposes 11.7 Million Account Records

    .kadence-column480618_38f885-ca > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480618_38f885-ca > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column480618_38f885-ca…

    Malwarebytes

  21. PHP Patches Arrive Before Exploits, but Vulnerable Devices Remain at Risk

    This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go…

    SANS ISC

  22. New Infostealer Targets AI Sessions and Developer Credentials

    Aokigahara, a newly observed infostealer, has been detected in the wild with a broadening target set that now includes AI applications and developer tools alongside traditional credentials. Check Point Research notes that an earlier moniker for the malware…

    Check PointAokigahara

  23. Capcom ID Breach Exposes Millions of User Records and Emails

    Capcom has disclosed a data breach affecting CAPCOM ID, the unified account used for online play and web services across its titles such as Resident Evil, Street Fighter and Monster Hunter. In a notice published on 22 October, the Japanese publisher said…

    Infosecurity

  24. Meta Faces Record $25 Billion Fine Over Facebook Data Deception

    A New Mexico court has ordered Meta to pay $25 billion after a jury found that Facebook deceived users about how their data was handled, marking a record penalty against the tech giant. The judge described the deception as intentional, with executives…

    Security Affairs

  25. Microsoft Expands Project Perception to Contain Risky AI Agents

    Microsoft is expanding Project Perception to treat AI agents as insiders, with Guardian Agents added to watch and contain anomalous AI entities that roam organised environments. The aim is to assign each agent a distinct identity separate from the user,…

    Dark Reading

  26. Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper Attack

    The Hacker News reports that Sandworm, the Russian state‑sponsored group, worked with another actor to mount a destructive wiping operation against a Ukrainian logistics company. The operation began with initial access on 16 July 2025, delivered via a…

    The Hacker NewsSandworm

  27. China-Linked Hackers Use AI Framework in ConnectWise Supply-Chain Attack

    A China-linked threat actor known as Storm-0940 has been using the open‑source AI penetration testing framework Artex to automate intrusions into ConnectWise customers’ environments, Microsoft reported. The activity, active since at least 2021, ramped up in…

    SecurityWeekStorm-0940

  28. Microsoft 365 Token Theft Lets Attackers Bypass MFA in BEC Campaigns

    A new, large-scale business email compromise (BEC) campaign targeted Microsoft 365 environments using token-spraying techniques to access corporate accounts without the attackers needing passwords. Researchers from Huntress identified the operation after a…

    Infosecurity

  29. PHP Exploits Are Probing Targets as Patches Roll Out Worldwide

    The latest SANS Internet Storm Center podcast update centres on ongoing patch activity and recent vulnerability disclosures. The host notes that patches for the long‑running PHP vulnerability are widely available from many vendors, though some devices such…

    SANS ISC

  30. Switch 2 Jailbreak Runs Homebrew but Vanishes on Restart

    Researcher Sammy Hajhamid has released NS2JB, a jailbreaking project for Nintendo’s Switch 2 handheld, developed with assistance from the AI tool Codex. The exploit relies on a software-only chain of flaws to achieve native code execution on firmware 23.0.1.…

    SecurityOnline

  31. Third Party Breaches Hit 69% of Victims as Tech Vendors Spread Risk

    A new Kroll report finds that more than two-thirds (69%) of data breach victims in the past year were affected by a third-party breach, with 79% of those individuals’ data accessed following a compromise at a technology company during June 2025 to June 2026.…

    Infosecurity

  32. Crime Stoppers breach exposes personal details in 850,000 tips

    A breach has compromised the anonymity relied upon by Crime Stoppers tip lines, prompting one Toronto chapter to pause phone, website and app submissions. The incident stemmed from March and involved P3 Global Intel, the Texas-based tip-management platform…

    Malwarebytes

  33. Qualcomm signals global job cuts as smartphone demand slumps

    Qualcomm has signalled substantial global job cuts in response to a marked slump in smartphone demand, according to a Reuters report cited by the site. The San Diego-based chipmaker informed staff that workforce reductions will begin in November, with the…

    SecurityOnline

  34. Pillow flaw lets malicious EPS filenames trigger code execution via Ghostscript

    Pillow, the widely used Python image library, has a critical flaw tied to how it handles EPS images. The vulnerability, CVE-2026-112900, arises because Pillow passes the EPS file name to Ghostscript when converting the PostScript to pixels, without first…

    The Hacker NewsCVE-2026-112900CVE-2026-112900

  35. Python Rushes Emergency Releases to Block MITM Attacks via emSign Certificates

    A security incident involving eMudhra intermediate certificates has led to the removal of the emSign CA certificate from major trust bundles used by Python projects, including certifi. In response, the Python project issued emergency releases: Python 3.15.1,…

    SecurityOnline

  36. LiteSpeed Cache Flaws Let Commenters Inject Scripts into WordPress Sites

    LiteSpeed Cache has three newly disclosed vulnerabilities affecting WordPress sites, with the issues tracked under CVEs 2026-113499, 2026-113500 and 2026-113501. The flaws were disclosed by WPScan on 23 October 2026 and patched in LiteSpeed Cache 7.9.2,…

    SecurityOnlineCVE-2026-113499CVE-2026-113499

  37. Flaws in x402 SDKs let AI agents pay API bills without spending limits

    Security firm V12 has disclosed a set of critical defects in the x402 SDKs used by AI agents to pay for API calls. The most serious flaw stemmed from the default client, which previously allowed automatic signing of payments without any spending limit. In…

    The Hacker News

  38. OpenBSD 8.0 Ships Day One Fix for Critical IPsec Kernel Flaw

    OpenBSD 8.0 arrived on 20 October 2026 with notable kernel hardening and new features, but the release was accompanied by four critical day-one errata. The most serious patch fixes a memory corruption flaw in the IPsec AES-GMAC implementation. Under targeted…

    SecurityOnline

  39. Capcom Breach Exposes Email Addresses of 11.7 Million Users

    Capcom has disclosed a data breach affecting CAPCOM ID, its shared service used for online access and gaming. The incident was detected on 19 October 2026 and involved unauthorised access to CAPCOM ID. The attackers stole the email addresses of 11,774,247…

    SecurityWeek

  40. Quest Diagnostics probes unauthorised access to patient records in Quanum platform

    Quest Diagnostics has disclosed a cyber incident affecting its Quanum Lab Services Manager, a platform used by some clients to place test orders and access results. In a regulatory filing, the company said it learned of unauthorized access to this system…

    SecurityWeek

  41. Compromised LiteLLM Update Stole Secrets and Fueled Cloud Abuse

    LiteLLM was compromised in a contemporary supply‑chain incident, with malicious packages pushed to PyPI and Docker Hub. The attackers abused GitHub CLI OAuth tokens that had been leaked from an internal LiteLLM deployment exposed to the public internet. They…

    SecurityWeek

  42. INC Ransomware Exposed Using AI and Custom Malware Against Victims

    In late September 2026, security researchers uncovered seven INC Ransomware command servers that exposed AI-driven activity and bespoke malware used by affiliates of the group. The exposed AI workbench contained 8,257 messages across 133 OpenCode sessions…

    SecurityOnlineCVE-2026-35616CVE-2026-35616Exploited

  43. Atlassian Flags 162 High and 14 Critical Flaws in Server Products

    Atlassian’s October bulletin lists 176 vulnerability entries, including 14 critical-severity issues, all in third-party components.

    SecurityWeekCVE-2026-65637CVE-2026-65637

  44. Australian Court Orders Apple to Open iOS to Rival App Stores

    An Australian Federal Court has ordered Apple to open its iOS ecosystem to third‑party app stores and direct downloads, marking a significant push to loosen the company’s control over the App Store. The ruling, described as a 1,104‑paragraph decision,…

    SecurityOnline

  45. Node.js Brotli flaw enables remote code execution in Linux arm64 builds

    Researchers have demonstrated a remote code execution (RCE) flaw in the Brotli decoder bundled with official Node[.]js builds, by feeding crafted Brotli data that exploits a mismatch in the decoder’s handling of a Brotli stream. The PoC, created by Imperva,…

    The Hacker NewsCVE-2026-111497CVE-2026-111497

  46. Capcom Confirms Data Breach Exposing 11.77 Million User Records

    Capcom has confirmed unauthorized access to its CAPCOM ID membership system, exposing about 11.77 million user records worldwide. The CAPCOM ID credential is used to access Capcom’s online services and some games. The initial findings indicate that the…

    SecurityOnline

  47. Arc browser will shut down in December 2026 as users face data loss

    The Browser Company has announced that Arc, its once-popular but niche browser, will shut down on 22 December 2026. After this date, the company will cease maintaining Arc and users will no longer be able to run the browser, with personal data also being…

    SecurityOnline

  48. Russian Doppelganger campaign revives fake Walla news ahead of Israeli vote

    Russian threat actors revived the Doppelganger campaign in August 2026 to influence Israeli public opinion ahead of the 27 October 2026 elections. Researchers from ClearSky Cyber Security report that operators created a counterfeit news portal at walla[.]ist…

    SecurityOnlineDoppelganger

  49. Iranian Hackers Resume Data Theft Using US Based Command Servers

    Prince of Persia, a government-sponsored Iranian threat group also known as Infy, resurfaced its command-and-control (C&C) infrastructure in the United States for the first time since 2016, according to Semperis. After a three-month lull in operations, the…

    SecurityWeekInfy

  50. Sophos Uncovers BRONZE SANDCASTLE Using Sandboxie to Load Malware

    Sophos Counter Threat Unit and SophosLabs have tracked BRONZE SANDCASTLE across victims in Asia and Africa from August 2025 to August 2026. The group’s hallmark technique is Sandboxie DLL sideloading, where a legitimate Sandboxie program is placed beside a…

    SecurityOnlineENERGETIC BEAR

  51. INTERPOL Operation Nets 1,462 Arrests and Disrupts 10,909 Networks

    INTERPOL’s Operation Serengeti III was a multinational crackdown conducted across 21 countries between 29 June and 31 August 2026, targeting online fraud, ransomware, business email compromise, scams and digital extortion. The operation culminated in 1,462…

    Security Affairs

  52. Quest Diagnostics Confirms Patient Data Breach in Lab Portal Intrusion

    Quest Diagnostics has disclosed an unauthorized access incident affecting its Quanum Lab Services Manager (LSM) system. The company said it detected the intrusion on 21 October 2026 and promptly paused access to Quanum LSM while it investigated. In a filing…

    SecurityOnline

  53. Oracle Rushes Fix for Compromised Certificates Threatening Java Users

    Oracle has issued an out-of-band security alert for CVE-2026-91403 relating to compromised eMudhra intermediate certificates that affect Java’s trust store in Oracle Java SE and GraalVM. The advisory, rated CVSS 9.1 (Critical, CVSSv3), warns that if Java…

    SecurityOnlineCVE-2026-91403CVE-2026-91403

  54. SBI Confirms Customer Data Leak, Raising Risks of Identity Fraud

    An anonymous hacker leaked a small batch of SBI customer records to BreachForums, disclosed in a post that includes a table of 375,000 rows and 2,722 PDFs. SBI has confirmed that the leaked data included names, genders, mobile numbers, email addresses, home…

    Dark Reading

  55. Unpatched Linux KSMBD flaws expose servers to remote code execution

    Trend Micro’s Zero Day Initiative (ZDI) has published details of several unpatched Linux kernel vulnerabilities to the public Linux kernel mailing list (LKML) as of 22 October 2026. The disclosures include two KSMBD flaws rated at CVSS 9.0 that can enable…

    SecurityOnline

  56. CISA Warns Kiloview Video Encoders Could Be Hijacked for Root Access

    CISA has warned that Kiloview E3 NDI encoders contain nine vulnerabilities, including three high‑risk OS command injection flaws that could allow a logged‑in attacker to gain root access. The flaws are tracked as CVEs including CVE‑2026‑107861 (CVSS 9.9),…

    SecurityOnline

  57. HPE Patches 72 Wi-Fi Flaws, Including Critical Remote Code Bugs

    HPE has issued patches for 72 vulnerabilities affecting its HPE Networking AOS-8 and AOS-10 wireless operating systems, which run across Mobility Conductors, Controllers, Gateways and Access Points. The flaws span unauthenticated remote code execution,…

    SecurityOnlineCVE-2026-79844CVE-2026-79844

  58. Laravel TokenGuard flaw lets attackers bypass login using JSON requests

    Hakai Security has released a public proof-of-concept for CVE-2026-114509, a critical authentication bypass in Laravel’s TokenGuard. The vulnerability, rated CVSS 9.2, allows an unauthenticated attacker to log in as an existing user when the backend uses…

    SecurityOnlineCVE-2026-114509CVE-2026-114509

  59. FortiSIEM flaw lets unauthenticated attackers execute code as admins

    FortiSIEM has a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-106173. A technical deep dive by Horizon3 detailed a gRPC path traversal flaw that enables an unauthenticated attacker to write files and execute code. The PoC…

    SecurityOnlineCVE-2026-106173CVE-2026-106173

Thu 22 Oct· 84 articles

  1. PHP9 articles this day · The Hacker News first

    PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches · Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable

    6 outletsCVE-2026-109618CVE-2026-109618

  2. Storm-09405 articles this day · The Hacker News first

    AI Pentesting Framework Scaled ConnectWise Attacks Across 365 Tenants · China-Linked Hackers Hit 2,250 Microsoft 365 Tenants Through ConnectWise

    5 outlets

  3. US crackdown exposes North Korean ‘laptop farm’ scheme hitting 70 firms

    The episode centres on a federal crackdown on North Korean fake IT worker schemes, highlighted by “Operation Lonestar Roundup” in Texas. Law enforcement seized 187 devices, filed charges against 14 individuals, and made several arrests in what the hosts…

    Dark ReadingDataSuckers

  4. eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued

    eMudhra, the Indian certificate authority, has said it is exiting the global SSL/TLS certificate business after a fault in a key generation ceremony allowed eight intermediate certificates to be minted with dangerously weak private keys. Researchers had…

    Ars Technica

  5. Python Urges Users to Update Tools After CA Key Compromise Threat

    The piece reports that on 20 October 2026, Python’s security team urged users to update packaging tools after the eMudhra / emSign intermediate CA incident. The core risk is that eight compromised intermediate CA keys with insufficient randomness could allow…

    StepSecurity

  6. Hackers Turn Supermarket Fridges Into Ovens in Attack on 700 Stores

    French and EU grocers were hit by a large-scale cyberattack that disrupted refrigeration and caused substantial financial losses. In the early hours of a Monday, attackers compromised commercial refrigeration controllers used by major supermarket chains,…

    Dark Reading

  7. Arista Networks VeloCloud Orchestrator2 articles this day · SecurityOnline first

    Arista VeloCloud Zero Day Exploited to Gain Superuser Access · Arista VeloCloud flaw under attack lets users seize superuser access

    2 outletsCVE-2026-114625CVE-2026-114625Exploited

  8. Signal RingRTC3 articles this day · SecurityOnline first

    Signal Flaw Could Keep Your Microphone Live After Calls End · Signal flaw could keep your microphone and camera active after hang-up

    3 outletsCVE-2026-113380CVE-2026-113380

  9. eMudhra Exits SSL Business After Private Keys Are Recovered

    eMudhra, an Indian certificate authority, has decided to withdraw from its global SSL/TLS certificate business. The board’s decision came five days after a researcher recovered private keys for eight of its intermediate CA certificates, six of which were TLS…

    The Hacker News

  10. Attackers Used Stolen Credentials to Breach PingCAP and Copy Data

    PingCAP has disclosed that attackers used stolen service account credentials to access internal systems between 9 September and 7 October 2026, enabling them to copy data and obtain source code. The breach also exposed customer-related records, including…

    The Hacker NewsCVE-2026-114509CVE-2026-114509

  11. Weak randomness exposes eMudhra certificate keys, enabling TLS attacks

    Eight eMudhra Limited intermediate certificate authority private keys were compromised due to a cryptographic defect in the certificate generation process, caused by insufficient randomness. The result is that private keys could potentially be derived from…

    unit42.paloaltonetworks.com

  12. Linux KSMBD Flaws Enable Remote Code Execution, No Fix Yet

    Two high‑severity Linux KSMBD remote code execution flaws were disclosed publicly on mailing lists in October 2026, with no fix in the mainline kernel at the time of reporting. ZDI has assigned two identifiers to these flaws: ZDI-CAN-33549, which concerns…

    The Hacker News

  13. Attackers Target OAuth Tokens to Bypass MFA and Keep Access

    The article outlines a shifting threat landscape where attackers increasingly target OAuth tokens rather than credentials to gain access, with tokens able to bypass MFA and survive password resets. It explains that, as enterprises roll out MFA, attackers…

    unit42.paloaltonetworks.com

  14. Meta Hit With $25 Billion Penalty Over Facebook’s Data Practices

    A New Mexico jury has ordered Meta to pay a civil penalty of $25 billion after finding that Facebook misled consumers about its data practices, as well as its handling of hate speech and misinformation. The verdict, reported by Reuters, tallies 43,899,725…

    Malwarebytes

  15. Meta Ordered to Pay $25 Billion Over Misleading Privacy Claims

    A New Mexico court has ordered Meta to pay 25 billion in penalties after ruling that the social media giant misled consumers about the privacy of their data. The decision ties to more than 43 million alleged violations of the state’s Unfair Practices Act,…

    The Hacker News

  16. Hackers Probe Critical PHP Flaws Days Before Public Disclosure

    Hackers had already begun probing a pair of critical PHP flaws four days before the issues were disclosed publicly, with Amazon saying the vulnerabilities were “now being broadly exploited in the wild.” The weaknesses affect PHP, a language underpinning much…

    Ars Technica

  17. M365 Token Replay Attack Bypasses MFA at 79 Organisations

    A token replay attack campaign exploited Microsoft 365 sign-in sessions to access accounts at 79 organisations, new research from Huntress and Microsoft Entra ID Protection shows. Between 14 July and 22 September 2026, attackers used adversary-in-the-middle…

    SecurityOnline

  18. Gravwell CEO’s “Evil Bit” Mindset Drives His Mission to Secure Critical Infrastructure

    Corey Thuen, founder and CEO of Gravwell, is profiled as a hacker with a distinctive mindset he calls the “evil bit” — an adversarial streak he believes is innate and essential for finding security weaknesses. The piece presents Thuen as someone who recruits…

    SecurityWeek

  19. INTERPOL Arrests 1,462 in Africa Cybercrime Crackdown

    Operation Serengeti III was an INTERPOL‑led crackdown across Africa that resulted in 1,462 arrests in 21 countries, with authorities disrupting 10,909 malicious networks and recovering more than USD 105 million. The operation ran from 29 June to 31 August…

    SecurityOnline

  20. Text Scams Cost $470 Million as AI Makes Fraud Harder to Spot

    Scammers are increasingly targeting mobile phones, exploiting their role as a primary channel for communication and authentication. The piece cites data showing texted scams caused about $470 million in losses in 2024, a 26% rise from the year before and far…

    Malwarebytes

  21. EU Probes Booking.com Over Security and Phishing Risks

    The European Commission has opened formal proceedings against Booking[.]com to assess potential security failings under the EU’s Digital Services Act (DSA). The investigation will determine whether the online travel platform complied with the DSA’s…

    Infosecurity

  22. INTERPOL Arrests 1,462 Suspects in Global Cybercrime Crackdown

    INTERPOL announced a coordinated global crackdown, Operation Serengeti III, which ran from 29 June to 31 August 2026. The operation disrupted 10,909 malicious networks and led to the arrest of 1,462 suspects across 21 countries, including the United States…

    The Hacker News

  23. Iranian hackers use US servers and Telegram to hide spyware campaigns

    An Iranian nation-state threat group known as Prince of Persia has been found hosting its command-and-control (C2) infrastructure in the United States to support malware delivery and cyber-espionage campaigns. The activity was uncovered by Semperis, which…

    InfosecurityInfy

  24. Indurex Raises €7 Million to Expand Industrial Cybersecurity Platform

    Amsterdam-based industrial cybersecurity firm Indurex has raised €7 million (roughly $7.84 million) in a round led by Contrarian Ventures, with Axeleo Capital and Curiosity participating. The funds will be used for research and development and to expand…

    SecurityWeek

  25. Cloudflare Wins South Korea Security Certification After 10-Day Audit

    Cloudflare has obtained South Korea’s ISMS certification under the ISMS-P framework, following a ten-day audit with auditors appointed by the Korea Internet & Security Agency (KISA) and a review of 80 controls. The certification signals that Cloudflare’s…

    Cloudflare

  26. CISA warns unmanaged AI token use could disrupt critical services

    CISA, together with the Canadian Centre for Cyber Security and partners, has published joint guidance on managing token consumption for operational resilience as organisations deploy third-party super intelligence (SI) services. The briefing notes that…

    CISA

  27. Unmanaged AI Agents Are Becoming Insider Threats in the Workplace

    The Hacker News reports on the growing risk posed by AI agents operating within organisations, potentially with broad access to internal systems and credentials, yet with little to no oversight. The article frames such agents as insiders in effect: if an…

    The Hacker News

  28. Attackers Hijack 333 Tor Exit Nodes to Intercept SSH Traffic

    Unknown attackers hijacked more than 300 Tor exit nodes to siphon unencrypted email and to redirect SSH connections through their own servers, a researcher reported on 2026-10-22. In the attack, 333 exit relays were compromised between 2 and 5 October, with…

    Ars Technica

  29. Woman Faces Six Years in Jail After Scammer Used Her Identity for Cash App

    A case out of the United States centres on a Cash App account opened in Amanda Smith’s name, which has led to criminal charges and a potential prison sentence of up to six years. The account is alleged to have received $1,000 from a Facebook Marketplace scam…

    Malwarebytes

  30. Railway Breach May Have Exposed Customer Secrets and API Keys

    Railway, a Platform‑as‑a‑Service provider, has disclosed “anomalous activity” affecting systems that store customer environment variables. In its update dated 21 October 2026, the company said an unauthorized third party may have accessed encrypted…

    The Hacker News

  31. EU Probes Booking.com Over Fake Listings and Phishing Scams

    The European Commission has opened formal proceedings against Booking[.]com under the Digital Services Act (DSA) to assess whether the platform did enough to curb fake property listings and phishing scams, and to check if boosted paid listings are clearly…

    SecurityOnline

  32. Splunk and SolarWinds patch flaws exposing data and enabling attacks

    Splunk and SolarWinds have released a new wave of security updates this week, addressing a range of flaws that could enable code execution, privilege escalation, information disclosure and other impacts. Splunk’s patches cover Splunk Enterprise and Splunk…

    SecurityWeek

  33. Portainer fixes flaws letting users mount host files and gain root access

    Portainer has fixed two critical vulnerabilities, both rated CVSS 9.4, that could let standard users mount files from the Docker host into containers. The flaws could lead to root access on the host. One reportedly extends a bind-mount bypass that remained…

    SecurityOnlineCVE-2026-44849CVE-2026-44849

  34. OpenCode flaw lets hijacked MCP servers run commands on Windows during sign in

    A flaw in the OpenCode AI coding agent could allow a malicious or hijacked MCP server to execute code on a developer’s Windows or Windows Subsystem for Linux (WSL) machine during sign-in. OpenCode connects to MCP (Model Context Protocol) servers to bring in…

    The Hacker News

  35. Attackers Targeted PHP2Shell Flaws Four Days Before Disclosure

    Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities

    Infosecurity

  36. Cisco TelePresence Video Communication Server (VCS) Expressway2 articles this day · SecurityOnline first

    Cisco Patches Critical Expressway Flaw That Could Run Commands as Root · Cisco Patches Root Access Flaw in Expressway Gateways

    2 outletsCVE-2026-76466CVE-2026-76466

  37. Delivery robot firms face lawsuits over alleged biometric data harvesting

    Two Chicago residents have filed separate class actions alleging that delivery robots operated by Coco Robotics (Cyan) and Serve Robotics illegally scanned customers’ faces, hands and surrounding LiDAR data during deliveries, storing the biometric data…

    Malwarebytes

  38. Microsoft Windows 10 Version 18092 articles this day · securelist.com first

    APT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central Asia · BlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flaw

    2 outletsCVE-2022-21894CVE-2022-21894

  39. Malicious LiteLLM Package Steals Secrets and Opens a Backdoor

    LiteLLM disclosed that threat actors compromised multiple independent security controls to push a malicious version of the LiteLLM Python package, designed to harvest credentials and act as a backdoor. The attack occurred on 21 October 2026, when the release…

    The Hacker News

  40. Cloud Misconfigurations Drive 45% of Critical Incidents, SANS Finds

    Nearly all organisations now operate production workloads in the cloud, yet the 2026 SANS Cloud Security Survey Insights shows a clear maturity gap. Based on 400 IT and security professionals, the report finds that only about 40% regard their cloud security…

    Infosecurity

  41. Fortinet urges customers to patch critical flaws before details emerge

    Fortinet has issued urgent security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, with FortiMail and FortiAuthenticator fixes arriving a day earlier. The disclosures follow AI-assisted testing that identified critical and…

    SecurityOnline

  42. Fancy Bear Used Webhook.site to Breach European Defence Targets

    Symantec’s Threat Hunter Team tracks the operation as Swallowtail (also known as APT28, Fancy Bear or Forest Blizzard). In the campaign, three organisations in two NATO member states were compromised: a naval shipbuilder, a defence contractor producing…

    SecurityOnlineAPT28

  43. Node.js fixes Brotli flaw that could enable remote code execution

    Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code…

    The Hacker News

  44. Oracle fixes 1,209 vulnerabilities in October security update

    Oracle has released its Critical Patch Update (CPU) for October 2026, delivering 1,295 fixes across numerous Oracle products. Tenable’s analysis accompanying the update notes 1,209 unique CVEs addressed, of which 95 are rated critical. The update distributes…

    SecurityWeekCVE-2026-91403CVE-2026-91403

  45. Trojanised LiteLLM Release Steals Cloud Keys on Python Startup

    A new LiteLLM supply chain attack has compromised the 1.107.0 release of the open‑source LiteLLM gateway, turning it into a credential stealer. Attackers used stolen maintainer tokens to publish trojanised wheels to PyPI and poisoned Docker images, exposing…

    SOCRadar

  46. Anthropic Launches Claude Duet, an AI Agent That Works in the Background

    Anthropic has unveiled Claude Duet, a proactive AI agent designed to act as a digital partner that takes initiative while keeping you in the loop. Positioned as a rival to OpenAI Dots and Meta Muse, Duet is being released as a research preview with a waiting…

    SecurityOnline

  47. Meta Fined $25 Billion Over False Facebook Privacy Assurances

    A New Mexico jury has ordered Meta Platforms to pay $25 billion after finding Facebook deceptive in how it handled users’ privacy. Jurors concluded Meta violated state consumer protection laws over more than 43 million statements about data handling, with…

    SecurityWeek

  48. SafePay ransomware hits 600 victims using stolen VPN credentials and old flaws

    Six agencies from the US, Germany and the UK issued a joint StopRansomware advisory on SafePay ransomware on 20 October 2026, detailing that the group has compromised at least 600 victims since August 2024. The advisory, AA26-293A, is a collaboration between…

    SecurityOnline

  49. SafePay Ransomware Hits 600 Organisations in Global Campaign

    SafePay ransomware has affected more than 600 organisations since mid‑2024, with the US CISA, FBI, US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz and two UK police forces publishing a joint advisory. The victims span critical infrastructure…

    Security AffairsSafePay

  50. quic-go2 articles this day · SecurityOnline first

    HTTP/3 Header Flaws Let Small Requests Exhaust Server Memory · HTTP/3 Header Attack Can Amplify Memory Use 4,000 Times in Bun

    2 outletsCVE-2025-64702CVE-2025-64702

  51. China linked hackers used AI agents to breach 48 targets in 12 days

    Between 24 September and 14 October 2026, a suspected China-linked operator conducted 66 hacking operations from a single server using AI agents, according to VULONE Research. The campaign targeted government ministries in Vietnam, Taiwan, Indonesia, and…

    SecurityOnline

  52. UAE Aims to Move Half of Government Operations to Agentic AI

    The United Arab Emirates plans to shift half of its government operations, services and sectors to autonomous, agentic AI within the next two years. Speaking at the World Economic Forum in Dubai on 14 October 2026, Omar Sultan Al Olama, the minister of state…

    Dark Reading

  53. Zeabur to shut down services after breach exposed millions of records

    Zeabur, a developer deployment platform, has announced it will shut down its shared cluster and dedicated server services by the end of December 2026, citing ongoing security problems and repeated data breaches that undermine confidence in delivering…

    SecurityOnline

  54. Google Brings Hands-Free Gemini AI to Apple CarPlay Navigation

    Google has rolled out Gemini integration to Apple CarPlay, bringing a conversational AI companion directly into the navigation experience. The update adds a dedicated Gemini button in the CarPlay interface, enabling hands-free access to the assistant without…

    SecurityOnline

  55. Cisco Patches 13 Snort 3 Flaws, Including Critical Code Execution Risk

    Cisco has issued a coordinated set of advisories fix­ing 13 Snort 3 vulnerabilities across its security products, including firewalls, Meraki MX, Cyber Vision and UTD on IOS XE. The most severe flaw, CVE-2026-20043, carries a CVSSv3 score of 9.0 for an…

    SecurityOnlineCVE-2026-20043CVE-2026-20043

  56. Railway Breach May Expose Customer Secrets and API Keys

    Railway has disclosed a security incident affecting its cloud platform, reporting anomalous activity on October 21 that potentially exposed customer environment variables. The firm warned that an unauthorised party “may have accessed encrypted environment…

    SecurityOnline

  57. PHP2Shell Flaws Face Active Attacks as Exploits Spread Rapidly

    PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now. Related Posts: Signal Call Vulnerability Details and PoC Published, Showing Hang-Up Can Fail to End Calls Cisco Fixes 13…

    SecurityOnline

  58. Splunk fixes 31 flaws, including three rated CVSS 9.9, in urgent updates

    Splunk has released four advisories fixing 31 vulnerabilities across Splunk Enterprise and Splunk SOAR, with three flaws rated at CVSS 9.9. The company urges admins to apply the latest updates: Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16, and…

    SecurityOnlineCVE-2026-76291CVE-2026-76291

  59. Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access

    Apache Software Foundation researchers disclosed 17 security flaws on 21 October 2026, affecting both Apache Pulsar and Apache IoTDB. The majority are Pulsar-related, with 13 vulnerabilities, and four concern IoTDB. The most severe issues include a 10.0 CVSS…

    SecurityOnlineCVE-2026-105944CVE-2026-105944

  60. Critical PHP flaws enable remote attacks on websites and appliances

    On 22 October 2026, SANS ISC’s Stormcast focused on a critical PHP vulnerability that has widespread impact because PHP is used by roughly 60% of websites and many network appliances run PHP as well. The discussion notes that the flaw is in the PHP…

    SANS ISC

  61. Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk

    Apache Traffic Server users face a substantial round-up of flaws disclosed in October 2026, with 15 CVEs spanning core proxy functionality and experimental plugins. The most severe entry is CVE-2026-111813 (CVSS 10.0) in the experimental magick plugin, which…

    SecurityOnlineCVE-2026-111813CVE-2026-111813

  62. AI Assisted PaperCut Campaign Breaches 395 Organisations Worldwide

    Hunt[.]io researchers uncovered three open directories on an attacker server involved in a PaperCut RCE campaign, exposing AI-assisted exploitation toolkit elements and victim data from hundreds of targets. The exposed material includes AI agent…

    SecurityOnlineCVE-2026-81578CVE-2026-81578Exploited

  63. Cisco fixes critical Unified CM flaws that could expose networks

    Cisco has released a security hardening update for Unified CM and related voice products, after internal testing uncovered a set of bugs that were grouped into nine CVEs. The advisories issued on 21 October 2026 flag three critical vulnerabilities (all CVSS…

    SecurityOnlineCVE-2026-76473CVE-2026-76473

  64. Oracle Fixes Critical MySQL Flaws That Could Allow System Takeover

    Oracle’s October 2026 Critical Patch Update fixes 98 vulnerabilities across MySQL products. The two highest-rated flaws, both scored CVSS 9.8, are in third-party libraries bundled with MySQL: CVE-2025-15467 in OpenSSL and CVE-2026-9547 in curl. The article…

    SecurityOnlineCVE-2025-15467CVE-2025-15467

  65. Apache bRPC 1.18.0 fixes 35 flaws enabling authentication bypass and DoS

    The Apache Software Foundation has released Apache bRPC 1.18.0 to patch 35 newly disclosed vulnerabilities, including 16 rated high severity and 19 moderate. The fixes address authentication bypass, memory corruption, and remote denial of service across…

    SecurityOnlineCVE-2026-48830CVE-2026-48830

  66. Duplicator WordPress Flaw Lets Hidden Payloads Take Over Sites

    Security researchers have disclosed a high-severity unauthenticated PHP object injection vulnerability in the Duplicator WordPress plugin and Duplicator Pro, tracked as CVE-2026-82814. Wordfence reports the flaw allows an attacker to plant a dormant payload…

    SecurityOnlineCVE-2026-82814CVE-2026-82814
Show 21 Oct · 96 articles

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device