News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Wed 14 Oct· 2 articles
-
Hidden VBA Projects in AutoCAD Drawings Can Evade Detection
Orphaned VBA projects can lurk inside AutoCAD drawing files (DWG) as embedded OLE objects. Didier Stevens revisits how VBA code can be stored inside an OLE file embedded in a DWG, and explains how you can locate the embedded file by following a 32‑bit…
SANS ISC -
Microsoft’s October Patch Tuesday fixes 1,417 flaws as attackers exploit a Windows security bypass
Microsoft’s October 2026 Patch Tuesday delivered a sprawling update set, addressing 1417 vulnerabilities across multiple products, with 76 of them rated as critical. Several of the critical issues are cloud-related and were addressed by Microsoft before this…
SANS ISC
Tue 13 Oct· 2 articles
-
Microsoft Patches Windows Shell Flaw Exploited in Malicious File Attacks
Microsoft’s October 2026 Patch Tuesday patches across a wide attack surface, addressing 1,417 disclosed vulnerabilities, with 76 rated as critical. The update set includes fixes for a substantial number of Office and .NET/Framework components, plus notable…
SANS ISC -
GitLab CI/CD flaw could let unauthenticated attackers execute code on servers
SANS ISC’s latest Stormcast highlights several notable security items. First, GitLab is dealing with an integer overflow in its CI/CD regular expression compiler that could allow unauthenticated users to execute arbitrary code on the GitLab server. The issue…
SANS ISC
Mon 12 Oct· 1 article
-
Amazon Bedrock AI agents exposed credentials through an SSRF flaw
On 12 October 2026, the SANS Internet Storm Center’s Stormcast covered a mix of threat intelligence governance and concrete vulnerability snapshots. The host clarifies the Traffic Light Protocol’s purpose: it indicates who information can be shared with, but…
SANS ISC
Sat 10 Oct· 1 article
-
TLP Labels Cannot Replace Internal Security Classification Schemes
The ISC diary entry discusses the inadequacy of treating the Traffic Light Protocol (TLP) as a replacement for a formal internal information classification scheme. The author, Jan Kopriva, argues that while TLP is a helpful standard for controlling with whom…
SANS ISC
Fri 9 Oct· 1 article
-
AI Agent Logs Expose Attacker Chats and Help Trace Cyber Intrusions
On 9 October 2026, the SANS Internet Storm Center’s Friday Stormcast notes continued concerns about how AI agents are used in cyberattacks and how defenders can trace those activities. The episode highlights two scripts by Jim Clausing that convert AI-agent…
SANS ISC
Thu 8 Oct· 2 articles
-
New Forensic Tools Reconstruct AI Agent Activity from Stored Data
Two new forensic review scripts have been added to FOR577’s material, aimed at reconstructing AI agent activity rather than replaying actions. The opencode-chat-replay[.]py script turns stored session data from opencode into readable transcripts or…
SANS ISC -
Atlassian Patches Flaw That Could Expose Files in Jira, Bitbucket and Confluence
The SANS podcast for 8 October 2026 reports on several ongoing security issues. A patched Atlassian vulnerability, disclosed 5 October, is being observed in honeypot traffic via proof‑of‑concept exploit strings. The flaw hinges on how Atlassian products…
SANS ISC
Wed 7 Oct· 2 articles
-
Atlassian Patches Flaw Letting Attackers Read Web App Files
Atlassian published patches on 5 October 2026 to fix a pre-auth Arbitrary File Access vulnerability across multiple products, tracked as CVE-2026-21589. The flaw is a directory traversal weakness that can let an attacker read arbitrary files within the web…
-
Fake Invoice PDFs Deliver Legitimate ActionOne Remote Access Tool Attacks
A recent SANS ISC Stormcast notes another abuse of a legitimate remote management tool, this time ActionOne’s A1 Agent. The threat arrives via a malicious PDF—an ordinary looking fake invoice or Adobe update—that lures the target into opening a URL as the…
SANS ISC
Tue 6 Oct· 2 articles
-
Attackers Are Exploiting a NetScaler Flaw to Cause Denial of Service
In the latest SANS Internet Storm Center podcast for 6 October 2026, the focus ranges from honeypot analytics to fresh vendor advisories. Guy’s segment on Kaori TTY Logs explains how attackers interact with a honeypot, using Elasticsearch for querying large…
SANS ISC -
Phishing PDFs Turn Action1 Remote Management Tool Into a Foothold
Threat actors are abusing a Remote Management and Monitoring (RMM) tool from Action1 in the wild, following a phishing email that delivers a fake PDF invoice. Opening the PDF triggers an OpenAction that redirects the user to a malicious VBS file, which then…
SANS ISC
Mon 5 Oct· 2 articles
-
FortiMail Flaw Exploited to Enable Unauthenticated Remote Code Execution
The SANS ISC podcast for 5 October 2026 rounds up ongoing internet scanning activity via honeypots, noting that many scans carry spoofed or misleading user agent strings. They point out that while some strings come from researchers or security vendors,…
SANS ISC -
DShield SIEM Links Attacker TTY Logs to More Than 3,130 Actors
A SANS ISC diary entry reports on an experiment in which Guy Bruneau created a script to parse and send TTY logs collected from attackers or bots that log in to a DShield sensor. The logs are then forwarded daily to the DShield SIEM for correlation with the…
SANS ISC
Sun 4 Oct· 1 article
-
User Agent Strings Curiosities, (Sun, Oct 4th)
A recent Internet Storm Center diary by Didier Stevens surveys amusing and worrying examples of User Agent Strings seen in honeypot logs. The piece collates a variety of UA strings that attackers send in requests, ranging from so‑called “authorized” scans to…
SANS ISC
Sat 3 Oct· 1 article
-
YARA-X 1.21.0 Streamlines Automated Scans With Stdin Support
The Internet Storm Center reports that YARA-X has released version 1.21.0, bringing five improvements and four bug fixes. The update appears to focus on enhancing usability and reliability for users who employ YARA-X for scanning tasks, with specifics likely…
SANS ISC
Fri 2 Oct· 1 article
-
Attackers Turn Legitimate Remote Tools and AI Into Phishing Weapons
In this SANS Internet Storm Center Stormcast, the host explains how attackers abuse legitimate remote administration tools to gain remote access without using malware. In one case, they email a copy of Screen Connect preconfigured to automatically connect…
SANS ISC
Thu 1 Oct· 2 articles
-
Phishers Abuse Trusted ScreenConnect Tool to Breach Victims
A phishing email delivered a link that purported to show an order invoice PDF, but led to a real executable: ScreenConnect.ClientSetup[.]exe. The attachment/link tricked basic security controls, and the attacker used a legitimate remote access tool to…
SANS ISC -
ISC Keeps Threat Level Green as October 2026 Stormcast Goes Live
The ISC (Internet Storm Center) features handler Xavier Mertens on duty, with the current threat level marked as green. The latest Stormcast podcast, dated October 1st, 2026, is available for listeners. Readers can find links to previous and next entries, as…
SANS ISC
Wed 30 Sep· 1 article
-
SANS Internet Storm Center Reports Green Threat Level on 30 September
The SANS Internet Storm Center diary for September 30, 2026, features Johannes Ullrich as the handler on duty, with a current threat level of green. The page includes links to previous entries, podcasts, and information about classes taught by Ullrich at…
SANS ISC
Tue 29 Sep· 2 articles
-
Attackers Scan Wordfence Files to Map Protected WordPress Sites
Starting yesterday, SANS ISC observed a small number of scans targeting Wordfence protected WordPress sites by requesting a file named wordfence-waf[.]php from the sites’ root directories. The script in question is created during Wordfence installation and…
SANS ISC -
ISC Stormcast Highlights Threat Feeds and Security Analysis Tools
The page provides information about the Internet Storm Center (ISC) with Didier Stevens as the handler on duty. The current threat level is green. There is a link for a podcast titled 'ISC Stormcast For Tuesday, September 29th, 2026,' and links to learn more…
SANS ISC
Mon 28 Sep· 2 articles
-
Apple Patches Exploited Zero Day Targeting Older iOS Versions
Apple has released security updates for older branches of its operating systems to address CVE-2026-86950. The vulnerability affects iOS 26, macOS 26 and macOS 15, and Apple says it is already being exploited. Apple credited Meta Product Security with…
-
Fake CAPTCHA Campaign Targets Mac Users With Information-Stealing Malware
Brad Duncan has analysed malware delivered through the active “Macfinger ClickFix” campaign, which uses injected scripts on legitimate websites to display fake CAPTCHA or bot-protection pages. Victims are instructed to paste commands into Terminal, causing a…
SANS ISC
Sun 27 Sep· 1 article
-
Wireshark 4.6.9 Fixes 19 Vulnerabilities and 16 Bugs
Wireshark 4.6.9 was released on 27 September 2026, according to the SANS Internet Storm Centre. The update fixes 19 vulnerabilities and 16 bugs. The supplied report does not provide details of the individual vulnerabilities, affected components, exploitation…
SANS ISC
Fri 25 Sep· 2 articles
-
Macfinger ClickFix Campaign Steals macOS Data Through Fake CAPTCHA Pages
The Macfinger ClickFix campaign remains active and is delivering an unidentified macOS information stealer, according to SANS Internet Storm Centre researcher Brad Duncan. In an infection observed on 24 September 2026 on macOS 27.0, victims were shown a fake…
SANS ISC -
ISC Stormcast Highlights Network Threat Research and Security Resources
The ISC (Internet Storm Center) report features Brad Duncan as the handler on duty with a current threat level of green. The report includes links to previous diaries and highlights a podcast titled 'ISC Stormcast for Friday, September 25th, 2026'.…
SANS ISC
Thu 24 Sep· 2 articles
-
Phishing Link Uses URL Parsing Tricks to Evade Security Checks
A phishing email analysed by SANS Internet Storm Centre on 24 September 2026 used a carefully constructed URL to evade basic security controls. The defanged address was `hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu`. The report says the…
SANS ISC -
Internet Stormcast Reviews the Latest Cyber Threats on 24 September
The content presents updates from the Internet Storm Center (ISC) regarding the handler on duty, Xavier Mertens, with a current threat level indicated as green. It features links to previous and next diary entries, as well as a specific podcast titled 'ISC…
SANS ISC
Wed 23 Sep· 2 articles
-
ISC Stormcast Reviews Key Cybersecurity Threats and Training Updates
The ISC Stormcast for September 23rd, 2026 is presented by handler Brad Duncan, with a threat level currently set to green. The podcast features discussions on ongoing cybersecurity highlights and relevant training courses. For further engagement, users can…
SANS ISC -
ClickFix Campaign Uses Fake Bot Checks to Deploy macOS Stealer
SANS Internet Storm Centre researcher Brad Duncan has reported a macOS-focused ClickFix campaign, which he calls “Macfinger”. Observed on 21 and 22 September 2026, the activity involved legitimate websites carrying injected JavaScript. The script displayed a…
SANS ISC
Tue 22 Sep· 2 articles
-
GET Request Bodies Expose Inconsistent Web Server Behaviour
SANS Internet Storm Centre researcher Johannes Ullrich examined how web servers handle HTTP GET requests containing a message body. The issue stems from differing language in the HTTP standards: RFC 2616 said a body must not be included when a method’s…
SANS ISC -
ISC Stormcast Reviews September’s Green-Level Cyber Threats
The page provides information about the ISC Stormcast for September 22nd, 2026, featuring handler Didier Stevens and indicating a current threat level of green. It includes links to previous diaries, discussions, and SANS classes taught by Johannes Ullrich,…
SANS ISC
Mon 21 Sep· 2 articles
-
Attackers Hide DLL Sideloading Payloads Inside Valid PNG Images
Microsoft Security Research’s TerminalFix campaign investigation identified PNG files being used to conceal malware through steganography. Didier Stevens of the SANS Internet Storm Centre examined indicators shared by the researchers and found that one…
SANS ISC -
ISC Stormcast Highlights Cybersecurity Classes and Threat Updates
The content indicates that Didier Stevens is the handler on duty for the ISC page with a current threat level rated as green. There is a mention of the ISC Stormcast podcast for September 21, 2026, and a link provided to learn more about classes taught by…
SANS ISC
Fri 18 Sep· 2 articles
-
New HTTP QUERY Method Could Bypass Web Defences and Caches
In June 2026, the IETF published RFC 10008, defining QUERY, the first new standard HTTP method since PATCH in 2010. QUERY is intended to sit between GET and POST: it is safe, idempotent and cacheable, but places the query in the request body rather than the…
SANS ISC -
ISC Stormcast September 18, 2026 Edition Reports Green Threat Level
The ISC Stormcast for September 18, 2026, features handler Xavier Mertens, with the current threat level rated as green. The page includes links to previous and next entries in the diary, as well as additional resources including details about classes taught…
SANS ISC
Thu 17 Sep· 1 article
-
LausivLoader Uses Fake Fibre Optic Quote to Deploy Hidden .NET Malware
A malspam email intercepted in late August attempted to impersonate an employee of a legitimate company and lure the recipient into reviewing attached requirements and providing a quotation for a fibre-optic system. The quarantined archive used an `.r01`…
SANS ISC
Wed 16 Sep· 2 articles
-
Hotel Systems Scanned for Abandoned PIAF-HMS Vulnerabilities
SANS Internet Storm Centre reported on 16 September 2026 that internet scans were targeting applications associated with hotel and hospitality systems. The activity began on 15 September and continued the following day, using the user agent…
SANS ISC
