News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Tue 13 Oct· 3 articles
-
n0n Extortion Group Targets 38 Maritime Operators in Data Theft Campaign
The SOCRadar cyber threat tracker reports that the n0n extortion group expanded its activity on 12 October 2026 by adding 38 global ports, shipping lines, port IT providers and related operators to its Dark Web leak site. The batch spans Brazil, Spain,…
SOCRadarn0n -
Attackers Set French Supermarket Freezers to Defrost, Causing Fires
Overnight from 11 to 12 October 2026, hundreds of French supermarkets were hit when attackers remotely forced refrigeration controllers to switch into defrost mode, heating fridges and freezers to as high as 50°C. The resulting spoilage and at least two…
-
GitLab rushes to patch critical flaw enabling unauthenticated server takeover
GitLab has issued an urgent patch for CVE-2026-97229, a critical unauthenticated remote code execution flaw in the CI/CD Regular Expression Compiler. Classified with a CVSS v3.1 score of 10.0, the issue arises from an integer overflow when processing a…
Wed 7 Oct· 2 articles
-
FortiBleed Campaign Locks Administrators Out of 86,000 FortiGate Devices
On 6 October 2026, a joint Cybersecurity Advisory from the FBI and the U.S. Secret Service warned that FortiBleed remains an active global credential‑harvest campaign targeting internet‑facing Fortinet FortiGate firewalls and Fortinet SSL VPN gateways.…
SOCRadar -
Hackers Exploit NetScaler Flaw to Deploy Root-Level C2 Agents
Citrix NetScaler ADC and NetScaler Gateway were publicly disclosed as affected by CVE-2026-88771 on 27 September 2026, described as a log-injection based, unauthenticated remote code execution flaw. SOCRadar’s researchers uncovered an autonomous operation,…
SOCRadar
Tue 6 Oct· 1 article
-
Hackers Exploited Citrix NetScaler Flaw to Knock Services Offline
CVE-2026-88779 is a high‑severity memory overflow that affected Citrix NetScaler ADC and NetScaler Gateway appliances configured for SAML authentication. Exploited as a zero‑day before fixes arrived, the flaw could cause a denial of service by triggering…
Mon 5 Oct· 1 article
-
Dark Web Claims Expose 10 Million French Records and More
SOCRadar’s Dark Web Team report highlights a cluster of fresh underground posts alleging a mix of data leaks and access to compromised infrastructures. The most prominent claim is an IQUALIF-based leak of more than 10 million French residential records, with…
Thu 1 Oct· 2 articles
-
TeamViewer Fixes Flaw Allowing Remote Attackers to Bypass Permissions
TeamViewer has patched five high-severity vulnerabilities across its Full Client and Host applications for Windows, Linux and macOS, with the September 29, 2026 security bulletin TV-2026-1010 rating the issues as Important. The most serious, CVE-2026-92370…
-
Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access
CVE-2026-76504 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Manager (formerly vManage) that lets an unauthenticated remote attacker reach the management API with administrator privileges. Cisco reports active exploitation in September…
Mon 28 Sep· 1 article
-
Citrix Patches NetScaler Zero Days Exploited in Global Attacks
Citrix has issued emergency updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days being exploited in the wild. CVE-2026-88771 and CVE-2026-88772 both have CVSS v4.0…
Fri 25 Sep· 2 articles
-
Blue Locker Ransomware Attack Spurs Pakistan’s Cyber Alert
Blue Locker ransomware was first observed in November 2021 but drew renewed attention after an attack on Pakistan Petroleum Limited (PPL) on 6 August 2025. The attackers encrypted servers and virtual machines, deleted backups and disrupted financial…
SOCRadarBlue Locker -
Roundcube SQL Flaw Exploited in Attacks Against Webmail Servers
A pre-authentication SQL injection flaw in Roundcube Webmail, tracked as CVE-2026-48842 and rated CVSS 8.1, is reportedly being exploited in the wild. The vulnerability affects the virtuser_query plugin, which performs database-backed mappings between…
Mon 21 Sep· 3 articles
-
WordPress Click2Shell Flaw Can Chain Into Remote Code Execution
Security researchers have disclosed “Click2Shell”, a WordPress Core flaw that can make an administrator’s browser install and preview a theme from WordPress.org after the administrator clicks a specially crafted link. The attacker does not need an account on…
SOCRadar -
ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets
ShinyHunters reportedly hijacked and defaced Clop’s (also known as Cl0p) Tor-based data-leak site on 18 September 2026, turning the ransomware group’s extortion platform against it. The attackers allegedly exploited an unauthenticated file-upload…
-
Dark Web Claims Expose Millions of Records and Fortigate Access
SOCRadar’s Dark Web Team reported several underground listings, while stressing that the claims had not been independently verified. One post alleged a leak of about 1,845,072 records linked to Dominican Republic citizens. The sample appeared to contain…
SOCRadar
Wed 16 Sep· 3 articles
-
Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw
Cisco has confirmed active exploitation of CVE-2026-76461, a critical SQL injection vulnerability in the email-parsing logic of AsyncOS Software for Cisco Secure Email Gateway. Rated CVSS 9.8 and classified as CWE-89, the flaw can be exploited remotely…
-
Attackers Exploit WooCommerce Plugin Flaw to Upload PHP Web Shells
Attackers are actively targeting CVE-2026-27540, a critical unauthenticated arbitrary file-upload vulnerability in Rymera Web Co’s Wholesale Lead Capture Plugin for WooCommerce. The flaw, classified as CWE-434 and rated 9.8 Critical by Wordfence, affects…
-
AI-Driven BlackHatSect0r Crew Exposed Millions of Hosts and Secrets
SOCRadar says an internet-exposed operation server linked to the French-speaking crew BlackHatSect0r && DXQRTXX contained 4.9GB across 9,299 files, including a Go-based command-and-control platform, a 16,834-entry credential vault and tooling for scanning,…
SOCRadarBlackHatSect0r & DXQRTXX
Fri 11 Sep· 2 articles
-
SOCRadar Brings Threat Intelligence to AWS Marketplace for Faster Buying
SOCRadar is now available on AWS Marketplace as a Software as a Service (SaaS) offering, enabling organisations that buy through AWS to procure Extended Threat Intelligence more quickly and predictably. The piece argues that procurement friction—new supplier…
SOCRadar -
Claude Code Helped Yemen Cell Design Missile Guidance Software
A small Yemen-based cell used Claude Code to design guidance, navigation and control software for missiles, according to Anthropic’s Threat Intelligence report covering September 2026. The group operated three parallel weapons programs: a guided rocket built…
SOCRadar
Thu 10 Sep· 1 article
-
Public ShieldCrash PoC Claims to Bypass Microsoft Defender Fix
Microsoft has been alerted to a new PoC called ShieldCrash, linked to CVE-2026-69414 (ShieldBreak), the High severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine that Microsoft recently fixed. Nightmare Eclipse’s ShieldCrash claim…
Mon 7 Sep· 2 articles
-
Active Magento RCE Lets Attackers Install Persistent Backdoors
StyleSmuggler is a currently active, unauthenticated remote code execution (RCE) vulnerability affecting Magento Open Source and Adobe Commerce, with attackers installing a persistent backdoor. The flaw, dubbed StyleSmuggler by Dutch security firm Sansec,…
SOCRadar -
SOCRadar Connects ChatGPT to Threat Intelligence via MCP
SOCRadar has released an integration that lets the SOCRadar Threat Intelligence MCP app connect ChatGPT to the SOCRadar MCP server via OAuth, exposing licensed intelligence modules as callable tools within a conversation. Analysts can enrich indicators,…
Thu 3 Sep· 2 articles
-
JFrog Artifactory CVE-2026-82329 Exploited
The article discusses a critical authentication bypass vulnerability in JFrog Artifactory, known as CVE-2026-82329. This vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to gain full administrative control over self-managed…
-
SonicWall CVE-2026-83548 Leads to CISA Alert
SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances, specifically **CVE-2026-83548** (a pre-authentication SSRF flaw) and **CVE-2026-83549** (a post-authentication OS command injection flaw). These vulnerabilities are actively…
Mon 31 Aug· 2 articles
-
Brazil’s SERPRO Data Leak Exposes 214 Million Records on Dark Web
The SOCRadar Dark Web Team reported several significant leaks on underground forums, highlighting major cybersecurity concerns. Key points include: 1. **Finnish Kennel Club Leak**: Over 105,000 records associated with dog shows, containing sensitive…
SOCRadar -
Anthropic warns infostealer malware hijacks Claude user sessions
The article discusses a security warning from Anthropic regarding infostealer malware that can hijack active login sessions of Claude users from infected devices. The malware doesn't exploit a vulnerability in Claude itself but emphasizes the risk of…
SOCRadar
Fri 28 Aug· 1 article
-
OpenAI urges stronger cyber defences as AI driven attacks grow
OpenAI is advocating for an increase in cyber defense capabilities as AI-enabled attacks rise in complexity. The organization's recommendations center around three key principles: improving current security measures, expanding access to capable cybersecurity…
SOCRadar
Wed 19 Aug· 1 article
-
Telegram's .gram TLD bid sparks phishing and impersonation fears.
Telegram has applied for the .gram top-level domain (TLD) with ICANN, aiming to transform usernames into web-addressable domains. This could facilitate phishing and impersonation, as Telegram has a significant presence in the threat landscape. If approved,…
SOCRadar
Mon 27 Jul· 2 articles
-
Wearable Tech Data Leaks Spark Calls for Stronger App Security
The article discusses the cybersecurity risks associated with wearable technologies, emphasizing the complexity of their ecosystem, which includes devices, companion apps, and cloud services. Key points include the extensive risk posed by companion apps,…
SOCRadar -
Dark Web Leaks Expose Millions of Health, Military Records
The SOCRadar Dark Web Team has uncovered a series of alleged data breaches involving various sectors, including healthcare and military. Key findings include: 1. **Transtreme/HealthNet-CMC/Aetna-CA Data Breach**: Claims of exposure involving 1.16 million…
SOCRadar
Fri 24 Jul· 1 article
-
Zimbra XSS bug CVE‑2025-66376 lets Russian hackers steal mail
CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite's Classic UI, allowing mailbox theft through malicious emails. Exploitation requires the targeted user to view an email containing crafted HTML without…
Tue 21 Jul· 2 articles
-
CVE-2026-6875 Hits ServiceNow AI Platform
CVE-2026-6875 is a critical pre-authentication vulnerability in the ServiceNow AI Platform that allows unauthenticated attackers to execute code under specific conditions. The vulnerability stems from a sandbox escape, threatening the security of ServiceNow…
-
SonicWall SMA 1000 zero day used to spread KNUCKLEBALL
The article discusses critical vulnerabilities in SonicWall SMA 1000 appliances exploited in a zero-day attack campaign leading to the deployment of KNUCKLEBALL malware. The two primary vulnerabilities, CVE-2026-15409 and CVE-2026-15410, allow attackers…
Fri 17 Jul· 1 article
-
CVE-2026-59208 Flaw Lets Attackers Impersonate n8n Users
The article addresses CVE-2026-59208, a vulnerability in n8n Enterprise that allows for cross-issuer impersonation due to improper authentication in token exchanges. The vulnerability arises when a valid token from one issuer can be used to impersonate a…
Mon 13 Jul· 1 article
-
Krybit Ransomware Sparks Double Extortion Threats in 43 Countries
Krybit Ransomware is a new player in the Ransomware-as-a-Service (RaaS) landscape, first detected in March 2026, employing a double-extortion strategy to target organizations for financial gain. Following its launch, Krybit was involved in a notable public…
SOCRadarKrybit
Fri 10 Jul· 4 articles
-
HalluSquatting Turns AI Hallucinations into Malware Delivery Tool
The article discusses the emerging risk of HalluSquatting, a technique where attackers exploit AI models' tendency to generate plausible yet incorrect resource names. This vulnerability allows AI agents to fetch malicious content instead of intended…
SOCRadar -
Saudi MSSP market to double as top 10 providers named for 2026
The article discusses the top 10 Managed Security Service Providers (MSSPs) in Saudi Arabia for 2026, emphasizing the country's growing cybersecurity market with projected expansion from USD 4 billion in 2025 to USD 8.9 billion by 2030, driven by regulatory…
SOCRadar -
Top 10 Cyber Threat Exposure Management Platforms
The article discusses the top 10 Cyber Threat Exposure Management (CTEM) platforms, highlighting their roles in helping organizations manage their cyber exposure effectively. It explains that CTEM is a continuous program aimed at reducing vulnerabilities…
SOCRadar -
Microsoft's AI system MDASH speeds up Windows flaw detection
Microsoft's new system, MDASH, integrates AI into Windows vulnerability management to enhance the identification and validation of software flaws. This proactive approach aims to accelerate discovery, improve validation processes, and speed up security…
SOCRadar
