News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Thu 15 Oct· 15 articles
-
AI-Enabled Espionage Campaign Targets Government Linux Systems
Unit 42 identifies an AI-enabled espionage campaign dubbed CL-UNK-1211, targeting government Linux infrastructure and extended across Linux servers and databases. The operation ran from October 2025 to April 2026, with attackers pursuing broad…
-
Palo Alto Networks Cloud NGFW3 articles this day · The Hacker News first
CISA Flags Exploited Firewall, Email Gateway and Backup Software Flaws · Palo Alto patches exploited PAN-OS zero-day allowing root access to firewalls
-
CISA Flags Exploited Firewall, Email Gateway and Backup Software Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four newly observed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The list comprises CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519…
-
Palo Alto patches exploited PAN-OS zero-day allowing root access to firewalls
Palo Alto Networks has released patches for a PAN-OS zero-day vulnerability tracked as CVE-2026-0322, which has been exploited in limited attacks against the management interface of PAN-OS. The flaw allows remote code execution and can be exploited by an…
-
Palo Alto Patches PAN-OS Flaw Exploited to Run Code as Root
Palo Alto Networks has released security updates for PAN-OS after a high‑severity remote code execution flaw, tracked as CVE-2026-0322 (CVSS 8.6), was observed being exploited in the wild. The vulnerability affects PAN-OS running on PA‑Series and VM‑Series…
-
-
Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally
ThreatsDay this week showcases a broad mix of exploits, from widely exploited remote code execution chains to novel attacker use of DNS and AI-enabled tooling. The headline concern is active exploitation of PAN-OS GlobalProtect/Prisma Access via…
-
RARLAB WinRAR2 articles this day · The Hacker News first
Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government · Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
-
Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government
Silent Lynx, a threat actor believed to be based in Kazakhstan, has been observed conducting espionage campaigns against energy and government targets across Central Asia, including an assault on the Orsk Oil Refinery in southern Russia and the government of…
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
Silent Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE…
-
-
CISA Flags Critical Atlassian Flaw Letting Attackers Access Files
CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalogue on 15 October 2026. The flaw affects multiple Atlassian products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software…
-
China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day
Google Threat Intelligence Group (GTIG) and Mandiant say the suspected China-linked espionage group ARMORY CASTLE, formerly tracked as UNC5221, exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 as a zero-day in late August 2026. BeyondTrust…
-
Cisco Secure Email3 articles this day · SecurityWeek first
Cisco and Palo Alto Patch Exploited Flaws Enabling Root Access · Cisco Fixes Actively Exploited Secure Email Gateway Flaw Allowing Root Access
-
Cisco and Palo Alto Patch Exploited Flaws Enabling Root Access
Cisco and Palo Alto Networks have issued patches for two actively exploited zero-day vulnerabilities that can enable root-level code execution on security appliances. The flaws, CVE-2026-76519 and CVE-2026-0322, have been added to the US CISA Known Exploited…
-
Cisco Fixes Actively Exploited Secure Email Gateway Flaw Allowing Root Access
Cisco has disclosed a critical flaw in its Secure Email Gateway that threat actors have been actively exploiting, tracked as CVE-2026-76519 with a CVSS of 9.8. The vulnerability resides in the Advanced Malware Protection (AMP) feature and stems from improper…
-
Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access
Cisco has disclosed that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519 with a CVSS of 9.8/10. The flaw affects the AMP (Advanced Malware Protection) component and arises when…
-
-
Ahsay Backup fixes exploited flaws after patches failed to stop attackers
Singapore-based Ahsay Backup has issued updated security patches for AhsayCBS to address two flaws that have been observed in the wild being exploited to deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and…
-
Attackers Exploit SiteGuard Flaw to Seize Server Control as Root
A SiteGuard Server Edition vulnerability, CVE-2026-106931, is exploited in the wild and grants root or SYSTEM access. Update to Ver8.00 Update 5 now. Related Posts: Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws Juniper…
-
Hackers Used FortiManager Flaws to Compromise 500 Firewalls
In September 2024, threat cluster CL-STA-0954, tracked by Mandiant as UNC5820 and attributed to Unit 42, breached a telecommunications managed service provider by exploiting Fortinet’s FortiJump vulnerability, CVE-2024-47575. The attackers gained access via…
Wed 14 Oct· 24 articles
-
Cisco Secure Email3 articles this day · The Hacker News first
Cisco Email Gateways Face Active Attacks That Could Expose Cluster SSH Keys · CISA Flags Exploited Cisco Email Gateway Flaw With Critical Score
-
Cisco Email Gateways Face Active Attacks That Could Expose Cluster SSH Keys
Cisco’s Secure Email Gateway is being exploited in the wild for CVE-2026-76519, a critical arbitrary file write vulnerability rated CVSS 3.1 v3.1 9.8. The flaw lies in the AMP File Reputation feature, specifically in how the file reputation service handles…
-
CISA Flags Exploited Cisco Email Gateway Flaw With Critical Score
CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The Cisco Secure Email Gateway Relative Path Traversal Vulnerability affects Cisco Secure Email Gateway and could let an unauthenticated remote attacker…
-
Cisco Email Gateway Flaw Exploited to Run Commands as Root
Cisco has warned that active attacks are exploiting a critical vulnerability in its Secure Email Gateway. The flaw, tracked as CVE-2026-76519 (CVSS 9.8), can allow a sender with no login to write files to the appliance’s operating system and, if successful,…
-
-
Hackers Stole Configurations for 500 FortiGate Firewalls in FortiManager Breach
Unit 42 reports a multi-stage intrusion against a telecommunications provider, which began in September 2024 with the exploitation of CVE-2024-47575 against a FortiManager appliance. The attackers registered a rogue Virtual FortiGate named localhost on the…
-
Ivanti Connect Secure4 articles this day · SecurityOnline first
Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched · CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks
-
Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched
Ivanti reported that two zero-day flaws in its Ivanti Connect Secure (ICS) hardware and software were exploited in the wild, centring on a high-severity authentication bypass combined with unauthenticated remote code execution (RCE) in SSL-VPN and…
-
CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks
CISA has urged organisations to urgently update Ivanti Connect Secure (ICS) appliances to the latest version after the disclosure of a zero-day authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS 8.6). The flaw affects ICS versions…
-
Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access
Volexity reports a stealthy Ivanti Connect Secure (ICS) VPN attack that chain-exploited three zero-day vulnerabilities to achieve unauthenticated root access on a fully patched appliance running version 22.8R2.4. The exploit chain combines an authentication…
-
Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery
Broadcom has announced a shift to a monthly software security update cadence for its VMware product line, citing the increasing capability of AI to identify defects as a driver for faster remediation. The move implies that organisations will need to devote…
-
-
Microsoft Windows8 articles this day · CISA first
CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections · Microsoft fixes 1,415 flaws as exploited Windows bug puts users at risk
-
CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951, to its Known Exploited Vulnerabilities (KEV) catalog. The advisory notes that the vulnerability is a Windows Shell command…
-
Microsoft fixes 1,415 flaws as exploited Windows bug puts users at risk
Microsoft Patch Tuesday in October 2026 set a new vulnerability record, addressing 1,415 CVEs across Microsoft products and services. The update cycle, described as the first four-digit/month in Microsoft’s reporting, spans Windows and related components,…
-
Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Zero Day
Microsoft’s October Patch Tuesday patch release has set a new record with fixing 1,413 vulnerabilities, including an actively exploited Windows Shell zero-day. The record-breaking bundle underscores the rapid pace of flaws being disclosed and addressed, with…
-
Microsoft Fixes Record 1,411 Flaws as Patch Tuesday Strain Grows
Microsoft’s October Patch Tuesday set a new record, fixing 1,411 CVEs and surpassing the total patched in the whole of 2025. The surge is attributed to Microsoft leveraging AI-assisted vulnerability discovery and remediation through its multi-model agentic…
-
Microsoft’s record 1,413 fixes include a Windows flaw exploited to bypass security warnings
Microsoft has released its October 2026 Patch Tuesday with a record 1,413 CVE fixes across multiple products, including Windows, Office, developer tools, and SharePoint Server. Microsoft notes that 1,102 of the fixes affect Windows, with additional patches…
-
Microsoft patches 1,413 flaws as hackers exploit Windows bug
Microsoft has released a record-breaking Patch Tuesday, delivering fixes for 1,413 vulnerabilities across Windows, Office, Developer Tools, SharePoint Server, and SQL Server. The update slate includes 1,102 Windows flaws, 134 in Office, 61 in Developer…
-
Microsoft Fixes Actively Exploited Windows Flaw in Record Patch Release
Microsoft’s October 2026 Patch Tuesday fixes a record 1,414 vulnerabilities, including 78 rated critical, making it the largest Microsoft release to date. The update slate includes three zero-day flaws, with one already being actively exploited. CISA has…
-
CISA flags actively exploited Windows flaw with 16 October patch deadline
CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. The vulnerability affects Microsoft Windows and is a command injection flaw in Windows Shell that allows an unauthorised attacker to bypass a security…
-
-
Palo Alto Networks Cloud NGFW2 articles this day · SecurityOnline first
CISA Flags Actively Exploited PAN-OS Flaw That Grants Root Access · Palo Alto Patches PAN-OS Flaw Exploited to Gain Root Access
-
CISA Flags Actively Exploited PAN-OS Flaw That Grants Root Access
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The vulnerability affects Palo Alto Networks PAN-OS and could let an authenticated attacker with network access execute arbitrary code as root on a firewall.…
-
Palo Alto Patches PAN-OS Flaw Exploited to Gain Root Access
Palo Alto Networks has disclosed CVE-2026-0322, a high-severity remote code execution flaw affecting PAN-OS managed devices, notably PA-Series, VM-Series and Panorama (virtual and M-Series). The vulnerability sits in the PAN-OS management interface and can…
-
-
CISA Warns of Attacks Exploiting AhsayCBS Authentication Flaw
CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The Ahsay AhsayCBS Improper Authentication Vulnerability affects AhsayCBS and could let a remote attacker bypass authentication by manipulating a parameter…
-
CISA Warns of Active Attacks on Critical AhsayCBS Flaw
CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The flaw affects Ahsay AhsayCBS and is a command injection vulnerability that could let a remote attacker execute operating system commands. The…
-
Collabora Online - Built-in CODE Server3 articles this day · SecurityOnline first
Hackers Exploited Nextcloud Flaw to Plant PHP Web Shells · Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026
-
Hackers Exploited Nextcloud Flaw to Plant PHP Web Shells
Hackers compromised a Nextcloud deployment by exploiting a flaw in Collabora Online’s Built-in CODE Server app (Richdocumentscode). Attackers sent unauthenticated requests to proxy[.]php while the local CODE server was not running (for example during…
-
Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026
Microsoft has announced the end of life for Windows 11 consumer editions running version 24H2, with lifecycle support terminating on 13 October 2026. The final security update for these builds (KB5127648) has already been issued, and Microsoft will stop…
-
Attackers Exploit Nextcloud Collabora Flaw to Plant Webshells
Threat actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). The vulnerability, rated CVSS 9.2, enables unauthenticated attackers to plant PHP…
-
-
Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day
Security updates have addressed 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including several critical-severity flaws that could allow unauthenticated code execution, authentication bypass, DoS, or leakage of sensitive data. Citrix…
Tue 13 Oct· 12 articles
-
Microsoft fixes over 1,400 flaws, including a Windows zero day
Microsoft has issued a sweeping patch batch fixing more than 1,400 security vulnerabilities across Windows operating systems and related software. The roll-up dwarfs September’s near-1,000 fixes and underscores an unusually large month for Microsoft’s patch…