News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 45 so far | 5 |
Developing
Wed 29 Apr47 articles
2 articles this day · SecurityWeek first · 2 outlets
CVE-2026-3854: GitHub patches critical RCE bug in push pipeline · Critical GitHub RCE flaw lets attackers run code via simple pushShow 2 articlesHide 2 articles
2 articles this day · Security Affairs first · 2 outlets
CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw · CISA Adds ConnectWise ScreenConnect Path Flaw and Windows Shell BugShow 2 articlesHide 2 articles
- CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw08:46The Hacker News
- CISA Adds ConnectWise ScreenConnect Path Flaw and Windows Shell Bug07:40Security Affairs
- CISA Flags Actively Exploited CVE-2024-1708 and Windows Flaw
- ShinyHunters exploit Anodot incident to target Vimeo
Vimeo confirmed a security breach linked to Anodot, with metadata, video titles and some user email addresses exposed, while user-uploaded videos, login credentials and payment card data were not affected and the service continued to operate normally. The…
Security AffairsShinyHunters - LiteLLM SQL flaw CVE‑2026‑42208 exploited hours after disclosure
LiteLLM has a critical SQL injection flaw tracked as CVE-2026-42208 (CVSS 9.3) that was exploited in the wild within 36 hours of disclosure, according to The Hacker News. The vulnerability allows an unauthenticated attacker to read and potentially modify the…
- ISC Stormcast: green threat level, Johannes Ullrich hosts podcast
ISC Stormcast for Wednesday, 29 April 2026 notes a threat level of green and identifies Johannes Ullrich as the Handler on Duty. The page provides a podcast detail at https://isc.sans[.]edu/podcastdetail/9910, and invites readers to click through to learn…
SANS ISC
Tue 28 Apr54 articles
- North Korea’s BlueNoroff uses fake Zoom to steal crypto exec data
North Korea’s BlueNoroff state-sponsored group is running a financially motivated campaign that targets cryptocurrency executives by using stolen victim videos, AI-generated avatars, and fake Zoom meetings to induce malware infections, according to Arctic…
Dark ReadingLazarus Group 2 articles this day · The Hacker News first · 2 outlets
CVE-2026-3854 flaw lets attackers run code via simple git push · GitHub flaw (CVE-2026-3854) lets attackers run code via one pushShow 2 articlesHide 2 articles
- CVE-2026-3854 flaw lets attackers run code via simple git push20:39Security Affairs
- GitHub flaw (CVE-2026-3854) lets attackers run code via one push18:19The Hacker News
- CVE-2026-3854 flaw lets attackers run code via simple git push
- NSA’s former chief urges firms to learn from Snowden fallout
Chris Inglis, the head civilian in charge at the NSA when Edward Snowden’s leaks exploded, reflects 13 years on about the episode and what enterprises can learn from it. He notes that Snowden alleged abuses of privilege, but, according to the investigations…
Dark Reading - Moldova health database hit in cyber attack, 30% data lost
Moldova’s Cybersecurity Agency has reported a large-scale attack on the country’s main medical database, damaging around 30% of the information. The agency’s deputy director said the attackers had been targeting the platform over the past month. The database…
DataBreaches - Elastic Labs releases CI tool to stop pipeline secret leaks
Elastic Security Labs outlines how an open-source, drop-in CI template called cicd-abuse-detector can help catch abuse across GitHub Actions, GitLab CI, and Azure DevOps pipelines. Published on 29 April 2026 by Mika Ayenson, PhD, the piece explains that…
elastic.co - Microsoft Windows Shell flaw allows network spoofing; patch urged
On 28 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑32202 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft Windows and is named the Microsoft Windows Protection Mechanism Failure…
2 articles this day · Infosecurity first · 2 outlets
0APT vs KryBit ransomware feud leaks data, helps defenders · Ransomware rivals leak each other's data, then rebuildShow 2 articlesHide 2 articles
- 0APT vs KryBit ransomware feud leaks data, helps defenders20:13Dark Reading
- Ransomware rivals leak each other's data, then rebuild13:00Infosecurity
- 0APT vs KryBit ransomware feud leaks data, helps defenders
- CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited
On 28 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2024‑1708 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects ConnectWise ScreenConnect and is a path traversal vulnerability that could allow an…
- Vidar malware surges to top after law enforcement takedowns of rivals
Vidar, a credential-stealing malware lurking in the cybercriminal ecosystem since 2018, has risen to the top of the chaotic infostealer market following this year’s law‑enforcement takedowns of Lumma and Rhadamanthys. According to Intrinsec, Vidar’s author…
Dark Reading - MFA misconfig fuels biggest ransomware loss in manufacturing
According to Resilience, security leaders can translate technical risk into financial terms by using insurance data that links specific cyber events to losses. The latest analysis focuses on ransomware in manufacturing, noting that in 2025 manufacturing was…
SecurityWeekALPHV/BlackCat - Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign
According to The Hacker News, a Brazilian-origin cybercrime group has resurfaced after more than three years with a Minecraft-focused campaign, deploying a new infostealer named LofyStealer (aka GrabBot). The malware masquerades as a Minecraft hack called…
The Hacker NewsLofyGang 2 articles this day · Infosecurity first · 2 outlets
Vimeo breach hits Anodot, emails exposed by ShinyHunters · Medtronic investigates breach after ShinyHunters data claimShow 2 articlesHide 2 articles
- Vimeo breach hits Anodot, emails exposed by ShinyHunters17:11SecurityWeek
- Medtronic investigates breach after ShinyHunters data claim15:30Infosecurity
- Vimeo breach hits Anodot, emails exposed by ShinyHunters
- The Mythos Moment: Enterprises Must Fight Agents with Agents
The Mythos Moment: Enterprises Must Fight Agents with Agents argues that the rapid adoption of agentic AI, such as Claude Mythos, could enable attacks to be discovered and executed at scale with minimal human intervention, prompting a shift to autonomous,…
SecurityWeek - Webinar tackles Shadow AI with practical governance roadmap
Live webinar co-hosted by Airia and SecurityWeek explores a practical, multi-layered roadmap to move from fragmented AI usage to a governed, scalable ecosystem, addressing the rise of Shadow AI where employees adopt generative and agentic tools without IT…
SecurityWeek - Malicious VS Code Extensions Spread via Open VSX Marketplace
A fresh wave of GlassWorm extensions for Visual Studio Code is spreading self-propagating malware via the Open VSX marketplace, an open source alternative to Microsoft's Visual Studio Marketplace. Researchers from Socket discovered a cluster of 73 so‑called…
Dark Reading - Robinhood says attackers abused signup flow for phishing emails
Robinhood has confirmed that cybercriminals exploited a vulnerability in its account creation flow to send out legitimate-looking phishing emails, rather than a breach of its systems or customer accounts. The emails came from a Robinhood address and carried…
SecurityWeek - Handala group threatens US troops in Bahrain with missile warnings
On 28 April 2026, U.S. service members in Bahrain began receiving WhatsApp messages signed by a group calling itself Handala, claiming that missiles and drones were already aimed at them and that their identities were under surveillance, with the messages…
SOCRadarHandala - VECT 2.0 Ransomware Functions as Wiper, Destroys Large Files
Threat hunters say that the cybercrime operation known as VECT 2.0 behaves more like a wiper than a ransomware due to a flaw in its encryption across Windows, Linux and ESXi that makes recovery impossible even for the attackers. The locker permanently…
The Hacker News - German officials hit by Signal phishing tied to Russian actors
A phishing campaign targeting German officials, suspected to be orchestrated by Russian actors, has been uncovered. The operation exploited the Signal messaging platform to vitiate trust, prompting high-profile targets, including politicians and diplomats,…
Security Affairs - Senators Demand Answers on BlueLeaks 2.0 Education Data Breach
DataBreaches[.]net casts the BlueLeaks 2.0 incident as potentially the worst privacy breach seen in education sector reporting in two decades, with questions surrounding P3 Global Intel and Navigate360's disclosures. The piece notes that U.S. Senators Maggie…
DataBreaches - US extradites Chinese national over Typhoon university hacks
A Chinese national accused of belonging to the Silk Typhoon state-sponsored threat group was extradited from Italy to the US over the weekend, according to the Department of Justice. Xu Zewei, 34, was arrested in July 2025 after being charged in the US for…
SecurityWeekHAFNIUM - Vercel bypass header probed via open proxy to lower security
This entry discusses the observation of HTTP requests containing the 'X-Vercel-Set-Bypass-Cookie' header directed at a honeypot. The header is associated with Vercel's testing features that allow for disabling certain security protections. The article…
SANS ISC - VECT ransomware flaw destroys large files, researchers warn
Check Point Research has analysed VECT 2.0, a ransomware-as-a-service that targets Windows, Linux and ESXi with a shared codebase, but presents itself with a professional facade that belies a flawed implementation. The study finds that VECT uses…
Check Point - Sentinel UEBA adds behavioural tables to AWS CloudTrail logs
Microsoft Sentinel UEBA now extends AWS analysis by enriching CloudTrail logs with behavioural context across hybrid environments, surfacing in two tables: BehaviorAnalytics and Anomalies. The approach moves away from heavy baselining and thresholds, instead…
Microsoft - Internet outages rise amid govt shutdowns, power cuts and strikes
The first quarter of 2026 saw an unusually high number of prolonged Internet disruptions driven by government-directed shutdowns, power outages and military action, with Uganda, Iran and the Republic of Congo among the most affected. Uganda’s nationwide…
Cloudflare - GlassWorm malware hides in 73 cloned Open VSX extensions
Over 70 Open VSX extensions published in April are likely sleeper extensions linked to the GlassWorm malware, with Socket later identifying 73 suspicious clones that mirror popular listings. GlassWorm first appeared in the Open VSX registry in October 2025…
SecurityWeek - US extradites Chinese hacker over COVID 19 mail server hack
A suspected state-linked hacker has been extradited to the US, according to the Department of Justice, after being charged over a series of intrusions carried out between February 2020 and June 2021, some linked to the Silk Typhoon campaign. Xu Zewei, a…
Infosecurity - Explaining the Five Stages of the Threat Intelligence Lifecycle
The 5 Stages of The Threat Intelligence Lifecycle describe a structured, continuous process security teams use to transform raw security data into actionable intelligence. The lifecycle begins with Planning & Direction, where intelligence needs are defined…
SOCRadar - Sevii launches Cyber Swarm Defense, $50 per asset per year
Sevii has unveiled a Cyber Swarm Defense (CSD) mode within its autonomous defence and remediation platform, launched on 28 April 2026. The new mode avoids charging by AI token usage and instead bills per asset protected, with an example price of $50 a year…
SecurityWeek - Security Leaders Caution Manual Data Transfers Amplify Cyber Risks
According to Cyber360: Defending the Digital Battlespace, a survey of 500 security leaders in government, defence and critical services across the US and UK found that 84% agree that sharing sensitive data across networks heightens cyber risk, while 53%…
The Hacker News
