News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 35 so far | 5 |
Developing
Thu 30 Apr53 articles
- Teenager Held Over Leak of 19 Million French ID Records
A 15-year-old has been arrested following a cyberattack on France’s National Agency for Secure Titles (ANTS). The breach, reported to have occurred on 13 April 2026, exposed approximately 19 million ID records containing passport, national ID card, and…
DataBreaches 2 articles this day · SecurityWeek first · 2 outlets
CISA flags critical cPanel WHM auth flaw allowing remote takeover · Critical cPanel Auth Bypass (CVE-2026-41940) Exposes 1.5M ServersShow 2 articlesHide 2 articles
- BIS Agent Claims WhatsApp Encryption Is Fake, Launches Probe
A BIS special agent claimed in early 2026 that Meta’s WhatsApp encryption is fake and that the company can access and store all user messages in an unencrypted form, a claim that prompted an internal probe nicknamed “Operation Sourced Encryption.” After…
Security Affairs - Lightning PyPI Package Hijacked for Credential Stealing Attack
The Hacker News reports that the Python package Lightning on PyPI was compromised to push two malicious versions, 2.6.2 and 2.6.3, both published on 30 April 2026, in an extended supply chain campaign aimed at credential theft. According to security…
The Hacker News - Shai Hulud worm hijacks Intercom SDK to steal cloud credentials
According to StepSecurity, the Shai-Hulud worm has pivoted to a multi-cloud credential sweep with intercom-client@7.0.4, the official Intercom Node[.]js SDK, boasting 361,510 weekly downloads. The malicious version was published today at 14:41 UTC via a…
StepSecurity - Ukraine Trio Arrested for Roblox Phishing Scheme That Stole $225k
Three people have been arrested in Ukraine over suspected involvement in a phishing and malware scheme that targeted Roblox, with the Prosecutor General’s Office of Ukraine saying a 19-year-old from Drohobych and two others aged 21 and 22 were taken into…
Infosecurity - Microsoft adds agent threat detection to Defender, links GitHub
According to Microsoft Security, the latest updates spotlight new capabilities in the Agent 365 tooling gateway, with Defender features now available in preview to detect, block and investigate anomalous behaviour of AI agents in near real time. The…
Microsoft - Ukrainian police arrest trio behind Roblox account theft ring
Hackers stole over 610,000 Roblox accounts, including valuable 'elite' accounts, generating around $225,000 from their sale. The Ukrainian authorities arrested three suspects involved in distributing malware disguised as game enhancements to steal login…
Malwarebytes - Lightning PyPI package compromised, steals secrets via JS payload
On 30 April 2026, a supply chain compromise was identified in the lightning PyPI package, affecting versions 2.6.2 and 2.6.3. On import, a daemon thread silently downloads the Bun JavaScript runtime from GitHub and executes router_runtime.js, an 11 MB…
StepSecurity - Stealthy Python backdoor Deep#Door targets Windows for spying
Deep#Door is a stealthy Python-based backdoor framework identified as targeting Windows systems, capable of long-term surveillance and credential theft. According to Securonix, the malware, dubbed Deep#Door, uses an obfuscated batch script to deploy a…
Infosecurity - Email threat landscape: Q1 2026 trends and insights
In Q1 2026, Microsoft Threat Intelligence detected 8.3 billion email-based phishing threats, with a decrease in volume from January to March. Notably, QR code phishing saw a 146% increase, becoming the fastest-growing attack vector. Credential phishing…
Microsoft - SonicWall Urges Immediate Patching of Firewall Vulnerabilities
SonicWall on Wednesday rolled out fixes for three SonicOS vulnerabilities, urging customers to immediately patch their Gen 6, Gen 7, and Gen 8 firewalls, with one high-severity and two medium-severity flaws. According to SonicWall advisory, the high-severity…
SecurityWeekCVE-2026-0204 - Malicious Code Infects SAP NPM Packages in Mini Shai Hulud Attack
Four SAP NPM packages were found injected with malicious code in a supply chain attack dubbed Mini Shai-Hulud. On April 29, four package versions were flagged as malicious: npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm…
SecurityWeek - Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
According to Krebs on Security, a Brazilian tech firm that specialises in network protection has been linked to enabling a botnet used in an extended campaign of massive DDoS attacks against Brazilian ISPs. The exposed file archive allegedly contained…
- New zero trust guide helps secure OT in critical infrastructure
According to Infosecurity Magazine, a new joint guide detailing how to apply zero-trust principles in operational technology environments has been released by US government agencies, led by the US Cybersecurity and Infrastructure Security Agency (CISA)…
Infosecurity - SMS blaster bust, OpenEMR flaws, 600K Roblox accounts hacked
ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories provides a snapshot of a busy week in cybersecurity, noting the bulletin covers 25 stories in total. Canadian authorities have arrested three men for operating an…
The Hacker NewsCVE-2026-24908 - Oracle Red Bull Racing Uses 1Password to Speed Wind Tunnel Reset
Oracle Red Bull Racing has recently accelerated security automation by implementing 1Password tools for automation, credential access, governed access and SaaS management, with the partnership kicking off in February 2025. The system acts as a central…
Dark Reading - Cloudflare rolls out post-quantum IPsec supports Cisco & Fortinet
Post-quantum encryption for Cloudflare IPsec is generally available, with Cloudflare using hybrid ML-KEM to protect IPsec traffic and stop harvest-now-decrypt-later attacks. According to the article, ML-KEM is specified in the draft-ietf-ipsecme-ikev2-mlkem…
Cloudflare - UK education sees rise in cyber breaches as phishing dominates
The British public education sector has faced a significant increase in cyber breaches over the past year, despite stable threat levels recorded in the UK. According to Cyber Security Breaches Survey 2025/2026, released on 30 April 2026 by DSIT and the Home…
Infosecurity - Stealthy Python backdoor DEEP#DOOR harvests data via Rust tunnel
Cybersecurity researchers have detailed a stealthy Python-based backdoor framework named DEEP#DOOR that promises persistent access and the harvesting of a wide range of sensitive information from compromised hosts, disclosed in a report published on 30 April…
The Hacker News - Critical Gemini CLI flaw lets attackers run arbitrary host code
SecurityWeek reports a critical remote code execution flaw in Gemini CLI, an open source AI agent that provides lightweight access to Gemini from a terminal, which could allow an attacker to run commands on the host by planting a malicious configuration in…
SecurityWeek - AI speeds up flaw hunting, leaving defenders chasing shadows
In Darktrace’s Mythos vs Ethos piece, Andrew Hollister explains that AI systems such as Mythos are accelerating vulnerability discovery to the point where attackers may exploit flaws before public disclosure, undermining the traditional CVE-driven model. The…
darktrace.com - ABB PCM600 flaw lets attackers execute code via crafted messages
The ABB PCM600 ICS Advisory ICSA-26-120-02 was released on 30 April 2026. According to CISA, the advisory states that successful exploitation of this vulnerability could allow an attacker to send specially crafted messages to the system node, resulting in…
CISACVE-2018-1002208 - ABB Symphony Plus PostgreSQL bug enables remote code execution
According to ABB PSIRT 7PAA017341, the ABB Ability Symphony Plus Engineering product lines are affected by vulnerabilities in PostgreSQL version 13.11 and earlier, which could allow an authenticated PostgreSQL user to execute arbitrary code if they gain…
CISACVE-2023-5869 - Remote flaws in EnOcean SmartServer expose buildings to hacking
EnOcean SmartServer Flaws Expose Buildings to Remote Hacking reports that two vulnerabilities, tracked as CVE-2026-22885 and CVE-2026-20761, were uncovered by Claroty researchers in EnOcean’s SmartServer IoT platform. According to Claroty, these flaws can be…
SecurityWeekCVE-2026-22885 - Lazarus linked EtherRAT spreads via GitHub facades, Ethereum C2
The EtherRAT distribution campaign described by The Hacker News in April 2026 uses a multi-layered GitHub facade approach to deliver malicious MSI installers impersonating common administrative tools, aided by aggressive SEO poisoning across search engines…
The Hacker News - ‘Copy Fail’ Logic Flaw in Linux Kernel Enables System Takeover
A high-severity logic bug in the Linux kernel allows unprivileged attackers to write code to other files’ memory and obtain a root shell, according to Theori. Tracked as CVE-2026-31431 (CVSS 7.8) and dubbed Copy Fail, the issue is believed to affect all…
- Europol busts Albanian scam that stole €50m, 10 arrested
Europol has announced a major achievement in the online fraud fight after a two-year operation led to 10 arrests at suspected Albanian scam call centres. The network behind the call centres is described as running a highly professionalized investment fraud…
Infosecurity - CVE-2026-31431: Linux flaw lets local users gain root via cache
A high‑severity Linux local privilege escalation flaw, tracked as CVE‑2026‑31431 and codenamed Copy Fail by Xint[.]io and Theori, could let an unprivileged local user gain root by writing four controlled bytes into the page cache of a readable file.…
The Hacker News - EU accuses Meta of allowing under 13s on Instagram, Facebook
According to the European Commission, Meta is being accused of violating the Digital Services Act by failing to protect minors on Instagram and Facebook, with under-13s able to access the platforms despite minimum age rules. The commission says Meta did not…
Security Affairs - Cyber threat literacy tops Marsh's 2026 people risk survey
Cyber-related challenges dominate the top 10 people risks highlighted in Marsh’s 2026 People Risks report, which is compiled from interviews with over 4500 HR and risk professionals across 26 global markets. The survey found that technological change and…
Infosecurity - Sandhills Medical Ransomware Leak Exposes 170k Patient Records
South Carolina-based Sandhills Medical Foundation has disclosed a data breach affecting nearly 170,000 individuals. The organisation said in a data security incident notice that it discovered a ransomware attack on 8 May 2025 and has since worked with law…
SecurityWeekInc Ransom - Ukrainian police bust ring that hijacked 610k Roblox accounts
Ukrainian police arrested three suspects accused of hijacking 610,000 Roblox accounts and selling them for about $225,000 in profit, according to a press release published by Prosecutor General’s Office. The operation involved searches in Lviv and the…
Security Affairs - Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution
Google has fixed a maximum severity security flaw in Gemini CLI and related GitHub Actions that could have allowed an attacker to execute code on a host, with Novee Security describing the issue as a CVSS 10.0 RCE vulnerability that could load malicious…
The Hacker NewsCVE-2026-26268 - Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor
Silver Fox has been observed targeting organisations in Russia and India by posing as tax authorities to distribute ValleyRAT alongside a new backdoor named ABCDoor, with the activity attributed to the Silver Fox threat group. The campaign began with a…
securelist.comVoid Arachne - Phishing drills lag behind real threats, leaving firms exposed
Training on Fiction While the Real Threat is in Your Inbox argues that security awareness programmes have evolved but still rely too much on outdated, generic simulations. The piece notes that phishing remains the dominant initial access vector and that real…
cofense.com - ISC Stormcast Sets Green Threat Level with Guy Bruneau On Duty
ISC Stormcast for Thursday, 30 April 2026 outlines the current threat level as green and provides details for the day’s briefing. The diary notes the Handler on Duty as Guy Bruneau, who is responsible for the published content and discussions. The entry…
SANS ISC - Redtail miner spread via CVE-2024-4577 Libredtail HTTP attacks
According to SANS Internet Storm Center, a guest diary by James Roberts details observations from a DShield honeypot where libertail-http activity was prominent and linked to cryptomining malware. The narrative notes that three top IP addresses from Germany,…
- Japan's Banks Unite Over AI Threat From Anthropic's Mythos Model
Claude Mythos Fears Startle Japan's Financial Services Sector reports that global financial institutions are panicked over Anthropic's new superhacker AI model, while cyber experts remain more measured. On 24 April 2026, Japan’s finance minister, the…
Dark Reading
