News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 23 so far | 4 |
Developing
Mon 4 May40 articles
- Attackers hit over 40k cPanel servers via CVE-2026-41940 flaw
Over 40,000 servers have likely been compromised as attackers intensified exploitation of a recently patched cPanel zero-day, CVE-2026-41940. According to The Shadowserver Foundation, threat actors are exploiting this critical authentication-bypass…
2 articles this day · DataBreaches first · 2 outlets
Instructure breach exposes 275M as ShinyHunters leaks data · ShinyHunters strike Instructure again, exposing 275m recordsShow 2 articlesHide 2 articles
- Instructure breach exposes 275M as ShinyHunters leaks data07:02SecurityWeek
- ShinyHunters strike Instructure again, exposing 275m records00:00DataBreaches
- Instructure breach exposes 275M as ShinyHunters leaks data
- Malwarebytes flags cPanel flaw putting millions of sites at risk
Malwarebytes Labs published a week-in-security roundup for April 27–May 3, 2026, on May 4, 2026. The piece points readers to several posts from that period, including an actively exploited cPanel bug that exposes millions of websites to takeover (May 1,…
Malwarebytes - Bluekit phishing kit adds AI tools and 40+ website templates
Bluekit is a newly discovered phishing kit still in development that combines AI features with automated domain setup and a centralised dashboard for campaign management. According to Varonis Threat Labs, it offers over 40 website templates and tools for…
Security Affairs - Operation Level Up nets 276 arrests in global crypto scam bust
A coordinated international operation led by Dubai Police under the UAE Ministry of Interior, in partnership with the FBI and the Chinese Ministry of Public Security, has arrested at least 276 suspects and shut down nine crypto scam centres used to defraud…
The Hacker News - ISC Stormcast Episode Out, Threat Level Green for May 4, 2026
ISC Stormcast for Monday, 4 May 2026 notes a posted episode and directs readers to the podcast detail at 9916 for more information. According to Didier Stevens, the handler on duty, the publication carries a threat level described as green. The page invites…
SANS ISC
Sun 3 May9 articles
- Salt Typhoon breach IBM subsidiary in Italy: a warning for Europe’s digital defenses
In late April 2026, Sistemi Informativi, an IBM Italy subsidiary that provides IT infrastructure management for public and private institutions, suffered a breach that has prompted concerns about Chinese-linked cyber operations in Europe, according to La…
Security AffairsGhostEmperor - Wireshark patches dozens of flaws after AI driven bug hunt
Wireshark 4.6.5 released fixes 43 vulnerabilities (38 CVEs) and 35 bugs, according to Didier Stevens. The release notes say the high number of fixes is due to AI-assisted vulnerability reports, a point echoed in a quoted line: "This release fixes quite a few…
SANS ISC - Pentagon inks AI deals with seven tech firms for classified use
The Pentagon said on May 3, 2026 that it has reached deals with seven tech companies to use their artificial intelligence in its classified computer networks, enabling the military to access AI-powered capabilities to aid warfighter decision-making in…
SecurityWeek - Security Affairs Newsletter Round 95 Highlights Malware Threats
The SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 95, authored by Pierluigi Paganini, was published on 03 May 2026 and presents a curated collection of malware-focused articles and research from around the international landscape. The piece explains that the…
Security Affairs - CISA adds critical cPanel auth bypass flaw to KEV catalogue
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in WebPros cPanel to its Known Exploited Vulnerabilities catalog, tracked as CVE-2026-41940, a login-flow authentication bypass affecting cPanel and WHM versions after 11.40…
- Security Affairs newsletter Round 575 by Pierluigi Paganini – INTERNATIONAL EDITION
Security Affairs newsletter Round 575 by Pierluigi Paganini – INTERNATIONAL EDITION was published on 3 May 2026, presenting a weekly digest of Security Affairs stories alongside international press coverage. The edition highlights several items, including…
Security Affairs - Malwarebytes urges small biz: use EIN, secure cloud, lock devices
Malwarebytes highlights three cybersecurity risks for small businesses that require little technical know-how. First, it notes that in the US the Internal Revenue Service allows small business owners to use their personal Social Security Number as the…
Malwarebytes - Google raises Android zero click bounty to $1.5m in AI shift
Google has announced a major overhaul of its Vulnerability Reward Programs for Android and Chrome, shifting the emphasis from quantity to quality and real-world impact in the AI era. The Android top reward for a zero-click exploit on the Pixel’s Titan M with…
Security Affairs - CISA flags CVE-2026-31431 Linux kernel flaw under active attack
CISA has added CVE-2026-31431, a Linux local privilege escalation flaw also known as Copy Fail, to its Known Exploited Vulnerabilities (KEV) catalog, with evidence of active exploitation in the wild. The vulnerability could allow an unprivileged local user…
Sat 2 May8 articles
- Ex Cybersecurity Pros Jailed for $1.2m BlackCat Ransomware Scheme
Two US cybersecurity professionals, Ryan Goldberg and Kevin Martin, were sentenced to four years in prison for their roles in supporting ransomware attacks, with a third accomplice, Angelo Martino, awaiting sentencing in July. According to DoJ, the three men…
Security AffairsALPHV/BlackCat - Trellix Detects Source Code Repository Breach, Says No Tampering
Trellix disclosed a security breach affecting part of its source code repository, with unauthorized access to a portion of the codebase. The company said it quickly launched an investigation with forensic experts and notified law enforcement. While the exact…
Security Affairs - Maryland pharmacist indicted for hacking, stealing medical data
A Maryland man has been federally indicted on an unauthorized computer access scheme linked to a Maryland medical system, with charges that include two counts of unauthorized access to a protected computer and one count of aggravated identity theft. The…
DataBreaches - Russian hacker Digit admits to attacking oil, gas and power sites
Artem Revensky, the Russian hacker known as “Digit,” has pleaded guilty to orchestrating cyberattacks aimed at critical infrastructure in Ukraine, the United States, and several other nations, according to Bloomberg. He was a member of the hacking group…
DataBreachesSector16 - New Bluekit phishing kit adds AI assistant for automated attacks
New Bluekit Phishing Kit Features AI Assistant reports a recently discovered kit that offers miscreants a broad range of capabilities, including an AI assistant and automated domain registration, according to Varonis. Dubbed Bluekit, it is advertised as…
SecurityWeek - Deep#Door malware hides in batch files to hijack Windows PCs
Security researchers at Securonix flag a sophisticated campaign called Deep#Door, a Python-based backdoor embedded inside a batch dropper that reconstructs itself in memory and on disk during execution to target Windows systems. The loader reads…
Security Affairs - Trellix confirms source code accessed in recent security breach
According to Trellix, it suffered a breach that enabled unauthorized access to a portion of its source code, with the company stating that it “recently identified” the compromise and that it has engaged leading forensic experts to resolve the matter and…
The Hacker News - Microsoft warns CVE-2026-31431 lets Linux users get root in cloud
Microsoft Defender researchers warn of CVE-2026-31431, a Copy Fail vulnerability that enables Linux root privilege escalation across cloud environments, affecting multiple major Linux distributions including Red Hat, SUSE, Ubuntu and AWS Linux. The flaw, a…
Fri 1 May43 articles
- Threat actors exfiltrate data 4x faster via endpoint gaps
The article notes that the 2026 Unit 42 Global Incident Response Report shows threat actors are now moving four times faster to exfiltration than in 2025, with attackers deliberately exploiting blind spots created by relying on endpoint data. It highlights…
Unit 42 - CISA Flags Linux Kernel Flaw CVE-2026-31431 in KEV Catalog
CISA has added CVE‑2026‑31431 to its Known Exploited Vulnerabilities catalogue, affecting the Linux kernel produced by the Linux vendor. The vulnerability, named Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, allows an attacker to…
- Cloudflare wraps up Code Orange Fail Small, strengthens network
Code Orange: Fail Small is complete, and Cloudflare says the result is a stronger network. Over the past two and a bit quarters, the project delivered safer configuration changes, reduced the impact of failures, and revamped incident management and…
Cloudflare - North Korea Holds 76% of Stolen Crypto in 2026 After Big Hacks
The article reports that 76% of all crypto stolen in 2026 is now in Pyongyang, North Korea, based on data analysed by TRM Labs. It notes that almost all of North Korea’s crypto winnings from January to April this year came from two incidents: an attack…
Dark ReadingTraderTraitor - Canonical hit by cross border DDoS, Ubuntu services down
Ubuntu infrastructure operated by Canonical has been offline since Thursday morning, with attempts to connect to most Ubuntu and Canonical webpages and download OS updates failing over the past 24 hours. Updates from mirror sites have continued to work…
Ars Technica - Malvertising pushes MacSync Stealer via fake Homebrew site
Malicious ads targeting macOS are on the rise, with a page impersonating Homebrew used to push MacSync Stealer to potential victims. The diary notes the example appeared on Thursday, 30 April 2026, and that the fake Homebrew page at…
SANS ISC - Thomson Reuters sued over SSN display under Michigan privacy law
A class of Michiganders has filed a federal lawsuit in the U.S. District Court for the Eastern District of Michigan alleging that Thomson Reuters search engines publicly displayed their Social Security numbers. The case, filed on a Thursday, argues the…
DataBreaches - Phishing via Google AppSheet compromises 30000 Facebook accounts
The article discusses a significant cybersecurity breach where approximately 30,000 Facebook accounts were hacked through a phishing campaign utilizing Google AppSheet. The article highlights methods employed by attackers, the significance of such…
The Hacker News - Lazarus Exploits Fake Interviews to Steal Developer Credentials
According to LAZARUS, the DPRK Contagious Interview campaign represents a mature evolution of intrusion tradecraft that weaponises legitimate hiring workflows to induce execution of malicious code within trusted developer environments. The campaign targets…
dti.domaintools.comLazarus Group - Delta Dental penalised $2.25M for MOVEit breach response lapses
According to the New York State Department of Financial Services, Delta Dental Insurance Company (DDIC) and Delta Dental of New York, Inc. (DDNY) will pay a $2.25 million penalty for violations of 23 NYCRR Part 500, following a 2023 MOVEit Transfer breach…
DataBreaches - GPT5.5 matches Mythos Preview in UK AI Security Institute tests
Last month, the UK’s AI Security Institute (AISI) (which has run 95 Capture the Flag challenges since 2023) found that OpenAI’s GPT-5.5 reached a similar level of performance on their cyber evaluations as Mythos Preview, despite Mythos’ hype. On expert…
Ars Technica - FBI warns of cyber enabled cargo theft costing $725 million
The FBI has issued a Public Service Announcement warning of a surge in cyber-enabled cargo theft, as hackers increasingly target brokers and carriers and impersonate legitimate businesses to hijack freight. Since 2024, attackers have used phishing emails,…
Security Affairs - In Other News: Scattered Spider Hacker Arrested, SOC Effectiveness Metrics, NSA Tool Vulnerability
In Other News highlights a busy week, led by OFAC designation of two cryptocurrency wallets tied to Iran’s Central Bank, with Tether freezing about $344 million in USDT across the addresses and roughly $370 million having accumulated through nearly 1,000…
SecurityWeekScattered Spider - Microsoft Agent 365 GA release adds shadow AI detection
Microsoft Agent 365 is now generally available for commercial customers, with general availability announced alongside new capabilities and integrations to help organisations observe, govern and secure agent activity across local, cloud and SaaS…
Microsoft - AI coding agent wipes production database after rushed deployment
The article argues that AI misbehaviour in production isn’t a fault of AI itself but of organisations rushing AI agent integrations into live environments without adequate security testing. It describes a case where an AI coding agent, Cursor running…
Dark Reading - Google Hikes Android Bounty to $1.5M, Trims Chrome Rewards
Google has overhauled its Vulnerability Reward Programs for Chrome and Android in response to a surge in AI-enabled vulnerability discovery, with Android rewards rising even as Chrome payouts fall. The maximum Android VRP payouts have increased, with…
SecurityWeek
