News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 16 so far | 3 |
Developing
Tue 5 May44 articles
- WhatsApp fixes attachment spoof and AI mediated URL bug
Meta-owned WhatsApp has published two security advisories describing vulnerabilities that were patched earlier this year in the messaging app. One is CVE-2026-23863, a medium‑impact attachment spoofing issue affecting WhatsApp for Windows prior to version…
SecurityWeekCVE-2026-23863 - Trellix Confirms Source Code Breach, Launches Forensic Probe
According to Infosecurity Magazine, a leading US cybersecurity vendor has been breached by threat actors who accessed its source code, with Trellix disclosing the incident on May 4 and stating it has notified law enforcement and is working with leading…
Infosecurity - Instructure investigating Canvas breach after ShinyHunters claim
Instructure, the U.S.-based educational technology firm behind Canvas, is investigating a cyber incident that exposed users’ personal data, with the company stating the incident is contained as investigations continue. The breach appears to involve…
Security AffairsShinyHunters - CVE-2026-22679 hits Weaver E‑cology via debug API, enabling RCE
Weaver (Fanwei) E-cology contains a critical unauthenticated remote code execution flaw, CVE-2026-22679, affecting Weaver E-cology 10.0 versions prior to 20260312, and it is actively exploited via a debug API endpoint at…
The Hacker NewsCVE-2026-22679 - Microsoft Details Phishing Campaign Targeting 35,000 Users Across 26 Countries
Microsoft has disclosed a large-scale credential theft campaign that targeted more than 35,000 users across 26 countries, with 92% of targets in the United States, observed between 14 April and 16 April 2026. The majority of phishing emails focused on…
The Hacker News - SANS ISC Stormcast: Green Threat Level, Podcast 9918 Highlights
According to SANS™ Internet Storm Center, ISC Stormcast for Tuesday, 5 May 2026 outlines the latest briefing from the Internet Storm Center. The diary notes a Threat Level of green and identifies Rob VandenBrink as the Handler on Duty. It references a…
SANS ISC - Elastic Workflows 9.4 brings AI powered security automation
Elastic Workflows is generally available in 9.4, delivering production-ready security automation that runs where your data lives across Security, Observability, and Search. According to Elastic Security Labs, the update expands case management to 25…
elastic.co
Mon 4 May40 articles
- Latvian jailed 102 months for ransomware gang's 54 company spree
According to the DOJ’s press release, a Latvian national was sentenced to 102 months in prison for his role in a major Russian ransomware organisation that stole from and extorted over 54 companies. Deniss Zolotarjovs (Денисс Золотарёвс), 35, of Moscow,…
DataBreaches 2 articles this day · The Hacker News first · 2 outlets
Progress fixes MOVEit Automation flaws opening door to file hacks · Progress patches critical MOVEit auth bypass, CVE-2026-4670Show 2 articlesHide 2 articles
- Progress fixes MOVEit Automation flaws opening door to file hacks21:32Security Affairs
- Progress patches critical MOVEit auth bypass, CVE-2026-467016:34The Hacker News
- Progress fixes MOVEit Automation flaws opening door to file hacks
- Phishing campaign abuses remote tools to stay hidden, experts warn
A stealthy phishing campaign targeting organisations across multiple industries has grown by weaponising legitimate IT management tools to bypass security controls, according to researchers. Security researchers at Securonix say the campaign, tracked as…
Dark Reading - Trump admin error exposed health workers’ SSNs in Medicare portal
According to The Washington Post, the Trump administration inadvertently exposed the Social Security numbers of health care providers in a database powering a new Medicare portal. The Centers for Medicare and Medicaid Services last year created a directory…
DataBreaches 4 articles this day · The Hacker News first · 3 outlets
Attackers Exploit cPanel Flaw, Endangering Millions of Websites · cPanel auth bypass exploited in Asian gov, MSP attacksShow 4 articlesHide 4 articles
- Attackers Exploit cPanel Flaw, Endangering Millions of Websites19:14Dark Reading
- cPanel auth bypass exploited in Asian gov, MSP attacks19:10Security Affairs
- Hacker News Weekly: Exploits Outpace Patches, Systems at Risk.14:23The Hacker News
- Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks09:27The Hacker News
- Attackers Exploit cPanel Flaw, Endangering Millions of Websites
- Cisco Moves to Acquire Astrix Security to Tackle Non-Human Identity Risks
Cisco on Monday announced its intent to acquire Astrix Security, a startup focused on securing non-human identities such as API keys, service accounts, and OAuth tokens increasingly used by applications and AI agents, according to SecurityWeek. The deal aims…
SecurityWeek - PSEA data breach settlement offers up to $5,000 compensation
According to RG/2 Claims Administration LLC, as Settlement Administrator, a proposed Settlement has been reached in a class action known as Melanie Hudson, et al. v. Pennsylvania State Education Association, Case No. 2025-CV-02411, filed in the Court of…
DataBreaches - Attackers Abuse SSA Phish to Plant Dual RMM Backdoors
An active phishing campaign codenamed VENOMOUS#HELPER has been observed targeting multiple vectors since at least April 2025, using legitimate Remote Monitoring and Management (RMM) software to gain persistent remote access to compromised hosts, according to…
The Hacker News - Hackers breach Trellix source code repo, law enforcement notified
According to Trellix, a part of its source code repository was recently breached, and the company is working with forensic experts as law enforcement has been notified. The cybersecurity firm says, based on its investigation to date, there is no evidence…
SecurityWeek - Supply chain worm compromises SAP, PyTorch, Intercom packages
The most significant development of the week was the April 29 to 30 Mini Shai-Hulud worm, a self-propagating supply chain campaign that compromised four official SAP npm packages, two PyTorch Lightning PyPI versions, two intercom-client npm versions, and the…
SANS ISCTeamPCP - Fake code of conduct phishing steals tokens via Microsoft AiTM
According to Microsoft Defender Security Research Team and Microsoft Threat Intelligence, phishing campaigns themed around a code of conduct used a multi-stage AiTM flow to harvest credentials, affecting tens of thousands of users across 13,000 organisations…
Microsoft - Small businesses hit by cyber tax raise prices to survive
This week on the Lock and Code podcast, Malwarebytes discusses what it calls the “cyber tax” as a consequence of a rising wave of attacks on small businesses. According to the Identity Theft Resource Center, 81% of small- and medium-sized businesses suffered…
Malwarebytes - DShield Honeypot Updated for Ubuntu 26.04 and New Raspberry Pi OS
According to Johannes Ullrich, the DShield honeypot will receive a couple of major updates this week, with automatic updates proceeding if that option is enabled. The changes include improved compatibility with Ubuntu 26.04 and newer Raspberry Pi OS…
SANS ISC - Airbus leads cyber M&A surge with Quarkslab AI defence deal
Thirty-three cybersecurity-related merger and acquisition deals were announced in April 2026, including Airbus to acquire Quarkslab, Cyera acquiring Ryft, Everfield acquiring Rhebo, Fortra acquiring Zero-Point Security, Palo Alto Networks to acquire Portkey,…
SecurityWeek - DigiCert Revokes 60 Certificates After Support Portal Breach
DigiCert revoked certificates after its internal support portal was compromised in a cyberattack, with malware delivered via a customer chat channel that infected an analyst’s system. The attack occurred on 2 April 2026, and the malware was first identified…
SecurityWeek - US defence contractors warned of nation state edge device attacks
According to Team Cymru, the US defence industrial base has become a prime target for nation-state hacking groups, yet small defence contractors critically lack network telemetry to detect these threats. In an article published on 29 April, Stephen Campbell,…
InfosecurityGhostEmperor - AI Boosted Cybercrime Surges as Malicious npm Packages Top 450k
The Hacker News argues that 2025 into 2026 marks a turning point for AI-assisted cyber attacks, with LLM-backed tools moving from helpful aids to end‑to‑end capabilities that accelerate wrongdoing. The piece notes that measures of cybercrime frequency and…
The Hacker News 2 articles this day · Dark Reading first · 2 outlets
Silver Fox Tax Phishing Hits Russia, India with ABCDoor · Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRATShow 2 articlesHide 2 articles
- Silver Fox Tax Phishing Hits Russia, India with ABCDoor11:57The Hacker News
- Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT11:35Dark Reading
- Silver Fox Tax Phishing Hits Russia, India with ABCDoor
- AI Powered Scams Rise as Deepfake Calls Cost Firms Millions
According to SOCRadar, AI is reshaping threat activity, enabling hyper-fast, scalable attacks such as personalised phishing, deepfake video calls, voice cloning, and self-mutating malware that can run intrusion chains with minimal human involvement. The…
SOCRadarCVE-2025-32711 - Phishing gang steals 30k Facebook ads via Google AppSheet
Researchers have uncovered a long-running phishing operation that abuses trusted Google services to hijack tens of thousands of Facebook accounts. The compromised accounts are mainly business and advertiser profiles, which criminals can monetise after…
Malwarebytes - Dark Reading's 2006 launch hit 300k views on first person story
According to TechTarget and Informa Tech’s Digital Business Combine, sometime in late February 2006 my phone rang with news from my boss, Steve Saunders, who had bought the URL darkreading[.]com and was considering a security site. He projected an early May…
Dark Reading - Fake FIFA World Cup 2026 sites flood web with crypto travel scams
The FIFA World Cup 2026 is scheduled to begin 11 June across the US, Canada, and Mexico, and Malwarebytes reports a surge of scam sites using World Cup branding across four main categories: crypto, travel, merchandise, and predictions. One crypto site…
Malwarebytes 2 articles this day · Security Affairs first · 2 outlets
CISA Warns of Active Exploitation of Linux Kernel Copy Fail Flaw · CISA flags Linux kernel CVE-2026-31431, urgent patch by May 15Show 2 articlesHide 2 articles
- CISA Warns of Active Exploitation of Linux Kernel Copy Fail Flaw10:42SecurityWeek
- CISA flags Linux kernel CVE-2026-31431, urgent patch by May 1510:26Security Affairs
- CISA Warns of Active Exploitation of Linux Kernel Copy Fail Flaw
- Attackers abuse Amazon SES for convincing phishing and BEC emails
Phishing campaigns and BEC attacks are increasingly delivered via Amazon SES, a cloud-based email platform that attackers misuse to bypass typical email security. According to Securelist, the technique relies on legitimate infrastructure, with emails passing…
securelist.com - OpenAI rolls out Advanced Account Security with security keys
OpenAI has introduced Advanced Account Security for ChatGPT users, targeting those at increased risk of targeted hacking attacks and others seeking extra protection. The opt‑in feature strengthens sign‑in by disabling password‑based login and requiring…
SecurityWeek - AI driven vulnerability hunt forces urgent patch wave, NCSC warns
The UK’s National Cyber Security Centre (NCSC) warns that artificial intelligence is accelerating the discovery of software vulnerabilities, likely triggering a rapid “patch wave” of urgent updates. According to the NCSC, skilled attackers using AI can…
Security Affairs - Dark web lists WhatsApp data, Indian bank VPN for sale
On 4 May 2026, SOCRadar reported a batch of underground posts detailing a range of data and tool sales, including a claim of 20.65 million Indonesian WhatsApp numbers being shared. According to SOCRadar Dark Web Team, there was a separate listing advertising…
