Skip to content
Sign in

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Articles per day, last 14 days

Most articles on Wed 21 Oct (96); 13–17 on weekend days.

21 Oct9623252729312Today15 so faravg 63
  • On CISA KEV CVEs
  • Other coverage
  • Closed-day average
Show as table
Articles per day, last 14 days
DayArticlesOn CISA KEV CVEs
Wed 21 Oct9618
Thu 22 Oct8411
Fri 23 Oct6816
Sat 24 Oct134
Sun 25 Oct132
Mon 26 Oct7621
Tue 27 Oct9518
Wed 28 Oct8716
Thu 29 Oct7817
Fri 30 Oct6910
Sat 31 Oct143
Sun 1 Nov170
Mon 2 Nov807
Tue 3 Nov944
Today, Wed 4 Nov15 so far2

Developing

Exploited only
92 articles · 5–6 May

Latest days

Wed 6 May48 articles

  1. Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls

    Palo Alto Networks is patching a critical PAN-OS zero-day, tracked as CVE-2026-0300, which has been exploited to hack some of the company’s firewall models. The vulnerability is described as a buffer overflow in the User-ID Authentication Portal (Captive…

    SecurityWeekExploitedCVE-2026-0300
  2. ISC Stormcast For Wednesday, May 6th, 2026 https://isc.sans.edu/podcastdetail/9920, (Wed, May 6th)

    ISC Stormcast for Wednesday, 6 May 2026 is published with Threat Level: green. The diary identifies Rob VandenBrink as the Handler on Duty. It notes a link to learn more about classes Johannes Ulrich is teaching for SANS. The entry also features a podcast…

    SANS ISC
  3. NYC Public Schools Audit Exposes 141 Data Breaches, Policy Gaps

    According to a state audit spanning 2020 to 2025, the New York City Public Schools does not have a clear understanding of the data it collects or the risks it faces, with major gaps in state-required data security policies and weaknesses in how student…

    DataBreaches

Tue 5 May44 articles

  1. CVE-2026-31431: Linux Kernel Flaw Enables Root via Simple Script

    Copy Fail, CVE-2026-31431, is described as a deterministic local privilege escalation in the Linux kernel’s AF_ALG interface, enabling an unprivileged attacker to gain root across many distributions since 2017. According to The Linux Foundation, the advisory…

    Unit 42ExploitedCVE-2026-31431
  2. Trellix confirms source code repo breach, starts forensic review.

    Trellix has disclosed that a threat actor recently gained unauthorized access to a portion of its source code repository, though the company says it cannot specify what portion was affected. In its statement, Trellix asserted that there is no evidence the…

    Dark Reading
  3. Karakurt

    2 articles this day · SecurityWeek first · 2 outlets

    Latvian Karakurt Ransomware Negotiator Gets 8.5 Year US Sentence · Latvian Karakurt ransomware member sentenced to 8.5 years in USShow 2 articles
  4. Widely used Daemon Tools disk app backdoored in monthlong supply-chain attack

    According to Kaspersky, Daemon Tools, a widely used app for mounting disk images, was backdoored in a monthlong supply-chain compromise that began on 8 April 2026 and remained active as of the time of reporting. Installers signed by the developer’s official…

    Ars Technica
  5. Vimeo confirms data breach via Anodot, exposing 119k users

    Vimeo confirmed a data breach stemming from a compromise at Anodot, a third‑party analytics vendor, exposing data for 119,000 users. The incident, which occurred in April 2026, is linked to the ShinyHunters extortion group, who reportedly listed Vimeo on…

    Security AffairsShinyHunters
  6. Apache Software Foundation Apache HTTP ServerCVE-2026-23918

    2 articles this day · SecurityWeek first · 2 outlets

    Apache HTTP Server patches critical HTTP/2 flaw CVE-2026-23918 · Apache patches HTTP Server and MINA flaws, warns of RCE riskShow 2 articles
  7. Trojanised DAEMON Tools installers spread QUIC RAT backdoor

    According to Kaspersky, a newly identified supply chain attack has compromised DAEMON Tools installers with a malicious payload, distributed from the official DAEMON Tools website and signed with digital certificates belonging to DAEMON Tools developers. The…

    The Hacker News
  8. Microsoft Flags Mass Phishing Campaign Using Fake Compliance Emails

    A mass phishing campaign identified by the Microsoft Defender Research team targeted more than 35,000 users across 13,000 organisations, using fake internal compliance or regulatory communications as lures. The lures employed polished, enterprise-style HTML…

    Infosecurity
  9. APT37

    2 articles this day · The Hacker News first · 2 outlets

    North Korean Hackers Trojanise Korean Gaming Site to Spy on Users · ScarCruft deploys Android BirdCall backdoor via sqgame.netShow 2 articles
  10. Edge passwords exposed in memory, researcher warns of theft risk

    Microsoft Edge stores passwords in process memory, a design that a security researcher described as potentially enabling broad credential access in enterprise environments. A proof‑of‑concept tool demonstrated that an administrator could steal saved Edge…

    Dark Reading
  11. Microsoft Warns of Code of Conduct Phishing Targeting 13k Firms

    Microsoft has issued a warning regarding a sophisticated phishing campaign targeting organizations in the U.S. This campaign, themed around a 'code of conduct review', has resulted in over 35,000 phishing attempts detected from April 14 to 16, affecting…

    SecurityWeek
  12. China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions

    A Cisco Talos–tracked operation attributed to a sophisticated China-nexus APT group has targeted government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025, under the moniker UAT-8302. According to…

    The Hacker NewsUAT-8302
  13. Google patches Android adbd flaw enabling remote code execution

    Google patched a critical Android flaw (CVE‑2026‑0073) that could let attackers run code remotely without user action, in the System component. The update prevents potential full device compromise from remote exploitation, with the advisory noting that…

    Security Affairs
  14. Phishing attack uses signed RMM to backdoor 80+ US organisations

    A long-running phishing operation that abuses signed remote monitoring and management (RMM) software to plant silent, persistent backdoors on victim machines has compromised more than 80 organisations, predominantly in the US. Codenamed Venomous#Helper and…

    Infosecurity
  15. AI Red Teamer Joey Melo Moves From Counter Strike to CrowdStrike

    Joey Melo, described as an AI red teamer, explains that his hacking style is about controlling the environment without changing the underlying rules, a mindset he traces back to tinkering with Counter-Strike configurations. He is currently a Principal…

    SecurityWeek
  16. Microsoft Edge passwords exposed in plain text via memory dump

    Edge stores all of your browser passwords in clear text, even if you haven’t used them in this session.

    SANS ISC
  17. Bleeding Llama bug leaks secrets from 300k Ollama servers

    Dubbed Bleeding Llama, the heap out-of-bounds read issue in Ollama can be exploited remotely without authentication. Roughly 300,000 Ollama deployments are prone to sensitive information theft through this unauthenticated vulnerability, Cyera warns. The bug,…

    SecurityWeekCVE-2026-7482
  18. ABB B&R PVI

    According to ABB PSIRT, ABB became aware of a vulnerability in ABB B&R PVI, with an update now available to address it. The affected product versions are PVI <6.5.0, 6.5.0 and the vulnerability is CVE-2026-0936, which could allow an authenticated local…

    CISACVE-2026-0936
  19. Hitachi Energy PCM600

    Hitachi Energy PCM600 is the subject of a CISA ICS Advisory released on 5 May 2026, with the advisory noting a vulnerability that can impact the integrity of the PCM600 product. According to Hitachi Energy, the affected PCM600 Legacy versions are…

    CISACVE-2018-1002208
  20. CISA alerts to DLL hijack flaw in Johnson Controls AC2000

    According to CISA, the Johnson Controls CEM AC2000 is vulnerable to DLL hijacking that could allow a standard user to escalate privileges on the host machine. The affected products are CEM AC2000 12.0, 11.0 and 10.6, identified under CVE-2026-21661, with a…

    CISACVE-2026-21661
  21. CVE-2025-11043 Flaw Lets Attackers Spoof ABB B&R Servers

    According to ABB PSIRT SA25P004 republished by CISA, ABB B&R Automation Studio contains a vulnerability affecting Automation Studio <6.5, 6.5 (CVE-2025-11043) that could allow an unauthenticated attacker on the network to masquerade as a trusted party when…

    CISACVE-2025-11043
  22. DoS flaw impacts ABB B&R Automation Runtime, CVE-2025-11044

    According to ABB PSIRT, the ABB B&R Automation Runtime advisory confirms a vulnerability affecting Automation Runtime versions <6.5, >=6.5, and =R4.93, tracked as CVE-2025-11044 (with CVSS 3.1 base score 6.8). The advisory notes that an unauthenticated…

    CISACVE-2025-11044
  23. Security team patches critical Android RCE bug CVE-2026-0073

    SecurityWeek reports that CVE-2026-0073 is a critical remote code execution flaw affecting Android’s System component, which can be exploited without any user interaction. The advisory notes the issue lies in adbd, the Android Debug Bridge daemon, a…

    SecurityWeekCVE-2026-0073
  24. Persistent OAuth Tokens Pose Rising Threat as AI Apps Multiply

    OAuth tokens granted to Google or Microsoft apps are described as persistent, with no expiration and little if any centralized visibility, a pattern the article says leaves organisations exposed as employees connect AI tools, workflows, and productivity…

    The Hacker NewsUNC6395
  25. A 2006 USB Drop Test That Redefined Social Engineering Tactics

    According to Dark Reading, the piece that became a milestone was Steve Stasiukonis’s column “Social Engineering, the USB Way,” published after Dark Reading recruited him a few days after its launch in 2006, and it went viral, helped by Slashdot coverage and…

    Dark Reading
  26. How a 2006 USB Drop Test Sparked a Social Engineering Legend

    The piece revisits Dark Reading’s history with a 2006 pen test in which thumb drives were planted in a credit union’s parking lot to probe employee behaviour, an experiment that Steve Stasiukonis and his team carried out after coordinating with Tim Wilson…

    Dark Reading
  27. MetInfo CMSCVE-2026-29014

    2 articles this day · SecurityWeek first · 2 outlets

    Attackers exploit CVE-2026-29014 to hijack MetInfo CMS · MetInfo, Weaver E-cology Vulnerabilities in Attackers’ CrosshairsShow 2 articles
  28. SSL.com rotates their root certificate today, (Tue, May 5th)

    SSL[.]com is rotating out its root certificate today, a move described as normal, business as usual for a certificate authority. The change was announced by SSL[.]com on 5 May 2026, with guidance urging users to review their configurations if they go beyond…

    SANS ISC
  29. Meta fixes two WhatsApp bugs: CVE‑2026‑23866, CVE‑2026‑23863

    Two flaws in WhatsApp have been patched by Meta, which says there is no evidence these bugs have been exploited in the wild. The vulnerabilities could be abused to interfere with how media and attachments are handled on your device, though they do not…

    Malwarebytes
  30. Many Firms Use AI Without Safety Policies, ISACA Warns

    AI has become embedded in organisations, yet fewer than half have any form of AI safety or security policies in place, potentially leaving them exposed to data breaches, privacy failures and other cyber threats, according to ISACA. The ISACA AI Pulse Poll,…

    Infosecurity
  31. Over One Million AI Services Exposed Due to Missing Auth.

    According to The Hacker News, a scan of certificate transparency logs pulled just over 2 million hosts, exposing about 1 million AI services. The assessment found that many of these AI infrastructures were deployed with no authentication by default, meaning…

    The Hacker News
  32. UK organisations urged to ready for AI driven patch wave

    Security experts have urged UK organisations to get ready for a surge in new software updates driven by vendors using powerful AI tools to find and fix vulnerabilities, with the NCSC’s CTO Ollie Whitehouse predicting a “forced correction” to address years of…

    Infosecurity
  33. Microsoft warns of huge phishing scam stealing login tokens

    Microsoft disclosed a major phishing campaign that targeted over 35,000 users across 26 countries in mid-April 2026, stealing authentication tokens via fake code-of-conduct emails and legitimate services. According to the report published by Microsoft,…

    Security Affairs
Show older articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in