Skip to content
Sign in

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Articles per day, last 14 days

Most articles on Wed 21 Oct (96); 13–17 on weekend days.

21 Oct9623252729312Today11 so faravg 63
  • On CISA KEV CVEs
  • Other coverage
  • Closed-day average
Show as table
Articles per day, last 14 days
DayArticlesOn CISA KEV CVEs
Wed 21 Oct9618
Thu 22 Oct8411
Fri 23 Oct6816
Sat 24 Oct134
Sun 25 Oct132
Mon 26 Oct7621
Tue 27 Oct9518
Wed 28 Oct8716
Thu 29 Oct7817
Fri 30 Oct6910
Sat 31 Oct143
Sun 1 Nov170
Mon 2 Nov807
Tue 3 Nov944
Today, Wed 4 Nov11 so far2

Developing

Exploited only
48 articles

Latest days

Wed 6 May48 articles

  1. New Mirai style botnet hijacks Android ADB for DDoS for hire

    According to Hunt[.]io, researchers have exposed a Mirai-derived botnet that self-identifies as xlabs_v1 and targets devices with an exposed Android Debug Bridge, enlisting them into a DDoS-for-hire network. The malware hunts for Android devices running ADB…

    The Hacker News
  2. Palo Alto Networks PAN-OSCVE-2026-0300Exploited

    4 articles this day · The Hacker News first · 4 outlets

    CVE-2026-0300 flaw in Palo Alto firewalls grants root access · Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)Show 4 articles
  3. DENIC .de DNSSEC slip triggers SERVFAIL, Cloudflare intervenes

    On May 5, 2026, at roughly 19:30 UTC, DENIC, the operator for the .de TLD, began publishing incorrect DNSSEC signatures for the .de zone, causing any validating resolver to reject them and return SERVFAIL, including 1.1.1[.]1, Cloudflare’s public resolver.…

    Cloudflare
  4. Missouri Regulators Seek Answers From Conduent Over 2024 Breach

    Missouri regulators are escalating their response to a cybersecurity breach at Conduent Business Services that could affect millions of consumers. The investigation has centred on Conduent, a vendor that handles insurance documents, processes insurance claim…

    DataBreaches
  5. Banks Sue Over Vendor Breach Despite External Data Leak

    A recent high-profile incident shows how vendor-driven data breaches can trigger litigation against financial institutions, with at least two putative class actions filed within weeks of a bank confirming a third-party breach, even though the alleged conduct…

    DataBreaches
  6. Chrome Silently Installs 4GB AI Model Without User Consent

    Google Chrome has been quietly downloading a 4GB AI model onto users’ devices without asking first, revealing a file called weights[.]bin stored in the OptGuideOnDeviceModel directory within Chrome profiles. The 4GB download occurs automatically when the…

    Malwarebytes
  7. Microsoft Tops KuppingerCole 2026 AI SOC Leader Report

    Microsoft has been named an Overall Leader and the Market Leader in KuppingerCole Analysts’ 2026 Emerging AI Security Operations Center (SOC) report, published as part of a shift toward intelligence‑driven security operations. The analysis notes that…

    Microsoft
  8. ClickFix campaign uses fake macOS utilities lures to deliver infostealers

    Microsoft researchers describe a shift in the ClickFix infostealer campaign, which uses fake macOS utilities and seeks to lure users via blog posts and other content platforms to install malware such as Macsync, Shub Stealer, and AMOS. In this iteration,…

    Microsoft
  9. TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

    According to Elastic Security Labs, TCLBANKER is a Brazilian banking Trojan spreading via WhatsApp and Outlook, and is tracked as REF3076, a major update of MAVERICK/SORVEPOTEL family. The campaign features a loader with anti-analysis and two embedded…

    elastic.co
  10. Malware hijacks Phone Link to steal SMS OTPs from Windows PCs

    CloudZ Malware Abuses Phone Link to Steal SMS OTPs, a Windows malware toolkit observed to hijack Microsoft’s Phone Link to harvest SMS messages and one-time passwords from victim machines. The activity has been ongoing since at least January 2026, according…

    Infosecurity
  11. XBOW secures $35M Series C extension, pushing valuation past $1B

    According to SecurityWeek News, autonomous offensive security firm XBOW has announced raising $35 million in an extension to its Series C funding round, bringing total funding to more than $270 million and valuing the company at over $1 billion after the…

    SecurityWeek
  12. MuddyWater

    3 articles this day · SecurityWeek first · 3 outlets

    Iranian spies fake Chaos ransomware to steal data via Teams · Iran-linked MuddyWater fakes Chaos ransomware in 2026 breachShow 3 articles
  13. Herd Security raises $3M to boost AI security training

    Herd Security today announced raising $3 million in a funding round led by Aspiron Ventures, with additional support from ForwardSlash VC, Forum Ventures, Rightside Capital, Team Ignite and YPO. Founded in 2025, the San Francisco-based company has built an…

    SecurityWeek
  14. CISA launches CI Fortify to protect critical infrastructure

    CISA has urged critical infrastructure operators to plan for remaining operational or recovering quickly if hit by a cyber-attack, launching the CI Fortify initiative on 6 May 2026 as a planning framework for sectors such as water, energy, transportation and…

    Infosecurity
  15. OceanLotus behind ZiChatBot malware in PyPI wheel packages

    Kaspersky’s GReAT researchers say OceanLotus is suspected of distributing ZiChatBot malware via malicious wheel packages uploaded to PyPI from July 2025, with three packages designed to imitate legitimate libraries. The packages, uuid32-utils, colorinal and…

    securelist.comAPT32
  16. Iran linked APT fakes ransomware gang in Teams espionage

    An APT group linked to the Iranian government pretended to be a Chaos ransomware affiliate to provide plausible deniability for geopolitical espionage, according to Rapid7 in a report published on 6 May 2026. The intrusion, which Rapid7 says began with…

    Infosecurity
  17. Bun JavaScript runtime abused to deliver NWHStealer infostealer

    Attackers are increasingly using a JavaScript runtime called Bun to help spread the Windows infostealer NWHStealer, with Bun distributed bundles embedded in ZIP archives that also contain loaders such as a self-injection loader named dw[.]exe. Bun is…

    Malwarebytes
  18. ShinyHunters

    2 articles this day · DataBreaches first · 2 outlets

    Instructure Canvas breach exposes 275 million education records · ShinyHunters Leaks 119k Vimeo Users' Emails After April HackShow 2 articles
  19. Hacker News opens submissions for Cybersecurity Stars Awards 2026

    According to The Hacker News, the Cybersecurity Stars Awards 2026 is a global program that recognises excellence across the cybersecurity industry and highlights outstanding work that often goes unnoticed. Submissions are now open, with applicants able to…

    The Hacker News
  20. Dark Reading marks 20 years: from Stuxnet to Volt Typhoon

    Dark Reading’s feature marks its 20th anniversary by revisiting two decades of cyber events that have shaped risk for security teams, from early Internet worms to modern AI-enabled threats. It spans episodes such as Stuxnet’s sabotage of Iranian centrifuges…

    Dark Reading
  21. Romanian Extradited for 2009 to 2010 VoIP Vishing, Faces 30 Years

    Gavril Sandu, 53, was extradited to the United States for his role in a cybercrime scheme carried out 17 years ago. According to the DOJ, he was indicted by a federal grand jury in 2017, arrested in Romania in January 2026, and extradited to the US in late…

    SecurityWeek
  22. Investors flee DeFi after $14B exit amid North Korean hacks

    According to PYMNTS, cryptocurrency investors are exiting the decentralised finance (DeFi) space after two high-profile hacks, with close to $14 billion pulled from DeFi projects in recent weeks, the Financial Times reported, citing data firm DefiLlama. The…

    DataBreaches
  23. Apache fixes HTTP/2 double‑free bug that could lead to RCE

    Apache has released updates to fix multiple vulnerabilities in its HTTP Server, including CVE-2026-23918, a double-free flaw in HTTP/2 that could enable remote code execution. The CVSS score is listed as 8.8, and the issue affects version 2.4.66, with a fix…

    Security AffairsCVE-2026-23918
  24. AI agents outrun identity controls, leaving hidden risk

    Analysts say AI agents are being deployed faster than enterprises can govern them, with Gartner noting that enterprise adoption of AI agents is accelerating and outpacing governance policy maturity in its Market Guide for Guardian Agents. According to Orchid…

    The Hacker News
  25. CISA Tells Critical Firms to Hone Isolation, Recovery Skills

    CISA: Critical Infrastructure Must Master Isolation, Recovery outlines new guidance to help US critical infrastructure operators withstand cyberattacks by foreign threat actors. The agency launched CI Fortify, an initiative designed to ensure essential…

    SecurityWeek
  26. Sophisticated Quasar Linux RAT Targets Software Developers

    According to Trend Micro, a recently identified Linux backdoor dubbed Quasar Linux (QLNX) targets software developers with a modular, in-memory RAT designed for remote access, surveillance, and credential exfiltration. The implant focuses on stealing…

    SecurityWeek
  27. Kaspersky Adds Filter to Block Fake Stores and Crypto Scams

    Securelist’s 06 May 2026 article explains that a “suspicious website” is not strictly phishing but engages in unsafe activities, such as fake online stores, dubious crypto exchanges, or subscription traps, with the overarching category described as sites…

    securelist.com
  28. Google's Android Apps Get Public Verification to Stop Supply Chain Attacks

    Google has announced expanded Binary Transparency for Android to counter binary supply chain attacks, with production Android applications released after 1 May 2026 carrying a cryptographic entry confirming their authenticity. The public ledger is intended…

    The Hacker News
  29. UK staff confess selling work logins as insider threat grows

    A large share of UK employees have sold their corporate credentials over the past year, according to Cifas. The non-profit fraud prevention service’s Workplace Fraud Trends report is based on responses from 2,000 UK employees in companies with 1,000+ staff…

    Infosecurity
  30. Attackers exploit Phone Link via CloudZ RAT to steal OTPs

    According to the Cisco Talos researchers Alex Karkins and Chetan Raghuprasad, the intrusion used a CloudZ remote access tool (RAT) together with a previously undocumented Pheno plugin to facilitate credential theft and potentially capture one-time passwords…

    The Hacker News
  31. Daemon Tools backdoor hits global users via typosquatting domain

    SecurityWeek reports that a sophisticated Daemon Tools supply chain attack has infected users worldwide, with a backdoor dropped on about a dozen systems in Belarus, Russia, and Thailand, indicating a targeted operation. The campaign compromised three Daemon…

    SecurityWeek
  32. ShaiWorm in PyTorch Lightning update steals dev credentials

    A malicious PyTorch Lightning update (v2.6.3) on PyPI spread briefly, exposing developers to credential theft before maintainers removed it at the end of April. The compromised package executed hidden code on import, launching a background process that…

    Security Affairs
  33. Oracle Debuts Monthly Critical Security Patch Updates

    Starting this month, Oracle is supplementing its quarterly Critical Patch Update (CPU) fixes with monthly security releases focused on high-priority vulnerabilities. The first monthly CSPU will roll out on 28 May 2026, addressing critical-severity…

    SecurityWeek
  34. UAE cyber attacks jump sixfold amid rising Middle East tensions

    Middle East cyber clashes are intensifying, with UAE breach attempts rising sharply in the wake of regional tensions. In February 2026, the UAE experienced daily breach attempts ranging from 90,000 to 200,000 before the start of renewed conflict, and a few…

    Dark Reading
Show older articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in