News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 10 so far | 2 |
Developing
Thu 7 May54 articles
- Keitaro cloaking powers AI themed investment scam with deepfakes
Researchers tracked a large AI‑themed investment scam campaign that spans 15,500 domains, using cloaking and deepfakes to hide from security tools while targeting ordinary users, according to Infoblox. Criminals abused the Keitaro ad‑tracking platform as…
Malwarebytes - Attackers hijack Claude Code to steal OAuth tokens via MCP proxy
SecurityWeek reports that Mitiga researchers say attackers can silently redirect Claude Code MCP traffic to intercept OAuth tokens, giving them persistent access to connected SaaS platforms. The token theft hinges on a crafted npm post-install hook that…
SecurityWeek - Cline Kanban server flaw lets sites steal dev data via WebSocket
A critical vulnerability in the Cline Kanban server has been disclosed that allows any website a developer visits to silently exfiltrate workspace data, inject commands into the AI agent's terminal or kill active agent sessions. The flaw, given a CVSS score…
Infosecurity 2 articles this day · SecurityWeek first · 2 outlets
Cisco patches Unity Connection flaws tracked as CVE-2026-20034/35 · Cisco patches five high severity flaws across enterprise productsShow 2 articlesHide 2 articles
- Cisco patches Unity Connection flaws tracked as CVE-2026-20034/3514:15Security Affairs
- Cisco patches five high severity flaws across enterprise products11:24SecurityWeek
- Cisco patches Unity Connection flaws tracked as CVE-2026-20034/35
- Chrome 148 Update Fixes 127 Flaws, Including Three Critical Bugs
Chrome 148 has been promoted to the stable channel with 127 security fixes, including three for critical-severity vulnerabilities. The first critical flaw is an integer overflow issue in Blink, tracked as CVE-2026-7896, which could allow remote attackers to…
SecurityWeekCVE-2026-7896 - AI models helped hackers target Mexico water utility, report says
Commercial large language models were used as part of a cyber-attack which targeted a municipal water and drainage utility provider in Mexico, according to Dragos. A “significant compromise” of the water infrastructure providers’ IT environment escalated…
Infosecurity - How AI Powered Phishing Starts Breaches From One Click
According to The Hacker News, the webinar titled The Patient Zero Playbook is pitched as a technical deep dive into how modern breaches start, emphasising that one employee and one click can initiate a stealth breach. The article explains that in 2026…
The Hacker News - AI vision models fooled by hidden commands in images
Cisco’s AI Threat Intelligence and Security Research team has published the second installment of a study on how vision-language models (VLMs) can be manipulated with bounded pixel-level perturbations to images that already fail as attacks. The researchers…
SecurityWeek 3 articles this day · Unit 42 first · 3 outlets
Palo Alto Networks Warns of Exploits in CVE-2026-0300 PANOS · CISA adds Palo Alto PAN OS flaw CVE-2026-0300 to KEV catalogShow 3 articlesHide 3 articles
- Disc Soft confirms supply chain hack hit free Daemon Tools Lite
SecurityWeek reports that Disc Soft, the Daemon Tools developer, says a intrusion led to a targeted supply chain attack but that the impact was limited to the free version of Daemon Tools Lite. According to Kaspersky, Chinese-speaking threat actors injected…
SecurityWeek - Fake Claude site delivers Beagle backdoor via sideloaded updater
A fraudulent imitation of Anthropic's Claude website has been used to distribute a backdoor named Beagle, deployed through a Dynamic Link Library sideloading chain that abuses a signed antivirus updater binary, according to Sophos X-Ops. The malicious domain…
Infosecurity - AI guided hackers breach Mexico govt, stall on OT leap
A small, unknown band of hackers pulled off what is described as history’s first recorded, AI-directed cyberattack, stealing data from the government of Mexico before failing to bridge IT to OT systems. Between December 2025 and February 2026, the group…
Dark Reading - One click RCE via Claude Code threatens developer supply chains
SecurityWeek reports that AI coding agents could threaten supply chains, with researchers from Adversa[.]AI finding a way to abuse Claude Code’s automation to enable a one-click remote code execution and potentially trigger a supply chain attack. Adversa…
SecurityWeek - One‑click TrustFall exploit hijacks Claude Code via bad repo
TrustFall, a one-click exploit demonstrated by Adversa AI, can trigger code execution in Claude Code with minimal or no user interaction, exposing developers to running attacker-controlled code from a malicious repository. According to Adversa AI, this…
Dark ReadingCVE-2025-59536 - Cloudflare Blocks Copy‑Fail Linux Flaw Using bpf‑LSM
Cloudflare describes its response to the Copy Fail Linux vulnerability (CVE-2026-31431) as rapid and methodical, beginning assessments within minutes of the public disclosure on 29 April 2026 and confirming that existing behavioural detections could identify…
Cloudflare - SecurityWeek Webinar Addresses Identity Risks in AI Era
The SecurityWeek webinar titled Webinar Today: Securing Identity Across Humans, Machines and AI examines how identity is evolving as organisations adopt cloud services, automation, machine identities and AI-driven processes. It explains that identity sprawl…
SecurityWeek - MOVEit Automation flaw CVE-2026-4670 forces rapid patch push
ThreatsDay’s ThreatsDay Bulletin for 07 May 2026 surveys a week of cybercrime and security stories, noting that attackers continue to rely on low-effort methods such as shady packages, fake apps and compromised logins, with AI speeding up exploit hunting and…
The Hacker NewsCVE-2026-4670 - ChipSoft says ransomware data deleted, but experts seek proof
ChipSoft has provided an update on its ransomware incident, and DigitalShield reports that the company has not disclosed whether it paid the attackers’ ransom, while noting that some negotiations took place. According to DigitalShield, one of the most…
DataBreaches - Operation HookedWing phishing campaign steals 2,000+ credentials
According to SOCRadar, Operation HookedWing is a four-year, multi-sector phishing campaign active from 2022 to the present that has compromised more than 2,000 credentials from users at over 500 organisations, with logs indicating more than 2,500 unique…
SOCRadar - Incident Response Needs More Than Just a Retainer Today
Day Zero Readiness argues that having an incident response retainer or an pre-approved external firm is not the same as being prepared to act the moment an incident is declared. Operational readiness is about what responders can do in the first hours, with…
The Hacker News - Gemini CLI flaw let attackers hijack AI agent via GitHub issue
A critical vulnerability in Gemini CLI could have enabled a supply-chain attack by allowing attackers to inject malicious prompts into a GitHub issue and take over the AI agent used to triage those issues, according to Pillar Security. The flaw, assigned a…
SecurityWeek - Online Safety Act Fails as Kids Easily Bypass Age Checks
The Malwarebytes piece examines whether the Online Safety Act is delivering the promised protections for children, noting the Act came into effect in July 2025 and a survey based on research by the UK’s Internet Matters sheds light on changes since then,…
Malwarebytes - Mirai Derivative Botnet xlabs_v1 Hijacks ADB IoT Devices for DDoS
A new Mirai‑derivative botnet named xlabs_v1 has emerged, hijacking internet‑exposed devices running Android Debug Bridge (ADB) to power large‑scale DDoS attacks, with 21 flood techniques across TCP, UDP and raw protocols. Hunt[.]io discovered the bot on an…
Security Affairs - Office and Windows flaws boost exploit kits in Q1 2026
During Q1 2026, exploit kits targeting user systems expanded again, adding new exploits for the Microsoft Office platform as well as Windows and Linux operating systems. Notable new entries include CVE-2026-21509 and CVE-2026-21514, which are security…
- CVE-2026-26956: vm2 Sandbox Escape Enables Host RCE in Node.js 25
CVE-2026-26956 is a critical sandbox escape in the vm2 library used to run untrusted JavaScript in Node[.]js, with vm2 version 3.10.4 affected and a fix in 3.10.5. The vulnerability is Node[.]js 25 specific and has been demonstrated on Node[.]js v25.6.1 (x64…
SOCRadarCVE-2026-26956 - Daemon Tools Lite releases clean version after malware scare
The developer of a popular utility software has been forced to release a new version after confirming reports that threat actors managed to hide malware in a previous iteration. Disc Soft said it released the malware-free Version 12.6 of its Daemon Tools…
Infosecurity - PyPI packages deliver ZiChatBot malware to Windows, Linux
Three PyPI wheel packages—uuid32-utils (1,479 downloads), colorinal (614 downloads) and termncolor (387 downloads)—were uploaded in a narrow window between 16 July and 22 July 2025, and are used to stealthily deliver a malware family called ZiChatBot on…
The Hacker News - Security experts warn of rising phishing campaigns on Vercel
Low-skilled threat actors are increasingly abusing legitimate Gen AI platforms to mount convincing phishing campaigns, according to Cofense. The firm says it has observed campaigns based around v0[.]dev, a powerful GenAI tool provided by web application…
Infosecurity - Claude AI assisted hackers in failed Mexican water utility attack.
Dragos has published a threat intelligence report describing an intrusion into a municipal water and drainage utility in Monterrey, Mexico, in which an unidentified threat actor used Claude AI to assist operations. The attack occurred in January 2026 and was…
SecurityWeek - Critical vm2 Node.js flaws expose systems to sandbox escapes
A dozen critical vulnerabilities have been disclosed in the vm2 Node[.]js library that could allow sandbox escapes and arbitrary code execution on affected systems. The flaws, listed as CVE-2026-24118, CVE-2026-24120, CVE-2026-24781, CVE-2026-26332,…
The Hacker NewsCVE-2026-24118 - ISC Stormcast Diary Posted for May 7 2026 with Green Threat Level
ISC Stormcast For Thursday, 7 May 2026 is published, with the diary note and podcast link at https://isc.sans[.]edu/podcastdetail/9922. The page lists a Threat Level of green and identifies the Handler on Duty as Guy Bruneau. It also directs readers to learn…
SANS ISC - AI Generated Dashboard Adapts to Daily Honeypot Attack Patterns
An Adaptive Cyber Analytics UI for Web Honeypot Logs is explored as a bespoke approach to processing web honeypot data, with the author noting the potential of large language models to tailor user interfaces to daily attack activity. The piece explains that…
SANS ISC
Wed 6 May48 articles
- Student tricks rail system, halts Taiwan high speed trains
A 23-year-old university student spoofed signals and triggered an emergency alarm that stopped four Taiwan High-Speed Rail trains for nearly an hour, disrupting services during the Qingming Festival holiday. Authorities say the attacker used a…
Security Affairs - Young hacker jailed 6.5 years for $250M crypto scam nationwide
GothFerrari, real name Marlon Ferro, was sentenced to 78 months in prison in connection with a sprawling social engineering conspiracy that stole well over $250 million in cryptocurrency from victims across the United States. According to the U.S. Attorney’s…
DataBreaches - VoidStealer Finds New Way to Break Chrome AppBound Encryption
Authors of the VoidStealer Trojan have uncovered a new method to bypass Google Chrome’s App-Bound Encryption (ABE), enabling infostealers to harvest cookie data and other secrets from Chrome. The bypass marks another successful sidestep of Chrome’s ABE,…
Dark Reading - Instructure Canvas breach leaks data of 275M users
Instructure, the maker of the Canvas learning management system, disclosed on May 1 a data breach in which a threat actor stole identifying information of users at affected institutions. The attack, claimed by ShinyHunters, involved exfiltrating about 3.65TB…
Dark ReadingShinyHunters - Romanian hacker extradited to US over 17 year old vishing fraud
Romanian national Gavril Sandu, aged 53, has been extradited to the United States nearly 17 years after a hacking scheme. Indicted in 2017, Sandu was arrested in Romania on 9 January 2026 and transferred to U.S. custody on 30 April 2026. He faces one count…
Security Affairs
