News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 10 so far | 2 |
Developing
Fri 8 May36 articles
- AI Agent Identity Budgets Highlight Funding Gaps, Survey Finds
According to Omdia, AI agent projects are triggering markedly different budget dynamics from traditional IAM efforts, with AI agent identities demanding new governance and security measures as they move into production. The research found that 45% of IT…
Dark Reading - Polish Water Plants Targeted in Cyberattacks on Control Systems
According to ABW, Poland’s Internal Security Agency, there was a significant escalation in cyberattacks on industrial control systems and other OT infrastructure targeting the water sector during 2024 and 2025, with attackers sometimes gaining access to ICS…
SecurityWeek - Linux Kernel Flaw Lets Local Users Gain Root Access
Security researchers have disclosed a new unpatched Linux kernel vulnerability, codenamed Dirty Frag, which allows an unprivileged local user to gain full root access on most major distributions, including Ubuntu, RHEL, Fedora, AlmaLinux and CentOS Stream.…
Security Affairs - Braintrust breach exposes AI provider keys for major tech firms
Braintrust, an AI evaluation and observability platform, says hackers accessed an AWS account used by its systems and likely obtained AI provider secrets stored in Braintrust. The incident was discovered on 4 May and customers were informed by email on 5…
SecurityWeek - ACSC alerts ClickFix Vidar Stealer via hijacked WordPress sites
The Australian Cyber Security Centre (ACSC) has issued a warning about a malicious campaign that exploits the ClickFix social engineering technique to deliver Vidar Stealer, a password‑stealing malware, in a campaign that has targeted infrastructure and…
Infosecurity - Stealthy Quasar Linux RAT siphons dev credentials in supply chain
A new Linux implant named Quasar Linux RAT (QLNX) is targeting developers’ systems to establish a silent foothold and support a broad post‑compromise capability, including credential harvesting, keylogging, file manipulation, clipboard monitoring, and…
The Hacker News 2 articles this day · SecurityWeek first · 2 outlets
CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM · Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacksShow 2 articlesHide 2 articles
- Canvas outage hits schools as hackers threaten data leak
A system thousands of schools and universities use went offline on Thursday due to a cyberattack, disrupting study as finals approached. According to Associated Press, the hacking group ShinyHunters claimed responsibility for the breach at Canvas, which is…
SecurityWeekShinyHunters - Study reveals hidden threats in low‑severity security alerts
A new analysis of more than 25 million security alerts across live enterprise environments shows defenders have been quietly avoiding low‑severity information. The dataset includes 10 million monitored endpoints and identities, 82,000 forensic endpoint…
The Hacker News - PCPJack hijacks cloud, steals credentials after erasing TeamPCP
Security researchers have uncovered PCPJack, a credential theft framework that “worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP,” according to SentinelOne senior threat researcher, Alex Delamotte. The campaign targets…
Infosecurity - New Linux PAM backdoor PamDOORa sold on Russian forum for $1,600
The Hacker News reports a new Linux backdoor named PamDOORa, advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor calling themselves “darkworm.” The backdoor is PAM-based and designed as a post-exploitation toolkit that enables…
The Hacker Newsdarkworm - PCPJack worm targets cloud credentials while wiping TeamPCP infections
According to SecurityWeek, a threat actor has launched PCPJack, a worm designed to evict TeamPCP infections and steal credentials, active since late April and targeting credentials across cloud environments such as AWS, Kubernetes and Docker. SentinelOne…
SecurityWeek - CVE-2025-68670 Flaw in xrdp Allows Attackers to Run Code Remotely
Kaspersky researchers describe CVE-2025-68670 as a remote code execution flaw in the xrdp server that is exploitable before authentication. The bug lies in xrdp_wm_parse_domain_information, which can overflow a 256-byte resultBuffer when processing a domain…
securelist.comCVE-2025-68670 - RansomHouse claims Trellix breach, posts service screenshots
RansomHouse has taken credit for the recent attack on the Trellix cybersecurity firm, publishing screenshots to demonstrate access to internal Trellix services. The Trellix source code repository breach was disclosed by the company on its website, with…
SecurityWeekRansomHouse 2 articles this day · The Hacker News first · 2 outlets
Linux Kernel Flaw Lets Users Gain Root via Page Cache Corruption · Dirty Frag kernel bug enables local root via chained exploitsShow 2 articlesHide 2 articles
- Linux Kernel Flaw Lets Users Gain Root via Page Cache Corruption07:50SANS ISC
- Dirty Frag kernel bug enables local root via chained exploits05:12The Hacker News
- Linux Kernel Flaw Lets Users Gain Root via Page Cache Corruption
- Pentagon teams with OpenAI, Google to fuse AI into US forces
May 2026 marks a turning point in the evolution of modern warfare as the Pentagon integrates AI into military operations, transforming cybersecurity, targeting and command systems into a unified warfare architecture. The Pentagon has signed agreements with…
Security Affairs - Attackers Exploit Claude Extension Bug to Steal Data via AI Agent
A vulnerability in the Claude extension for Chrome could let attackers takeover the AI agent and abuse it for information theft, according to LayerX. The flaw, dubbed ClaudeBleed, combines lax permissions, where any Chrome extension can run commands in…
SecurityWeek - Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack against the Canvas platform disrupted classes across the United States on 7 May 2026, after a cybercrime group defaced the login page with a ransom demand. The extortion message claimed data from 275 million students and…
Krebs on Security - ISC Stormcast May 8 2026: Green Level, Podcast & SANS Training
ISC Stormcast for Friday, 8 May 2026 is published, with the Threat Level listed as green. The page notes a podcast detail, 9924, and includes a reminder to click links to learn more about Johannes Ulrich’s SANS classes. The handler on duty is listed as Guy…
SANS ISC
Thu 7 May54 articles
3 articles this day · The Hacker News first · 3 outlets
Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotely · CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patchShow 3 articlesHide 3 articles
- ShinyHunters Hit Instructure Canvas Again, Threaten School Data Leak
According to DataBreaches[.]Net, ShinyHunters hacked Instructure again after Instructure failed to contact them to negotiate payment following a previous breach in April, with the threat actors posting a notice to schools about contacting them to negotiate a…
DataBreachesShinyHunters - DomainTools Investigations | Cybersecurity Reading List - Week of 2026-05-04
The Cybersecurity Reading List for the week of 2026-05-04 gathers a mix of official alerts, research and industry notes, including a report from FBI/IC3 that notes a 26% increase in known losses from 2024. It highlights the UK NCSC’s guidance on defending…
- Fake Google Authenticator Chrome Extension Hits 260k Users
DTI’s latest edition breaks down how state-backed actors are shifting from one-off attacks to parallel pipelines of espionage and disruption, notably detailing DPRK’s modular malware portfolio and a burn-and-replace approach that enables simultaneous…
dti.domaintools.comSilent Chollima 2 articles this day · SecurityWeek first · 2 outlets
Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks · Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State HackingShow 2 articlesHide 2 articles
- Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks20:44Security Affairs
- Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking15:31SecurityWeek
- Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks
- New PCPJack cloud worm steals secrets via parquet files
After replacing TeamPCP malware, PCPJack is described as a modular cloud worm that steals secrets from multiple cloud environments, including cloud services, wallets and keys, and email and other popular cloud applications. According to SentinelLabs, PCPJack…
Dark Reading - When prompts become shells: RCE vulnerabilities in AI agent frameworks
According to Microsoft Defender Security Research Team, the article outlines two critical vulnerabilities in Microsoft’s Semantic Kernel, CVE-2026-26030 and CVE-2026-25592, which could allow a prompt injection to escalate to host-level remote code execution.…
MicrosoftCVE-2026-26030 - Cloudflare cuts 1,100 jobs as AI usage soars, reshapes workforce
This afternoon, Cloudflare announced in an internal email that it has decided to reduce its global workforce by more than 1,100 employees. The message explains that the way the company works has fundamentally changed, with AI usage rising by more than 600%…
Cloudflare - Mozilla’s AI tool Mythos uncovers 271 Firefox flaws in two months
Mozilla says Mythos identified 271 Firefox vulnerabilities over two months, with engineers reporting “almost no false positives” thanks to a harness that guides the AI through testing and verification. Of the 271 bugs, 180 were sec-high, 80 were…
Ars Technica - Musk vs OpenAI trial spotlights AGI control and safety fears
At the heart of the case is a dispute between Elon Musk and OpenAI’s leaders over how to safeguard humanity from artificial intelligence, with the trial focusing on OpenAI’s origins as a nonprofit and Musk’s bid for greater control. The proceedings have kept…
SecurityWeek - Stop Traefik fuzzing with Elastic and Cloudflare auto block
On 8 May 2026, Erik-Jan de Kruijf details how to detect web server probing and fuzzing in Traefik using an out-of-the-box Elastic Security ES|QL detection rule to spot repeated 403/404 errors from a single source IP, signalling directory fuzzing or…
elastic.co - PCPJack worm spreads across cloud, stealing credentials via CVEs
PCPJack is a new credential theft framework that targets exposed cloud infrastructure and spreads worm-like across cloud environments, according to The Hacker News report dated 7 May 2026. Security researchers say the toolset harvests credentials from cloud,…
- British cybersecurity expert Tom Parker considered for CISA chief
According to Dark Reading, Tom Parker, a British-born cybersecurity expert, has emerged as a possible contender to lead the Cybersecurity and Infrastructure Security Agency (CISA) after a brutal 16 months without a Senate-confirmed director. Parker is…
Dark Reading - Microsoft backs passwordless push as passkeys hit billions
World Passkey Day marks a push to cut reliance on passwords and phishable authentication by accelerating passkey adoption, as cyberattacks become more automated and AI-powered. Passwords remain a major risk, with phishing still a concern; Microsoft says it…
Microsoft - Boost Security Raises $4 Million for SDLC Defense Platform
Boost Security has announced raising $4 million in funding to expand its SDLC defence platform, alongside the acquisitions of SecureIQx and Korbit[.]ai to broaden its capabilities. Bringing total funding to $16 million, the round comprises investments from…
SecurityWeek - Capital One study finds legacy tools block data protection
Legacy Security Tools Are Failing Data Protection, Capital One Software Report Finds, a study released on 7 May 2026 shows that traditional network and perimeter security tools are hindering adequate data protection even as data security becomes more…
Infosecurity
