News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 4 so far | 0 |
Developing
Tue 12 May56 articles
- OpenAI's Daybreak embeds security into code from day one
OpenAI has unveiled Daybreak, an initiative built on its frontier LLMs and its Codex coding assistant to help developers build secure software from the ground up. Unveiled on 12 May 2026, Daybreak leverages the Trusted Access for Cyber program to reserve…
Infosecurity - Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise
According to Microsoft Incident Response, a stealthy intrusion leveraged trusted operational relationships and authentication processes via a compromised third-party IT services provider to establish long-term access. The campaign unfolded through an…
Microsoft - Anthropic’s Mythos Flags Five Curl Flaws, but Only One Holds Up
The article reports that Anthropic’s Mythos AI analysed curl and identified five vulnerabilities, but after further review by curl’s maintainers only one real vulnerability remained, rated as low severity. Three of the original findings were false positives,…
Security Affairs - RubyGems pauses signups after massive malicious package attack
RubyGems has temporarily paused new signups after what The Hacker News describes as a major malicious attack, with Mend[.]io confirming hundreds of uploaded packages were involved. According to Maciej Mensfeld, senior product manager for software supply…
The Hacker News - Attackers hijack TanStack npm packages to steal CI credentials.
A new wave of the Mini Shai-Hulud campaign compromised dozens of TanStack npm packages as part of a broader supply chain attack affecting developer ecosystems, including UiPath, Mistral AI, OpenSearch and PyPI. In April, Mini Shai‑Hulud initially targeted…
Infosecurity - BWH Hotels Says Hackers Had Access to Reservation Data for 6 Months
Hospitality group BWH Hotels says hackers had access to a web application housing some guest reservation data for more than six months. Emails sent to customers show the intrusion was discovered on 22 April 2026, with investigators finding that threat actors…
SecurityWeek - Tampered Tokenizer Files Pose AI Model Hijack Risk, Experts Warn
Hugging Face’s open source model repository is highlighting a vector where a tokenizer library file can be manipulated to hijack model outputs, with a single edit to the tokenizer[.]json potentially enabling a attacker to supervise what a model outputs and…
Dark Reading 4 articles this day · The Hacker News first · 4 outlets
Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach · Instructure reaches deal with hackers to delete stolen Canvas dataShow 4 articlesHide 4 articles
- Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach13:58DataBreaches
- Instructure reaches deal with hackers to delete stolen Canvas data13:26SecurityWeek
- Canvas Data 'Returned' After ShinyHunters Deal, but Risk Remains08:41Malwarebytes
- Instructure reaches deal with ShinyHunters after 9k org breach07:37The Hacker News
- Homeland Security wants to know about the Instructure breach; we still want to know about the Navigate360 breach
- Free OnlyFans Lure Used to Spread Cross-Platform CRPx0 Malware
SecurityWeek reports that CRPx0 is a cross‑platform, multi‑stage malware campaign that currently targets Windows and macOS, with Linux capabilities reportedly in development, and was analysed by Aryaka Threat Research Labs. The campaign begins with a lure…
SecurityWeek - Apple and Google Launch Cross Platform E2EE RCS Messaging Beta
End-to-end encrypted (E2EE) Rich Communication Services (RCS) messaging is being rolled out in beta between iPhone and Android handsets, closing one of the longest-running interoperability gaps in mainstream mobile messaging. Apple announced the beta rollout…
Infosecurity - When "idle" isn't idle: how a Linux kernel optimization became a QUIC bug
The article discusses a bug related to the CUBIC congestion control algorithm used in Linux that affects QUIC connections. The problem arises when the congestion window (cwnd) is pinned at its minimum after a congestion collapse, preventing recovery. This…
Cloudflare - West Pharma Takes Systems Offline After Global Ransomware Breach
West Pharmaceutical Services says it took systems offline globally after hackers exfiltrated data and deployed file-encrypting ransomware, with the incident occurring on 4 May and prompting proactive shutdowns of affected on-premise infrastructure. The…
SecurityWeek - TrickMo uses TON network to hit EU banking, crypto users
Cybersecurity researchers have flagged a new TrickMo variant that uses The Open Network (TON) for its command-and-control communications, as observed by ThreatFabric between January and February 2026. The variant is actively targeting banking and…
The Hacker News - Apple patches dozens of macOS, iOS flaws, including WebKit bugs
Apple on Monday published 11 new security advisories detailing dozens of patched vulnerabilities across macOS and iOS, with iOS and iPadOS 26.5 fixing more than 60 CVEs, including 20 WebKit issues that can cause crashes or expose sensitive data. According to…
SecurityWeek - Apple patches 82 macOS flaws, highlights WiFi and kernel bugs
According to The Apple macOS Security Update Review, May 2026 saw Apple release 82 unique CVEs across three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. The analysis notes that Apple does not provide…
thezdi.comCVE-2026-28819 - SAP Patches Critical S/4HANA, Commerce Vulnerabilities
SAP has issued 15 security notes as part of its May 2026 Security Patch Day, with the most severe fixes addressing critical code injection flaws in S/4HANA and Commerce. These two high‑severity vulnerabilities carry a CVSS score of 9.6; S/4HANA is tracked as…
SecurityWeekCVE-2026-34260 - ClickFix attackers use decade old Python proxy to stay hidden
Cybercriminals have combined ClickFix attacks with PySoxy, a 10-year-old open-source Python SOCKS5 proxy, to maintain persistence on victims’ machines without malware, even after attempts at removal. The campaign, detailed by ReliaQuest researchers, shows…
Infosecurity - Dark Reading marks 20 years of CISO influence with 20 leaders
Dark Reading’s 20 Leaders Who Built the CISO Era marks two decades of cybersecurity history, profiling CISOs, researchers, policymakers and other pivotal figures who reshaped enterprise risk. The piece, part of Dark Reading’s 20th anniversary coverage,…
Dark Reading - CISA and G7 release joint AI software bill of materials guidance
According to CISA and the Group of Seven (G7) international partners—Germany, Canada, France, Italy, Japan, the United Kingdom, and the European Union—joint guidance on Software Bill of Materials for AI – Minimum Elements has been released to help public and…
CISA - Radiant Security Webinar Reveals AI Fix for Overlooked SOC Alerts
According to The Hacker News, a technical webinar titled “Alert Coverage No One Else Can Triage” will address why the riskiest SOC alerts often go uninvestigated and how Radiant Security proposes to fill the coverage gap. The session, hosted on May 21, 2026,…
The Hacker News - Attackers exploit cPanel CVE-2026-41940 to deploy Filemanager Backdoor
Attackers are abusing cPanel CVE-2026-41940 to deploy a backdoor known as Filemanager on compromised servers. The flaw enables remote attackers to bypass authentication and gain access to the cPanel/WHM interface, with researchers noting a CVSS score of 9.3.…
- Claude Mythos spots one curl bug, experts split on AI claim
A SecurityWeek feature reports that Claude Mythos found only one curl vulnerability, with experts divided on what this means for the AI model’s capabilities. Curl’s lead developer, Daniel Stenberg, says Mythos claims are marketing, but many in the industry…
SecurityWeek - AI Powered Self Rewriting Malware Makes Traditional SOCs Obsolete
SecurityWeek argues that the traditional Security Operations Centre is obsolete because threats now move at machine speed, outpacing human-centric SOC workflows. The piece notes that attackers are deploying AI-powered techniques, with Google’s Threat…
SecurityWeek - Agentic AI Runs Loose, Leaving Security Teams Out of the Loop
Agentic AI is already in production, with systems executing tasks and taking actions often without security teams being involved, according to The Hacker News. The piece argues that the real issue is whether security professionals understand what they are…
The Hacker News - TeamPCP’s Mini ShaiHulud supply chain attack hits 170+ packages
SecurityWeek reports that the Mini Shai-Hulud supply chain campaign, blamed on TeamPCP, compromised more than 170 packages across multiple high-profile projects, including 42 TanStack packages and 65 UiPath packages, as well as Mistral AI’s PyPI packages and…
SecurityWeekTeamPCP - Dark Web Forum Monitoring Gives Early Warning of 2026 Breaches
The article surveys the Top 10 Deep Web and Dark Web Forums in 2026, naming XSS, Exploit[.]in, BHF, Dread, DarkForums, Altenen, CryptBB, Cracked, DamageLib, and the ShinyHunters DLS as the most actively monitored platforms based on threat intelligence, court…
SOCRadar - WannaCry worm spreads globally after exploiting Windows SMB flaw
WannaCry emerged on 12 May 2017, exploiting a vulnerability in the SMBv1 protocol of Microsoft Windows (CVE-2017-0144, aka EternalBlue) and was later addressed by the MS17-010 patch in March 2017. The attack spread as a worm, able to propagate autonomously…
- Hackers hijack Hugging Face repo to spread infostealer malware
Security researchers have uncovered covert infostealer malware hidden in a top-ranking Hugging Face repository, in another example of the dangers posed by the AI supply chain. According to HiddenLayer, the attack used the Open-OSS/privacy-filter, which was…
Infosecurity - Cifas Finds One in Eight UK Employees Sold Login Credentials
UK anti-fraud non-profit Cifas published research showing that one in eight workers at large enterprises have either sold their company login credentials or know someone who did, based on interviews with 2,000 employees from organisations with at least 1,000…
Malwarebytes - Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
According to The Hacker News, TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of the Mini Shai-Hulud…
- Top 10 Anonymous Browsers for Safe Dark Web Access in 2025
The article outlines the 10 best dark and deep web browsers for anonymity, with Tor Browser described as the gold standard for Dark Web anonymity. It also covers I2P, Freenet, Tails OS, Whonix, Subgraph OS, Mozilla Firefox (when configured for Tor),…
SOCRadar - UK Water Firm Fined Nearly £1m After Massive Customer Data Breach
A UK water company has been fined nearly £1m by the Information Commissioner’s Office (ICO) after a two-year incident resulted in the compromise of personal information on over 633,000 people. South Staffordshire Water and parent company South Staffordshire…
Infosecurity - Discord and Gemini Database Claims, Cisco FMC RCE Leak, Xia Stealer Sale, and IMSS Donor Records Listing
SOCRadar’s Dark Web Team identified several new underground posts, including an alleged Discord database leak and an alleged Google Gemini database leak shared for free, along with an alleged Cisco Secure Firewall Management Center RCE tied to…
- Ransomware groups shift to data leak extortion as payments drop
Kaspersky’s State of ransomware in 2026 notes that International Anti-Ransomware Day on May 12 frames a year in which ransomware remains persistent and adaptive, with new families adopting post-quantum cryptography ciphers and a growing shift towards…
securelist.com - OpenAI launches Daybreak AI tool to spot and fix code flaws early
OpenAI has launched Daybreak, a cybersecurity initiative that combines frontier AI model capabilities with Codex Security to help organisations identify and patch vulnerabilities before attackers exploit them. According to OpenAI, Daybreak blends AI…
The Hacker News - TrickMo Android Trojan Moves C2 to Telegram’s TON Network
ThreatFabric researchers have identified a new TrickMo Android banking Trojan variant that reengineers its underpinnings for stealth, resilience and operator reach, migrating its command-and-control traffic off the conventional internet and onto The Open…
Security Affairs - Apple enables end to end encrypted RCS across iPhone and Android
iOS 26.5 is rolling out end-to-end encrypted RCS messaging between iPhone and Android, with the feature enabled by default for new and existing conversations on both platforms. The rollout is available to iPhone users on iOS 26.5 with supported carriers and…
The Hacker News
