News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 83 so far | 4 |
Developing
Thu 14 May57 articles
4 articles this day · The Hacker News first · 4 outlets
Cisco SD WAN flaw lets attackers seize control, patch urged · U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalogShow 4 articlesHide 4 articles
- Cisco SD WAN flaw lets attackers seize control, patch urged20:25Dark Reading
- U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog18:35Security Affairs
- Cisco SD WAN authentication bypass lets attackers gain admin access17:51CISA
- Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access17:45The Hacker News
- Cisco SD WAN flaw lets attackers seize control, patch urged
- CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS
CVE-2026-0265 is an authentication bypass in Palo Alto Networks PAN-OS, with Palo Alto Networks publishing a security advisory on 13 May 2026. The flaw allows a remote unauthenticated attacker with network access to bypass authentication when Cloud…
Rapid7CVE-2026-0265 - Zero day YellowKey exploit rapidly bypasses Windows 11 BitLocker
A zero-day exploit circulating online allows people with physical access to a Windows 11 system to bypass default BitLocker protections and gain complete access to an encrypted drive within seconds, a threat described in Ars Technica as YellowKey. The…
Ars Technica 3 articles this day · Infosecurity first · 3 outlets
Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root · Linux Kernel Flaw Fragnesia Lets Local Users Gain Root AccessShow 3 articlesHide 3 articles
- Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root17:57Security Affairs
- Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access13:44SecurityWeek
- New Fragnesia Flaw Hands Linux Local Users Root Access13:00Infosecurity
- Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root
- Malicious node ipc npm packages steal secrets via HTTPS and DNS
Cybersecurity researchers have flagged malicious activity in three published versions of the node-ipc npm package, specifically node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1, with early analysis from Socket and StepSecurity describing obfuscated…
The Hacker News - FrostyNeighbour Uses Spear Phish PDFs to Hit EU Govt Targets
A Belarussian cyberespionage group, FrostyNeighbor, is back with a threat campaign aimed at Eastern European government and military organisations in Poland and Ukraine, according to ESET research. The campaign began in March and continues to evolve its…
Dark ReadingFrostyNeighbor - Malicious node ipc npm release exfiltrates cloud secrets
StepSecurity has detected multiple malicious releases of the widely used node-ipc npm package, with three confirmed compromised versions: node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1. The obfuscated payload is designed to fire when the package is…
StepSecurity - Palo Alto fixes critical PAN OS bug after EarthWorm exploits
According to The Hacker News, Palo Alto Networks has released the first round of fixes for CVE-2026-0300, a critical PAN-OS flaw in the User-ID Authentication Portal that could let an unauthenticated attacker execute arbitrary code with root privileges; the…
- Securing Autonomous AI Agents by Bounding the Application Layer
Defence in depth for autonomous AI agents emphasises that security decisions must be made across multiple layers, with the application layer being the decisive one for safe production use. The article outlines four mutually reinforcing patterns: design…
Microsoft - Broadcom releases VMware Fusion security update for root access bug
Broadcom has released a security update for VMware Fusion to fix a high-severity flaw, tracked as CVE-2026-41702, which could allow local attackers to escalate privileges to root on affected systems. The vulnerability is a time-of-check time-of-use (TOCTOU)…
Security AffairsCVE-2026-41702 - Secret Blizzard’s Kazuar malware hits govts with P2P botnet
Kazuar is a sophisticated malware family attributed to the Russian state actor Secret Blizzard and described as a modular peer-to-peer botnet designed to provide persistent, covert access for espionage purposes. The threat group has historically targeted…
MicrosoftTurla - FDMTP backdoor v3.2 update tied to Mustang Panda espionage
An updated variant of the FDMTP backdoor has been observed in a months-long espionage campaign aimed at networks in the Asia-Pacific and Japan, with researchers claims that the activity is linked to the China-aligned group Mustang Panda. According to…
InfosecurityMUSTANG PANDA - When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
AI and agentic deployments across cloud-native platforms are increasingly prioritising speed over secure configuration, leading to exploitable misconfigurations when public exposure pairs with weak or missing authentication. According to Microsoft Defender…
Microsoft - Belarus aligned Ghostwriter hits Ukraine via Ukrtelecom phishing
The Ghostwriter group, described as Belarus-aligned, has been attributed with a fresh wave of attacks against Ukrainian government organisations, according to The Hacker News. Since March 2026, the latest activity seen involves spear-phishing PDFs that drop…
The Hacker NewsGhostwriter - Broadcom patches ESXi zero day, urges DPU security for AI DCs
In March 2025, Broadcom patched a series of VMware ESXi zero-day vulnerabilities that could escape the VM sandbox entirely, highlighting how a single compromise can disable or encrypt dozens of virtual machines at once. In 2023, the ESXiArgs campaign…
SecurityWeek 2 articles this day · SecurityWeek first · 2 outlets
NGINX Rift flaw lets attackers run code with one HTTP request · F5 fixes NGINX heap overflow and iControl REST command injectionShow 2 articlesHide 2 articles
- NGINX Rift flaw lets attackers run code with one HTTP request13:30Security Affairs
- F5 fixes NGINX heap overflow and iControl REST command injection10:47SecurityWeek
- NGINX Rift flaw lets attackers run code with one HTTP request
- Google launches Android Intrusion Logging to track spyware
Google has rolled out a feature to help investigate spyware attacks on Android devices, called Android Intrusion Logging, as part of Android Advanced Protection Mode (AAPM). The tool was released on 12 May 2026 and is designed to let high‑risk users log…
Infosecurity - AI security startups draw record funding, outpacing M&A by $1bn
AI-driven cybersecurity funding has surged this year, with investment in AI security startups in 1Q26 surpassing AI acquisitions by more than $1 billion, a rare shift in the market, according to Dark Reading. Momentum Cyber’s report shows 108 deals in Q1,…
Dark Reading - Mythos Proves Potent in Vulnerability Discovery, Less Convincing Elsewhere
Mythos appears to be as powerful as claimed at detecting software vulnerabilities, but its capabilities in other areas are more nuanced, according to SecurityWeek’s review. Independent benchmarking by XBOW found Mythos is extremely strong for source code…
SecurityWeek - Akamai to buy AI focused browser security firm LayerX for $205m
According to SecurityWeek, Akamai has agreed to acquire LayerX, a company specialising in AI and browser security, for roughly $205 million. The deal will allow Akamai to expand its Zero Trust and application security portfolio with AI usage control…
SecurityWeek - Alleged Dream Market admin arrested in Germany
According to The Record, German and U.S. authorities arrested Owe Martin Andresen, 49, during a May 7 raid on three locations, on multiple charges of money laundering. An indictment unsealed this week by the DOJ accused Andresen of being the main…
DataBreaches - Salt Typhoon hits Azerbaijani energy firm via Exchange exploit
SecurityWeek reports that Salt Typhoon, also known as Earth Estries, FamousSparrow, GhostEmperor, and UNC2286, expanded its targets to include an Azerbaijani energy company, with Bitdefender noting the activity between December 2025 and February 2026. The…
SecurityWeekGhostEmperor - Siemens SIPROTEC 5 devices at risk from weak session ID flaw
Siemens SIPROTEC 5 devices are vulnerable because their session identifiers are not generated from sufficiently random numbers, potentially allowing an unauthenticated remote attacker to hijack a valid user session by brute-forcing the ID, according to the…
CISACVE-2024-54017 - CISA alerts to Siemens HMI vulnerability permitting browser access
The Cybersecurity and Infrastructure Security Agency has published an ICS Advisory titled Siemens SIMATIC (ICSA-26-134-07), released on 14 May 2026. It outlines a vulnerability in SIMATIC HMI Unified Comfort Panels before V21.0 that could allow an…
CISACVE-2026-27662 - Critical Path Traversal Flaw in Siemens ROS# File Server Exposed
According to Siemens ProductCERT SSA-357982, Siemens ROS# contains a ROS service file_server that before version 2.2.2 exposes a path traversal vulnerability allowing a remote attacker to read and write arbitrary files on the system hosting the service. The…
CISACVE-2026-41551 - Siemens gWAP hit by RCE flaw via Axios library, patch now advised
Siemens gWAP is affected by a remote code execution vulnerability introduced through a third‑party component, the Axios HTTP client library, with a specific Gadget attack chain enabling prototype pollution in third‑party dependencies. According to Siemens…
CISACVE-2026-40175 - Siemens SIMATIC CN 4100 hit by CVE-2024-47704, urges V5.0 update
According to the ICS Advisory “Siemens SIMATIC” released on 14 May 2026, Siemens SIMATIC CN 4100 is listed as affected by a suite of Linux kernel and related components vulnerabilities (CVEs such as CVE-2024-47704, CVE-2024-57924, CVE-2025-6021,…
CISACVE-2024-47704 - Siemens Ruggedcom Rox flaw lets attackers run root commands
CISA has published ICS Advisory ICSA-26-134-12, released on 14 May 2026, regarding Siemens Ruggedcom Rox. The advisory warns of an input validation vulnerability in the Scheduler functionality of Ruggedcom Rox, which could allow an authenticated remote…
CISACVE-2025-40949 - Siemens Industrial Devices Flaw Triggers DoS, Needs Manual Restart
According to Siemens ProductCERT, the Siemens ICS advisory ICSA-26-134-06 warns of a vulnerability in multiple Siemens Industrial Devices that could allow an attacker to trigger a denial of service, with a CVSS v3.1 base score of 7.5. The list of affected…
CISACVE-2025-40833 - PraisonAI flaw exploited hours after CVE-2026-44338 disclosure
Threat actors have been observed attempting to exploit PraisonAI CVE-2026-44338 within hours of its disclosure, highlighting the rapid exploitation trend noted by Sysdig. The flaw, a CVSS 7.3 authentication bypass, affects PraisonAI’s open‑source multi‑agent…
The Hacker NewsCVE-2026-44338 - AI hallucinations put critical infrastructure at risk study shows
AI hallucinations are introducing serious security risks by delivering highly confident yet incorrect outputs that mislead critical infrastructure decision‑making. The piece cites a 2025 Artificial Analysis AA-Omniscience benchmark which found that, across…
The Hacker News - G7 Publishes AI SBOM Guidance to Boost Supply Chain Transparency
G7 countries this week published joint AI SBOM guidance aimed at helping organisations create a software bill of materials for AI, with the document titled Software Bill of Materials for AI – Minimum Elements and seven clusters designed to boost transparency…
SecurityWeek - Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoor
Kimsuky, a Korean-speaking threat actor, has expanded its PebbleDash and AppleSeed toolset in a string of campaigns, with PebbleDash variants such as HelloDoor, httpMalice and MemLoad, and AppleSeed variants including HappyDoor. The group delivers…
securelist.comRuby Sleet - Why Malwarebytes blocks some Yahoo Mail redirects
Malwarebytes has explained that some Yahoo Mail redirects are being blocked because background calls from the Yahoo Mail web interface reach third‑party domains that many security tools classify as risky. The article notes that when you open Yahoo Mail, the…
Malwarebytes
