News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 73 so far | 4 |
Developing
Mon 18 May50 articles
- US healthcare breaches expose millions as HHS tracker updates
Several major healthcare data breaches were added to the US Department of Health and Human Services (HHS) tracker in recent days, according to the tracker. The largest incident involves NYC Health and Hospitals Corporation, with a breach detected on 2…
SecurityWeek - ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery
Four vulnerabilities in the OpenClaw AI assistant have been linked in a chainable set named Claw Chain, capable of escaping the sandbox and delivering backdoors, security firm Cyera warns. The four flaws can be exploited in sequence to move from prompt…
SecurityWeekCVE-2026-44113 - SparkCat stealer hides in Android apps as Mamont Trojans surge
According to Kaspersky Security Network, in Q1 2026 more than 2.67 million attacks utilizing malware, adware, or unwanted mobile software were prevented. The Trojan-Banker category was the prevalent mobile malware threat with a 10.86% share of total…
securelist.com - Kaspersky blocks 343M attacks as ransomware variants surge in Q1 2026
According to AMR, IT threat evolution in Q1 2026 shows that Kaspersky products blocked more than 343 million attacks originating from online resources, with Web Anti-Virus responding to 50 million unique links and File Anti-Virus blocking nearly 15 million…
- Boulevard of Broken Dreams: 2 Decades of Cyber Fails
According to TechTarget and Informa Tech’s Digital Business Combine, the two groups power an unparalleled network of 220+ online properties spanning 10,000+ granular topics. The network serves an audience of more than 50 million professionals with original,…
Dark Reading - SOCRadar finds kernel EDR killer and huge data leaks on dark web
SOCRadar’s Dark Web Team identified several new underground posts, including a kernel-level “EDR/XDR terminator” package advertised as source code plus a compiled driver, and a post claiming an 832.87GB “Adobe Business” dataset, among other…
SOCRadar - ShinyHunters leaks 600k Salesforce records from 7Eleven breach
7-Eleven has confirmed a data breach after the ShinyHunters hacker group claimed to have stolen information from its systems. The intrusion into a franchise documents storage area was detected on 8 April, and the hackers claimed more than 600,000 Salesforce…
SecurityWeekShinyHunters - Attackers Hit Developer Workstations to Harvest CI/CD Credentials
Developer workstations are identified as a real part of the software supply chain, with attackers increasingly targeting secrets stored in developer environments and CI/CD pipelines. In a 48-hour window, three campaigns hit npm, PyPI and Docker Hub, all…
The Hacker News - Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Ivanti, Fortinet, SAP, VMware, and n8n have all released security fixes for a range of flaws that could allow unauthenticated attackers to read data, execute code or bypass authentication. The notable listing starts with Ivanti Xtraction CVE-2026-8043 (CVSS…
The Hacker NewsCVE-2026-8043 - Edge to stop loading all passwords into memory at startup
Microsoft says it is changing Edge’s plaintext password handling as a defence‑in‑depth measure. Previously Edge decrypted the entire saved‑password store on startup and kept credentials in memory in clear text for the whole browser session. It had been…
Malwarebytes 3 articles this day · The Hacker News first · 3 outlets
MiniPlasma exploit revives Windows privilege flaw CVE-2020-17103 · MiniPlasma PoC revives CVE-2020-17103 flaw on fully patched WindowsShow 3 articlesHide 3 articles
- MiniPlasma exploit revives Windows privilege flaw CVE-2020-1710310:38SecurityWeek
- MiniPlasma PoC revives CVE-2020-17103 flaw on fully patched Windows08:13Security Affairs
- MiniPlasma PoC reveals unpatched Windows privilege escalation flaw04:59The Hacker NewsExploited
- MiniPlasma exploit revives Windows privilege flaw CVE-2020-17103
- UK NCSC Issues Agentic AI Guidance to Curb Cyber Risks
The UK’s National Cyber Security Centre (NCSC) has released new guidance for organisations keen to harness agentic AI while keeping cyber risks in check, as published on 18 May 2026. According to NCSC, the guidance accompanies a broader report produced with…
Infosecurity - Cloned Shai Hulud Worm Targets NPM After Source Code Leak
According to Ox Security, the first Shai-Hulud worm clones emerged after TeamPCP released the malware’s source code on GitHub, with at least one threat actor adopting it in attacks against NPM developers. Shai-Hulud was first used in September 2025 and again…
SecurityWeek - Pwn2Own Berlin 2026 awards $1.3m for 47 zero day flaws
Security researchers were awarded close to $1.3m after discovering 47 zero-day vulnerabilities at Pwn2Own Berlin, which ran for three days from 14 to 16 May and was sponsored by TrendAI’s Zero Day Initiative (ZDI). The Devcore team won the event, claiming a…
Infosecurity - UK regulators tell banks to act on rising AI cyber risks
According to Bank of England, FCA and Treasury, UK financial services firms must actively manage cybersecurity risks stemming from frontier AI. A joint missive dated 15 May clarifies and reinforces the message as the operating environment becomes more…
Infosecurity - Malicious npm packages spread worm clone and DDoS botnet
Cybersecurity researchers have flagged four new npm packages that carry information-stealing malware, with one package containing a direct clone of the Shai-Hulud worm released by TeamPCP. The identified packages and download counts are chalk-tempalte (825…
The Hacker News - Grafana Confirms Breach After Hackers Claim They Stole Data
Grafana confirms a data breach after being listed by Coinbase Cartel on its leak site, with the intrusion traced to a compromised token that granted access to Grafana Labs’ GitHub environment. SecurityWeek reports that Grafana admitted attackers downloaded…
SecurityWeekCoinbase Cartel 2 articles this day · Security Affairs first · 2 outlets
Hackers Exploit NGINX Zero Day CVE-2026-42945 in Wild · NGINX Rift flaw CVE-2026-42945 exploited despite ASLR mitigationsShow 2 articlesHide 2 articles
- Hackers Exploit NGINX Zero Day CVE-2026-42945 in Wild07:27SecurityWeek
- NGINX Rift flaw CVE-2026-42945 exploited despite ASLR mitigations06:33Security Affairs
- Hackers Exploit NGINX Zero Day CVE-2026-42945 in Wild
- Attackers hijack JDownloader installers, inject malware for days
A week in security for May 11–May 17, 2026 was documented by Malwarebytes Labs, summarising a busy period of threat news. Highlights include attackers replacing JDownloader installer downloads with malware on the JDownloader website for several days, and…
Malwarebytes - Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations
A new analysis of the Lua-based fast16 malware confirms it was a cyber sabotage tool designed to tamper with nuclear weapons testing simulations. According to Symantec and Carbon Black teams, the pre-Stuxnet tool was engineered to corrupt uranium‑compression…
The Hacker NewsEquation Group - Hackers Earn $1.3 Million at Pwn2Own Berlin 2026
Pwn2Own Berlin 2026 has come to an end, with participants earning a total of nearly $1.3 million for exploits targeting Windows, Linux, VMware, Nvidia, and AI products. According to TrendAI’s Zero Day Initiative (ZDI), white hat hackers were awarded…
SecurityWeek - AI Fake Holocaust Images on Facebook Spark Profit Concerns
In May of last year, the Auschwitz-Birkenau State Museum warned publicly about a Facebook account using generative AI to create fake images of people who died in the Holocaust, noting that some images used real names, birthplaces and deportation histories…
Malwarebytes - South Korea prepares AI deepfake ban for 2026 local elections
South Korea will hold local elections on 3 June 2026, and for the first time will enforce two laws aimed at curbing the use of AI deepfakes in political campaigns. Article 82-8 of the Public Official Election Act, established in 2023, prohibits generating…
Dark Reading
Sun 17 May6 articles
- Security Affairs Round 97 Covers JDownloader Hacked, TrickMo Rise
According to Security Affairs, the Security Affairs Malware newsletter Round 97, by Pierluigi Paganini, offers a curated collection of malware research from around the international landscape and was published on 17 May 2026. The feature highlights include…
- Pwn2Own Berlin 2026 crowns champion with $1.3 million prize
Security Affairs' weekly newsletter presents Round 577, the INTERNATIONAL EDITION, authored by Pierluigi Paganini and dated 17 May 2026. The digest highlights a mix of security news and analysis, featuring items such as attackers exploiting Funnel Builder…
Security Affairs - Attackers exploit Funnel Builder bug to skim WooCommerce payments
Attackers are exploiting a critical flaw in the WordPress Funnel Builder plugin to inject e-skimmers into WooCommerce checkout pages, with the vulnerability noted by Sansec researchers. Funnel Builder, used as a checkout and upsell plugin on over 40,000…
Security Affairs - CVE-2026-42945 Exploit Seen In Wild, NGINX Users Urged To Patch
The Hacker News reports that a newly disclosed vulnerability, CVE-2026-42945, in NGINX Plus and NGINX Open, has been exploited in the wild, causing worker crashes and potential remote code execution. The flaw is a heap buffer overflow in…
The Hacker NewsCVE-2026-42945 - Grafana token leak exposed GitHub code, extortion attempt failed
Grafana has disclosed that an unauthorized party obtained a token that granted access to its GitHub environment and allowed the downloader to access the company’s codebase. According to Grafana, the investigation determined that no customer data or personal…
The Hacker News - DEVCORE Dominates Pwn2Own Berlin 2026 with $1.3M Zero Day Haul
Pwn2Own Berlin 2026 concluded on Day Three with DEVCORE crowned Master of Pwn and a final tally of $1.298 million across 47 unique zero-days discovered. The event ended with DEVCORE leading the field on every metric, finishing with 50.5 Master of Pwn points…
Security Affairs
Sat 16 May10 articles
- CISA flags Exchange zero day flaw CVE-2026-42897 in KEV list
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft Exchange Server flaw, tracked as CVE-2026-42897 with a CVSS score of 8.1, to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft warned that threat actors are…
- Another detail emerges about Instructure’s agreement with ShinyHunters; Debate continues about whether to pay
DataBreaches[.]net reports that Instructure paid ShinyHunters after its second attack, and that the payment was reportedly higher than what would have been negotiated in April, with the exact amount not disclosed. The article notes that ShinyHunters has…
DataBreachesShinyHunters - Russian Turla Group Deploys P2P Kazuar Botnet for Stealth
Russian-linked APT group Turla has upgraded its Kazuar backdoor into a modular peer-to-peer botnet designed for stealth and long-term access to compromised systems, according to Microsoft researchers. The Kazuar botnet now features Kernel, Bridge, and Worker…
Security AffairsTurla - Critical Flaw in Funnel Builder Plugin Hijacks WooCommerce Payments
The Hacker News reports a critical vulnerability in the Funnel Builder WordPress plugin that has moved into active exploitation to skim payments on WooCommerce checkout pages. The flaw allows unauthenticated attackers to inject arbitrary JavaScript into…
The Hacker News - BlackFile vishing attack steals data from Microsoft 365 and Okta
According to Google Threat Intelligence Group, UNC6671—operating under the BlackFile brand—has run an extensive vishing extortion campaign that targets organisations via social engineering and single sign-on compromise. The group uses adversary-in-the-middle…
DataBreachesUNC6671 - Michigan nurse guilty of $1.6M Medicare fraud via hospital bribes
A federal jury in the Eastern District of Michigan convicted a Michigan nurse and home health care agency owner yesterday for operating a $1.6 million scheme to defraud Medicare, according to Dissent reporting. The defendant, Ruby Scott, 55, of Farmington…
DataBreaches - Supreme Court backs Illuminate in student data breach case
The Supreme Court of California has ruled in J.M. v. Illuminate Education, Inc, reversing the Court of Appeal and holding that J.M. failed to state viable claims under the Confidentiality of Medical Information Act (CMIA) and the Customer Records Act (CRA).…
DataBreaches - Pwn2Own Berlin 2026 racks up $908k for 39 zero day wins
Pwn2Own Berlin 2026 concluded on 16 May 2026 with a final day that added to the event’s tally of impressive findings, bringing the running total to $908,750 for 39 unique zero days. The Master of Pwn standings were updated as Day Three unfolded, with…
thezdi.com
