News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 70 so far | 3 |
Developing
Tue 19 May51 articles
- Drupal warns of exploit risk, urges sites to prep for May update
Drupal has issued an alert that it intends to release a core security update for all supported branches on 20 May 2026, from 5–9 p.m. UTC. According to Drupal Security Team, exploits might be developed within hours or days, so site operators are urged to…
The Hacker News - 201 Arrested in Crackdown on Cybercrime in Middle East, North Africa
A 13-country law enforcement crackdown on phishing and malware threats in the Middle East and North Africa, named Operation Ramz, led to 201 arrests, with 382 additional suspects identified. The operation ran from October 2025 to 28 February 2026, and…
SecurityWeek - DirtyDecrypt kernel flaw PoC released, raising privilege fears
SecurityWeek reports that a proof-of-concept (PoC) for the DirtyDecrypt Linux kernel vulnerability is now available, with the exploit published by the V12 security team who discovered it earlier this month after fixes were rolled out in April. The flaw,…
- SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access
Security researchers have disclosed critical vulnerabilities in SEPPMail Secure E-Mail Gateway that could enable remote code execution and allow attackers to read arbitrary mails from the appliance, according to InfoGuard Labs researchers Dario Weiss, Manuel…
The Hacker NewsCVE-2026-2743 - Grafana Labs Rejects Ransom After Source Code Leak Via Token
Grafana Labs says hackers stole its source code after an unauthorised party obtained a token that gave access to its GitHub environment and allowed download of the codebase. The firm said in posts on X that they have invalidated the compromised credentials…
InfosecurityCoinbase Cartel - Poland tells officials to drop Signal after Russian phishing
Poland has instructed government officials to stop using the popular instant messaging app Signal for sensitive communications and to move to a state-developed alternative. The decision follows repeated cyberattacks targeting Signal accounts belonging to…
Security Affairs - INTERPOL's Operation Ramz nets 201 arrests across Middle East
According to INTERPOL, Operation Ramz was a multinational effort across the Middle East and North Africa that led to 201 arrests and the identification of 382 additional suspects. The first-of-its-kind operation, conducted by 13 countries between October…
Security Affairs - ClickFix tactics trick users into spreading Vidar Stealer malware
The article reports that threat actors are eschewing traditional malware-driven attacks in order to bypass security tools and socially engineer victims, according to the Cyber Threat Intelligence Report 2026 published by Bridewell. The report notes attack…
Infosecurity - Compromised Nx Console Extension Steals Dev Credentials
A compromised version of the Nx Console VS Code extension, version 18.95.0, published as rwl[.]angular-console, has been linked to a credential stealer and supply chain attack. The extension, with more than 2.2 million installations on the VS Code…
The Hacker News - Shai Hulud worm copycats strike NPM via supply chain attacks
Shai-Hulud worm copycats are already hitting online targets just days after the malware’s source code was dumped on GitHub, with researchers warning that copycats would emerge and they were right. According to Ox Security, at least one threat actor is…
Security Affairs - Mini Shai Hulud worm breaches AntV, steals CI/CD keys on GitHub
A new wave of the Mini Shai-Hulud worm has compromised packages across Alibaba’s AntV data visualisation ecosystem, including echarts-for-react, timeago[.]js, and dozens more, with stolen CI/CD secrets being dumped to thousands of public GitHub repositories…
StepSecurity - Critical CVE-2026-8153 Flaw Enables Remote Hijack of Cobots
According to CISA and Universal Robots, PolyScope 5, the operating system powering the company’s cobots, is affected by CVE-2026-8153, an OS command injection in the Dashboard Server interface. The flaw is rated critical with a CVSS score of 9.8 and has been…
SecurityWeekCVE-2026-8153 - GitHub Action Compromised to Steal CI/CD Credentials
On 19 May 2026, The Hacker News reports that threat actors compromised the popular GitHub Actions workflow actions-cool/issues-helper to harvest CI/CD credentials and exfiltrate them to an attacker-controlled server. According to StepSecurity, Varun Sharma…
The Hacker News - Hijacked npm account spreads credential‑stealing malware
The Hacker News reports that Mini Shai-Hulud is pushing malicious versions of AntV npm packages by compromising a maintainer account, with the attack affecting packages tied to the npm maintainer account atool, including echarts-for-react, a popular React…
The Hacker News - Compromised atool account pushes malware to timeago.js and AntV
The atool npm account, linked to hustcc on GitHub and the author of timeago[.]js, was compromised, with the account’s email listed as i@hust[.]cc. The attacker published two waves of malicious releases across 24 packages in a 10-minute window on 19 May 2026,…
StepSecurity - ISC Stormcast Shows Green Threat Level, Promotes SANS Podcast
The ISC Stormcast for Tuesday, 19 May 2026 notes a Threat Level of green and identifies Handler on Duty as Jan Kopriva. The diary includes a link to learn more about classes Johannes Ullrich is teaching for SANS. It also promotes the podcast detail at SANS…
SANS ISC
Mon 18 May50 articles
- Storm-2949 breaches Microsoft 365, Azure after identity takeover
Microsoft Threat Intelligence researchers describe Storm-2949 conducting a two‑phase campaign that began with targeted identity compromise and progressed to cloud infrastructure takeover, exfiltrating data from Microsoft 365, file hosting, and Azure…
MicrosoftStorm-2949 2 articles this day · The Hacker News first · 2 outlets
Microsoft Exchange Zero-Day Under Attack, No Patch Available · Microsoft Exchange zero day bug exploited in the wildShow 2 articlesHide 2 articles
- Microsoft Exchange Zero-Day Under Attack, No Patch Available21:43Dark Reading
- Microsoft Exchange zero day bug exploited in the wild13:50The Hacker News
- Microsoft Exchange Zero-Day Under Attack, No Patch Available
- OpenClaw bugs enable full system takeover via chained exploits
Security researchers have disclosed four new vulnerabilities in the OpenClaw framework, which attackers can chain to gain initial access, steal credentials, escalate privileges, and establish persistent backdoor access. The flaws, dubbed “Claw Chain” by…
Dark ReadingCVE-2026-44112 - CISA Admin Leaked AWS GovCloud Keys on Github
According to KrebsOnSecurity, on May 18, 2026 the site reported that until this past weekend a CISA contractor maintained a public GitHub repository exposing credentials to several AWS GovCloud accounts and numerous internal CISA systems. The exposed…
Krebs on Security - actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials
Varun Sharma reports that the popular GitHub Action actions-cool/issues-helper has been compromised, with every existing tag in the repository moved to point to a single imposter commit that does not appear in the action’s normal history. The imposter commit…
StepSecurity 3 articles this day · StepSecurity first · 3 outlets
Jenkins AST plugin trojanised as Mini Shai Hulud worm floods npm · TeamPCP leaks Shai Hulud worm, fuels NPM supply chain attacksShow 3 articlesHide 3 articles
- Jenkins AST plugin trojanised as Mini Shai Hulud worm floods npm20:08SANS ISC
- TeamPCP leaks Shai Hulud worm, fuels NPM supply chain attacks19:53Dark Reading
- StepSecurity's Secure Registry blocks npm worm Mini Shai Hulud15:16StepSecurity
- Jenkins AST plugin trojanised as Mini Shai Hulud worm floods npm
- Nx Console VS Code extension hijacked to steal developer secrets
Version 18.95.0 of the Nx Console VS Code extension (nrwl[.]angular-console), published to the VS Code Marketplace, was found to contain malicious code that targets developer credentials, cloud infrastructure tokens, and CI/CD secrets. The compromised…
StepSecurity - Grafana says hackers stole source code after GitHub token breach
Grafana Labs confirmed a security incident in which a compromised GitHub token gave attackers access to its GitHub environment, after the extortion group Coinbase Cartel listed Grafana on a leak site and claimed data theft on May 15. Grafana said attackers…
Security AffairsCoinbase Cartel - INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests
INTERPOL says its first-of-its-kind crackdown across the MENA region resulted in 201 arrests and the identification of a further 382 suspects, spanning 13 countries between October 2025 and February 2026. The operation targeted phishing and malware…
The Hacker News - AI powered phishing surges putting small firms at greater risk
AI is rapidly reshaping how work gets done, bringing both opportunities and risk for growing businesses, especially during National Small Business Month. The article notes that AI-automated phishing is 4.5 times more effective than traditional cyberattacks,…
Microsoft - Canvas LMS Breach Sparks Senators Enquiry Over Student Data
U.S. Senators Bill Cassidy, M.D. and Tommy Tuberville have urged answers after a cybersecurity incident hit Instructure’s Canvas LMS, potentially affecting the data of 275 million students, families and teachers worldwide. Canvas is described as the most…
DataBreaches - Congress learnt of RXNT breach exposing patient data after delay
Congress is learning months later that RXNT, a healthcare software contractor used by the Office of the Attending Physician, was breached on 1 March and 3 March, with hackers obtaining copies of patient data stored within the platform. The compromised data…
DataBreaches - Extant Aerospace ransomware data breach exposes 3,012 US records
Extant Aerospace, a defence and space electronics company based in Melbourne, Florida, disclosed a data breach that affected 3,012 individuals in the United States, according to Claim Depot. The company, legally known as Symetrics Industries LLC,…
DataBreaches - Iranian hackers tweak US fuel tank gauges, security experts warn
Iranian threat actors allegedly exploited online-exposed automatic tank gauge systems to tamper with readings at fuel storage tanks serving gas stations in the US, demonstrating Iran’s cyber reach beyond its conventional military engagements, a claim echoed…
Dark Reading - B1ack’s Stash Dark Web Site Dumps 4.6M Stolen Credit Cards Free
B1ack’s Stash, a well-known Dark Web carding marketplace, has announced the free release of approximately 4.6 million stolen credit card records, framed as a response to seller misconduct on its platform. In the same move, the operators declared the…
SOCRadar - Interpol's Operation Ramz leads to 201 MENA arrests
According to Interpol, a first-of-its-kind cybercrime crackdown dubbed Operation Ramz led to 201 arrests across the Middle East and North Africa. The operation ran from October 2025 to February 2026, spanning 13 countries in the MENA region. It targeted…
Infosecurity - ShinyHunters says 7 Eleven breach exposed 600k Salesforce records
ShinyHunters has claimed a breach at 7-Eleven, saying it stole more than 600,000 Salesforce records and franchisee data. 7-Eleven confirmed the breach after an unauthorized party accessed systems storing franchisee documents on 8 April 2026, and said it had…
Security AffairsShinyHunters - Five UK Startups Vie for Infosecurity Europe 2026 Cyber Prize
The Infosecurity Europe Cyber Startup Competition is back for 2026, with five cybersecurity startups set to pitch live on 2 June to an audience of senior industry leaders, investors and buyers. The five finalists are Cytidel, a vulnerability intelligence…
Infosecurity - AI Generated Bug Bounty Reports Overwhelm Security Programmes
According to The Financial Times Ltd, bug bounty programmes are being overwhelmed by AI-generated, low-quality reports as researchers flood schemes with spurious submissions. Bugcrowd, whose customers include OpenAI, T-Mobile and Motorola, said reports more…
Ars Technica - Public Amazon S3 bucket leaks hotel guests’ IDs and selfies
Public Amazon bucket leaks sensitive guest data from Japanese hotel platform Tabiq describes a misconfigured Amazon S3 bucket that left Reqrea’s TabIq hotel check‑in system publicly accessible, exposing passports, driver’s licenses and selfie verification…
Security Affairs - Early phishing detection stops threats before they hit business
The Hacker News outlines how early phishing detection can stop a single misleading click from turning into broader disruption, emphasising the value of moving from uncertainty to evidence fast. A recent ANY[.]RUN investigation shows a dangerous phishing…
The Hacker News
