Skip to content
Sign in

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Articles per day, last 14 days

Most articles on Wed 21 Oct (96); 13–17 on weekend days.

20 Oct9622242628301 NovToday67 so faravg 63
  • On CISA KEV CVEs
  • Other coverage
  • Closed-day average
Show as table
Articles per day, last 14 days
DayArticlesOn CISA KEV CVEs
Tue 20 Oct8616
Wed 21 Oct9618
Thu 22 Oct8411
Fri 23 Oct6816
Sat 24 Oct134
Sun 25 Oct132
Mon 26 Oct7621
Tue 27 Oct9518
Wed 28 Oct8716
Thu 29 Oct7817
Fri 30 Oct6910
Sat 31 Oct143
Sun 1 Nov170
Mon 2 Nov807
Today, Tue 3 Nov67 so far3

Developing

Exploited only
108 articles · 19–20 May

Latest days

Wed 20 May57 articles

  1. Huawei router flaw knocks out Luxembourg telecom for three hours

    A Huawei enterprise router flaw reportedly caused Luxembourg’s 2025 nationwide telecom outage, which affected landline, 4G/5G and emergency services for more than three hours after specially crafted traffic forced network devices into continuous reboot…

    Security Affairs
  2. TeamPCP

    2 articles this day · The Hacker News first · 1 outlet

    Grafana breach confined to GitHub, no customer impact · GitHub probing after threat actor offers internal repos for saleShow 2 articles
  3. ISC Stormcast For Wednesday, May 20th, 2026 https://isc.sans.edu/podcastdetail/9938, (Wed, May 20th)

    According to Internet Storm Center, ISC Stormcast for Wednesday, 20 May 2026 notes a green threat level and provides the usual updates and links for readers. The diary identifies the Handler on Duty as Jan Kopriva. It also points readers to a resource…

    SANS ISC
  4. Vulnerability exploits lead breach causes, Verizon DBIR 2026 shows

    Verizon’s 2026 DBIR finds vulnerability exploitation has overtaken credential abuse as the leading breach vector, with AI accelerating attacks and patching delays worsening the problem. The report analyzed 31,000 security incidents, of which more than 22,000…

    SecurityWeek

Tue 19 May51 articles

  1. Dev Machine Guard adds native Linux support for fleet visibility

    Dev Machine Guard now supports Linux, running natively on Linux while already covering macOS and Windows, so the same scanning engine can see every developer machine in your fleet from one dashboard. The release enables Linux developers to appear in the…

    StepSecurity
  2. Dev Machine Guard now covers Windows and macOS developer machines

    Dev Machine Guard now supports Windows, giving security teams full visibility into Windows and macOS developer machines, with the same scanning engine and enterprise dashboard as macOS. According to StepSecurity, the Windows release runs natively on Windows,…

    StepSecurity
  3. AI BOMs Move From Concept to Practice Amid Regulatory Pressure

    AI BOMs are moving from concept to practice as standards bodies, open-source projects and vendors push for practical tooling and governance. According to OWASP, with its CycloneDX SBOM standard, and the Linux Foundation, with its SPDX standard, have both…

    Dark Reading
  4. Verizon DBIR Reveals Patch Gaps as Vulnerability Exploits Rise

    Defenders are grappling with an unprecedented influx of vulnerabilities, with patch prioritisation now more critical than ever, according to Verizon's "2026 Data Breach Investigations Report" ("DBIR"). The DBIR highlights that vulnerability exploitation…

    Dark Reading
  5. Windows Zero-Day Barrage Continues After Patch Tuesday

    Six Windows zero-days were disclosed by Nightmare Eclipse in the six weeks since May 2026’s security update, adding to a growing list that researchers say attackers are already exploiting in some cases. The three new vulnerabilities are YellowKey,…

    Dark ReadingExploitedCVE-2020-17103
  6. CISA’s private GitHub repo leaked passwords for months

    GitGuardian researcher Guillaume Valadon revealed a public GitHub repository belonging to the Cybersecurity and Infrastructure Security Agency (CISA) contained 844MB of sensitive data, including plain-text passwords, authentication tokens and other secrets,…

    Dark Reading
  7. Drupal to Release Critical Core Patch Amid Short Exploit Window

    Drupal is pushing a core security update on May 20, with the Drupal Security Team urging site administrators to block out time between 5 and 9 p.m. UTC for the release window. The vulnerability type has not been disclosed ahead of the coordinated release,…

    Security Affairs
  8. [Virtual Event] Anatomy of a Data Breach: What to Do if it Happens to You

    According to Dark Reading, the virtual event Anatomy of a Data Breach: What to Do if it Happens to You examines the main vulnerabilities and exploits that lead to enterprise data breaches, plus the latest tools and best practices for conducting incident…

    Dark Reading
  9. CISA contractor’s GitHub leak exposed AWS GovCloud access keys

    Security researcher Brian Krebs brings us the news that America’s Cybersecurity & Infrastructure Agency has had a large store of plaintext passwords, SSH private keys, tokens and other sensitive CISA assets exposed in a public GitHub repo since at least…

    Ars Technica
  10. Microsoft durabletask SDK hijacked on PyPI to steal cloud secrets

    On 19 May 2026, three malicious versions of Microsoft’s official durabletask Python SDK—1.4.1, 1.4.2, and 1.4.3—were published to PyPI within a 35-minute window, and they were not released through Microsoft’s official CI/CD pipeline. The versions were pushed…

    StepSecurity
  11. Fox Tempest

    4 articles this day · Infosecurity first · 4 outlets

    Microsoft Disrupts Fox Tempest Malware Signing Service Worldwide · Microsoft shuts Fox Tempest malware signing serviceShow 4 articles
  12. Trapdoor ad fraud hijacked 455 Android apps, spawning traffic

    Cybersecurity researchers have disclosed Trapdoor, a mobile ad fraud operation targeting Android devices, which at its peak generated 659 million bid requests per day and involved 455 apps, with 183 threat actor-owned C2 domains forming its infrastructure.…

    The Hacker News
  13. Drupal to patch highly critical flaw on May 20, urges swift action

    Drupal has announced it is preparing a patch for a “highly critical” vulnerability that security researchers fear could be exploited within hours or days of disclosure. According to SecurityWeek, patches will be released for all supported Drupal versions on…

    SecurityWeek
  14. NYC Health+Hospitals breach exposes 1.8M patient data via vendor

    NYC Health + Hospitals (NYC H+H) disclosed a months‑long breach via a third‑party vendor that exposed highly sensitive patient and employee data for at least 1.8 million people, including medical records, government IDs, geolocation data, and even biometric…

    Malwarebytes
  15. Linux Kernel Privilege Escalation Flaw Exposed by DirtyDecrypt PoC

    Proof-of-concept PoC for a Linux kernel local privilege escalation has been released in relation to CVE-2026-31635, a vulnerability that Zellic and V12 security team reported on 9 May 2026. The flaw is described as an rxgk pagecache write issue caused by a…

    The Hacker NewsCVE-2026-31635
  16. Dark Reading Editors Chart 20 Years of Cybersecurity Evolution

    Looking Back, Looking Forward: Digesting a Dynamic Bouillabaisse of Cyber Evolution sees Dark Reading editors reflecting on two decades of dramatic change in cybersecurity, from perimeter defence to resilience, and noting how AI, cloud and the pandemic have…

    Dark Reading
  17. MSHTA abuse spreads Lumma, Amatera stealers via phishing

    Attackers are increasingly abusing Microsoft’s legacy MSHTA utility to silently deliver stealers, loaders and persistent malware through phishing, fake software downloads and LOLBIN-based attack chains, according to BitDefender. Since the start of this year…

    SecurityWeek
  18. Cloudflare and Anthropic Upgrade AI Agent Sandbox Security

    Cloudflare and Anthropic have collaborated to integrate Claude Managed Agents with Cloudflare Sandboxes, giving developers more control, security, and observability for agent sandboxes. According to Anthropic, the integration lets you run your agent loop on…

    Cloudflare
  19. MSHTA Abused to Deliver Password Stealers and Advanced Threats

    The article details the continued exploitation of Microsoft's HTML Application Host (MSHTA) by cybercriminals, despite its classification as a legacy utility. Researchers from Bitdefender observe that attackers utilize MSHTA to deliver a variety of malware,…

    bitdefender.com
  20. ChromaDB flaw allows remote shell via malicious HuggingFace model

    An unpatched vulnerability in ChromaDB could allow remote, unauthenticated attackers to spawn a shell and take control of the server process, according to HiddenLayer. Tracked as CVE-2026-45829 and referred to as ChromaToast, the pre-authentication remote…

    SecurityWeekCVE-2026-45829
  21. Fake Aldi meat box deal on Facebook lures victims to payment scam

    A Facebook post falsely claiming Aldi is offering a meat box for under £10 is not from the retailer and leads victims to a scam flow designed to harvest payment details. The user is redirected first to a site that fingerprinted their device before sending…

    Malwarebytes
  22. ENISA warns AI scanners leave firms no excuse for software flaws

    AI-powered vulnerability scanning tools are accelerating the ability to identify and fix bugs, with industry voices arguing there is now little excuse for firms to be unaware of flaws in their software, according to ENISA. During the ESET World conference on…

    Infosecurity
  23. AI fuels surge in mobile app attacks, 87% of apps hit in 2026

    According to Digital[.]ai, the frequency of cyber-attacks on customer-facing mobile apps has risen rapidly as AI lowers barriers for threat actors. The 2026 Application Security Threat Report, published on 19 May 2026, claims 87% of monitored apps faced…

    Infosecurity
  24. ZKTeco CCTV Cameras

    According to CISA, the ICS Advisory ICSA-26-139-04 warns of a vulnerability in ZKTeco CCTV Cameras, specifically CVE-2026-8598, where an undocumented configuration export port is accessible on some models and does not require authentication, exposing open…

    CISACVE-2026-8598
  25. Kieback & Peter DDC Building Controllers

    Kieback & Peter DDC Building Controllers is the subject of an ICS Advisory released on 19 May 2026, which warns that successful exploitation could allow an attacker to take control of a victim’s browser. According to CISA, the affected products include…

    CISACVE-2026-4293
  26. Critical flaw in Palo Alto firewalls lets attackers run root code

    According to Siemens ProductCERT, a buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS software could allow an unauthenticated attacker to execute arbitrary code with root privileges on…

    CISAExploitedCVE-2026-0300
  27. ABB patches critical path traversal flaw in CoreSense HM and M10

    An update has been issued for ABB CoreSense HM and CoreSense M10 to remediate a path traversal vulnerability (CVE-2025-3465) that could allow unauthenticated users to access restricted directories and potentially lead to complete system compromise, according…

    CISACVE-2025-3465
  28. ScadaBR bugs allow unauthenticated remote code execution on SCADA

    According to CISA, ScadaBR has multiple unauthenticated remote code execution vulnerabilities that could be exploited through version 1.2.0. The advisory lists four CVEs affecting ScadaBR 1.2.0: CVE-2026-8602, CVE-2026-8603, CVE-2026-8604 and CVE-2026-8605,…

    CISACVE-2026-8602
  29. B1ack’s Stash leaks 4.6M cards, SOCRadar says 4.3M usable

    SecurityWeek reports that the dark web carding marketplace B1ack’s Stash announced a free download of 4.6 million stolen credit card records, released after sellers were caught reselling data purchased from the site on other platforms. The data dump…

    SecurityWeek
  30. EvilTokens hijacks 340 Microsoft 365 firms via OAuth consent

    According to The Hacker News, a phishing-as-a-service platform called EvilTokens went live in February 2026 and, within five weeks, had compromised more than 340 Microsoft 365 organisations across five countries. The targets were asked to enter a short code…

    The Hacker News
  31. ISF 2026 guides cyber resilience as business continuity backbone

    The article argues that cyber resilience should be the backbone of business continuity, linking security, continuity and risk management around what the business cannot afford to lose. It cites the ISF Standard of Good Practice 2026 as a framework that asks…

    SecurityWeek
  32. YouTube rolls out selfie ID deepfake detection for creators

    YouTube is expanding its likeness detection system, inviting users to upload a selfie video and government ID to help combat deepfake videos that use their image. According to YouTube, the idea is to let its own AI patrol the service for fakes and offer…

    Malwarebytes
Show older articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in