News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 55 so far | 2 |
Developing
Sat 23 May15 articles
- AI finds 10k high severity flaws in widely used software
Claude Mythos AI has identified 10,000 high-severity vulnerabilities in widely-used software, highlighting the critical need for improved security measures in the field of cybersecurity. The article discusses how artificial intelligence is both a risk and a…
The Hacker News - Underminr CDN flaw exposes 88 million domains in US, UK, Canada
The article discusses a cybersecurity vulnerability called 'Underminr', which exploits shared content delivery networks (CDNs) to disguise connections to malicious domains. This method is seen as an evolution of domain fronting, where attackers can navigate…
SecurityWeek - Laravel-Lang Packages Hijacked to Deliver Credential Stealer
The article discusses a supply chain attack on Laravel-Lang PHP packages that were compromised to distribute a cross-platform credential stealer. The incident highlights the vulnerability of software supply chains to cyber threats. Cybersecurity…
The Hacker News - Ghostwriter APT Hits Ukraine Gov with Prometheus Phishing
The Belarus-based APT group Ghostwriter has initiated a new phishing campaign targeting Ukrainian government agencies. The campaign uses the Prometheus online learning platform as bait, making it effective due to its familiarity among users. Emails sent from…
Security AffairsGhostwriter - LiteSpeed cPanel Plugin Flaw Lets Attackers Gain Root via CVE-2026-48172
The article discusses a cybersecurity vulnerability associated with the LiteSpeed cPanel Plugin, designated as CVE-2026-48172. This vulnerability allows unauthorized users to execute scripts with root privileges, potentially leading to severe security…
- Drupal Core SQL injection flaw exploited, added to US KEV catalog
The article discusses a recently discovered SQL injection vulnerability in Drupal Core, which is currently being exploited in the wild. This vulnerability has been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited…
The Hacker News - Malware Hiding via Stack Strings Reverse Engineers Seek New Tools
Xavier Mertens discusses malware obfuscation techniques, specifically focusing on stack strings in high-level programming. He highlights how these strings are dynamically constructed at runtime instead of being stored as literals, making them harder to…
SANS ISC - Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets
On May 22, 2026, an attacker with push access to the Laravel-Lang GitHub organization compromised three popular Composer packages by rewriting every git tag in a 15-minute window. This allowed malicious payloads to be executed upon installation, targeting CI…
StepSecurity
Fri 22 May47 articles
2 articles this day · SecurityWeek first · 2 outlets
CISA Flags Drupal SQL Injection Flaw CVE-2026-9082 in KEV Catalog · Drupal Critical SQL Flaw CVE-2026-9082 Prompts Urgent PatchShow 2 articlesHide 2 articles
- Europol shuts down criminal VPN First VPN after global crackdown
Europol announced that law enforcement agencies have dismantled a VPN service called 'First VPN' which was utilized by cybercriminals for ransomware attacks and other illegal activities. The operation, led by French and Dutch authorities with support from…
Ars Technica - Texas AG Sues Meta Over WhatsApp Encryption Claims
The Texas Attorney General has initiated a lawsuit against Meta, alleging that WhatsApp does not provide the promised end-to-end encryption (E2EE) for its messaging service, which is used by over 3 billion people. Since 2016, Meta has claimed that WhatsApp…
Ars Technica - First VPN Used by 25 Ransomware Groups Dismantled in Global Raid
The article discusses the dismantling of the first VPN service used by 25 ransomware groups, a significant operation in the ongoing fight against cybercrime. Key insights from the takedown indicate that these VPNs were instrumental in facilitating…
The Hacker News - Microsoft Leads Forrester Wave for Identity Security in Q2 2026
Microsoft has been recognized as a Leader in The Forrester Wave™ for Workforce Identity Security Platforms in Q2 2026. The recognition highlights Microsoft's strong current offerings and strategic position in identity security, showcasing the value of the…
Microsoft - F5 BIG IP flaw lets attackers pivot to internal Linux hosts
The article discusses a sophisticated multi-stage Linux intrusion involving compromised internet-facing edge appliances like firewalls and VPNs, emphasizing the risks associated with such devices serving as entry points for attackers. The threat actor…
Microsoft - Richmond Radiology Breach Hits 1.6 Million Patients
On July 1, 2025, Radiology Associates of Richmond (RAR) reported a data breach to HHS affecting over 1.4 million patients from an April 2024 incident. A second breach was reported on May 21, 2025, affecting 266,183 individuals, but details about the affected…
DataBreaches - Lawmakers press CISA to explain AWS GovCloud key leak
Lawmakers are pressing the U.S. Cybersecurity & Infrastructure Security Agency (CISA) for answers regarding a serious data breach involving a contractor who posted sensitive agency information, including AWS GovCloud keys, on a public GitHub account named…
Krebs on Security - Ghostwriter AI Phishing Hits Ukrainian Government Agencies
The article discusses the emergence of Ghostwriter, a malicious phishing malware targeting Ukrainian government entities. It emphasizes the threat posed by this malware, which utilizes AI techniques to enhance attack efficiency. The article further…
The Hacker NewsGhostwriter - St. Luke’s and ManpowerGroup Use Microsoft Security for AI Growth
The article discusses how organizations like St. Luke’s University Health Network and ManpowerGroup are leveraging Microsoft Security solutions to strengthen their foundations for AI adoption. It highlights the importance of integrating security into the…
Microsoft - Akamai Buys LayerX for $205m to Boost Zero Trust Browser Security
Akamai Technologies announced its acquisition of LayerX, a secure enterprise browser extension provider, for $205 million, adding to the trend of vendors integrating secure browsers into their security portfolios. LayerX enhances existing browsers by…
Dark Reading - Megalodon Supply Chain Attack Hijacks Thousands of GitHub Repos
On May 18, 2026, a significant supply chain attack named **Megalodon** targeted over 5,500 public GitHub repositories in a 6-hour window. Attackers exploited weak branch protection to inject malicious CI/CD workflows designed to steal cloud credentials, SSH…
StepSecurity - Iranian hackers revive with SEO poison, fake Zoom and AI backdoor
The article discusses the resurgence of the Iranian IRGC-affiliated threat actor, Nimbus Manticore, during the U.S. military campaign against Iran, named Operation Epic Fury, which commenced on February 28, 2026. The campaign involved sophisticated…
Check PointUNC1549 - Trump Mobile leaks customer data after third party mishap
Trump Mobile has acknowledged that it inadvertently exposed customers' personal information, including names, email addresses, mailing addresses, cell numbers, and order identifiers, to the internet. A spokesperson stated that the company is investigating…
DataBreaches - Iranian Hackers Hit US Gas Station Tank Monitors, Raising Alarms
This week's cybersecurity news from SecurityWeek covers significant topics, including: 1. **Iranian Hackers:** Suspected breaches of US gas station tank monitoring systems using unprotected devices, raising concerns about critical infrastructure safety. 2.…
SecurityWeek - Canadian police arrest 23 year old for Kimwolf DDoS botnet
Canadian authorities arrested Jacob Butler, 23, accused of operating the Kimwolf DDoS botnet, allegedly responsible for compromising over 2 million Android devices. U.S. authorities are seeking his extradition. Butler faces charges of computer intrusion,…
Security Affairs - New Jersey Bill 1852 urges firms to tighten breach response plans
Joseph Lazzarotti discusses the evolution of state breach-notification laws during the 2026 legislative sessions, emphasizing the need for businesses to enhance their incident response planning. Key considerations include mandatory notice timelines,…
DataBreaches - Dutch FIOD arrests two over pro Russia hacking aid
Officials allege that **WorkTitans** and **MIRhosting** were used to assist pro-Russian hackers and circumvent EU sanctions. Youssef Z., a 57-year-old entrepreneur arrested in Amsterdam, had become increasingly elusive, disabling access to his LinkedIn and…
DataBreaches - German Hospitals Suffer Patient Data Breach via Unimed Billing
German university hospitals are facing a significant patient data breach caused by hackers targeting an external billing service provider named Unimed, which processes billing for multiple hospitals across Germany. Reports indicate that the hack occurred in…
DataBreaches - Hacker Returns $8.5M ETH After Verus Bridge Exploit, Keeps Bounty
A hacker returned approximately $8.5 million in Ethereum after exploiting the Verus cross-chain bridge, following negotiations for a white-hat bounty. The hacker returned 4,052.4 ETH and retained 1,350 ETH valued at around $2.8 million as part of the bounty…
DataBreaches - Hugging Face Hiding Second-Stage Malware for npm Supply Chain Attack
Hackers, linked to North Korea, have exploited the Hugging Face platform by embedding second-stage malware within it, transforming it into a channel for malware delivery and data exfiltration. This sophisticated npm supply chain attack specifically targets…
DataBreaches - Vietnam ministerial data breach leaks millions despite SOC
At the Vietnam Security Summit 2026, Lieutenant Colonel Tran Trung Hieu from the National Cybersecurity Center reported that two serious data breaches have affected ministerial-level agencies in Vietnam, resulting in the compromise of millions of user…
DataBreaches - Ottawa Man Faces US Extradition Over Botnet Hit on 1M Devices
Jacob Butler, a 23-year-old from Ottawa, was arrested by Ontario Provincial Police and is facing extradition to the U.S. He is accused of participating in significant cyberattacks that impacted over one million devices globally. OPP's cybercrime team has…
DataBreaches - Sen. Murphy Leads Illinois Bill to Block Targeted Ad Data Harvest
State Senator Laura Murphy is spearheading Senate Bill 340, which aims to establish the Illinois Consumer Data Privacy Act to protect consumers' personal data from targeted advertisements. The bill prohibits the collection, processing, or sale of sensitive…
DataBreaches - Verizon DBIR: Healthcare Fends Off Increased Social Engineering Attacks
The Verizon 2026 Data Breach Investigations Report (DBIR) highlights a significant increase in social engineering attacks within the healthcare sector, primarily driven by advanced tactics utilizing artificial intelligence (AI). These attacks, which also…
Dark Reading - Iranian APT Screening Serpens Unleashes New RATs in Espionage
The article reports on the Iranian APT group Screening Serpens, detailing its cyber espionage campaigns from mid-February to April 2026, targeting sectors in the U.S., Israel, UAE, and other Middle Eastern entities. It highlights the emergence of new Remote…
Unit 42Screening Serpens - Canadian Man Arrested for Operating Kimwolf Botnet
The US Justice Department announced the arrest of Jacob Butler, a 23-year-old Canadian national known online as 'Dort', for allegedly operating the Kimwolf DDoS botnet. He is charged with aiding and abetting computer intrusion and faces up to 10 years in…
SecurityWeek - Chrome 148 patches WebRTC and UI flaws letting attackers run code
Google has released critical updates for its Chrome browser, addressing two high-severity vulnerabilities that could allow attackers to execute code remotely simply by visiting a compromised website. Users are encouraged to update their browsers to version…
Malwarebytes - Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows
A recent cybersecurity attack named 'Megalodon' targeted over 5,561 GitHub repositories, leveraging malicious CI/CD workflows to compromise systems. The attack underscores the vulnerabilities in the supply chain and cloud security domains, highlighting the…
The Hacker News - Attackers Exploit Vulnerable Drivers Remotely Using BYOVD
The article discusses the concept of making vulnerable drivers exploitable under the Bring Your Own Vulnerable Driver (BYOVD) perspective. It highlights how attackers can utilize these vulnerabilities without the need for hardware access. Key points include…
The Hacker News - Fake Gemini and Claude sites spread infostealer via poisoned SEO
Security researchers at EclecticIQ have detected a malicious campaign exploiting fake sites mimicking Google's Gemini coding tool and Anthropic's Claude Code to distribute information-stealing malware. This campaign employs SEO poisoning methods to rank…
Infosecurity
