News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 39 so far | 2 |
Developing
Wed 27 May68 articles
- Scammers use fake World Cup 2026 offers to target football fans
The article discusses the rise of scam campaigns targeting football fans in anticipation of the FIFA World Cup 2026. Bitdefender Labs has uncovered over 55 malvertising campaigns exploiting fan loyalty and excitement through fake stores, social media ads,…
bitdefender.com 2 articles this day · SecurityWeek first · 2 outlets
Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants · CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed pluginShow 2 articlesHide 2 articles
- Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants12:54SecurityOnline
- CISA urges patch of CVE-2026-48172 in cPanel LiteSpeed plugin06:55SecurityWeek
- Serpens Hackers Exploit CVE-2026-48172, Roll Out New RAT Variants
- FBI Warns of Silent Ransom Group Targeting US Law Firms
The FBI has released a Flash Alert regarding the Silent Ransom Group (SRG), also called Luna Moth, Chatty Spider, and UNC3753. This group specifically targets US-based law firms using social engineering, impersonating IT support through phone calls and…
DataBreachesStorm-0252 - Fake UK Visa Site Leaks 100k Passport, Selfie Data
A website named UK Visa Portal has been exposed for leaking the personal information, including passports and selfies, of at least 100,000 applicants seeking U.K. immigration visas. The leak was reported to TechCrunch by an anonymous source, confirming that…
DataBreaches - Link11 opens Lisbon hub to boost EU digital sovereignty
Link11, a European IT security provider, is opening a Technical Customer Excellence Hub in Lisbon to strengthen its commitment to digital sovereignty and regulatory compliance within the EU. The hub will relocate technical customer service to ensure…
SecurityOnline - Dark Reading Turns 20: From Firewalls to AI Powered Security
The article commemorates Dark Reading's 20th anniversary by exploring the evolution of the cybersecurity industry from its focus on perimeter defenses, such as antivirus software and firewalls, to today's advanced technologies influenced by cloud computing,…
Dark Reading - Albanian hacker 'Venom' extradited to France for VenomRAT malware
A 39-year-old Albanian national known as 'Venom' was extradited to France after being arrested in Greece in November 2025 as part of Operation Endgame. The arrest followed an investigation into his involvement in developing a Remote Access Trojan (RAT)…
DataBreaches - Lithuania breach leaks 600k records via compromised logins
The Lithuanian Prosecutor General’s Office reported a significant data breach involving unauthorized access to over 600,000 records managed by the Centre of Registers. The breach was facilitated through the misuse of login credentials from authorized…
DataBreaches - RevEng.AI raises $15M Series A to boost AI binary code analysis
RevEng.AI, a London-based cybersecurity startup, has secured $15 million in a Series A funding round, raising its total investments to $19.5 million. The funding was led by NATO Innovation Fund, along with support from Sands Capital and others. Founded in…
SecurityWeek - GlassWorm Malware Takedown Shields Developer Supply Chains
The article discusses the recent takedown of GlassWorm malware, which targeted developer supply chain infrastructures. The operation disrupted various cyber-attack activities and illustrated the ongoing battle against evolving cybersecurity threats. Key…
The Hacker News - SOCs Follow Three Critical Steps to Slash Early Attack Risks
The article emphasizes three critical steps for Security Operations Centers (SOCs) to effectively mitigate incident risks early. These steps focus on enhancing threat intelligence, optimizing incident response protocols, and fostering continuous improvement…
The Hacker News - FBI warns of Kali365 phishing kit stealing Microsoft 365 tokens
The Kali365 phishing kit, highlighted by the FBI, is a phishing-as-a-service platform that targets Microsoft 365 accounts by stealing access tokens instead of passwords. This method is effective against both organizations and individual users, as it bypasses…
Malwarebytes - Hacker Sentenced 4 Years for Selling Oregon State Network Access
A Romanian hacker, Catalin Dragomir, has been sentenced to 4 years and 8 months in prison for selling access to a state network in Oregon for $3,000 in Bitcoin. Arrested in November 2024 and extradited to the U.S. in January 2025, Dragomir pleaded guilty to…
SecurityWeek - CrowdStrike, Google shut Glassworm botnet infecting dev tools
On May 26, 2026, cybersecurity firms, including CrowdStrike and Google, coordinated a simultaneous takedown of the Glassworm botnet, which had been infecting software developers since early 2025 through malicious developer tools. The group utilized…
Security Affairs - How to Tackle Shadow AI Risks While Keeping Staff Productive
The article "5 Steps to Managing Shadow AI Tools Without Slowing Down Employees" discusses strategies for organizations to effectively manage unauthorized AI tools ('shadow AI') while ensuring that productivity is not hindered. It emphasizes the importance of…
The Hacker News - Thousands of Fake FIFA Domains Target World Cup Fans
Over 4,300 fraudulent domains impersonating FIFA's official websites have been created to target fans of the upcoming 2026 FIFA World Cup. This operation, identified by Group-IB, involves multiple fraud schemes and actors, with many sites ready to activate…
InfosecurityGHOST STADIUM - Lastwall Raises $11.5 Million for Quantum-Resilient Identity Platform
Lastwall, a company specializing in identity security and quantum resilience, recently raised $11.5 million in a Series A extension to expand its operations in North America. This funding was led by the Business Development Bank of Canada. Lastwall offers…
SecurityWeek - How Credential Theft Evolves Beyond Passwords in Modern Cyber Threats
The article discusses the challenges of credential compromise in cybersecurity, emphasizing that credential theft is a critical tactic for attackers. It categorizes credentials into human and non-human types, detailing various forms such as passwords and…
SecurityWeek - SymJack Attack Turns AI Coding Agents into Supply Chain Threats
The article discusses the SymJack attack, which exploits trust in AI coding agents to facilitate supply chain attacks. Malicious repositories can trick developers into using compromised code within the CI pipeline. The attack involves an attacker controlling…
SecurityWeek - CrowdStrike, Google Disrupt GlassWorm Botnet Via Solana, Calendar
The GlassWorm botnet, targeting the open-source software ecosystem, has been disrupted by CrowdStrike in collaboration with Google and the Shadowserver Foundation. This operation dismantled four command-and-control (C&C) channels utilized by the botnet,…
SecurityWeek - Gitea bug exposes private container images to attackers
A recent vulnerability in Gitea has been identified, allowing unauthorized access to private container images without authentication. This weakness poses significant risks for users relying on Gitea for their development and deployment processes, as it…
The Hacker News - Cox Media Group fined $930k for fake phone listening claims
A media company, Cox Media Group, and two marketing partners have been fined for falsely claiming they could listen to consumers' phone conversations through a service called "Active Listening." Despite concerns consumers had about their phones…
Malwarebytes - Hackers linked to Iran breach LA Metro, steal sensitive data
A recent cyberattack on the Los Angeles public transportation system, LA Metro, has been attributed to a pro-Iranian hacktivist group known as Ababil of Minab. The breach, detected in mid-March, resulted in operational disruptions but did not affect transit…
SecurityWeekAbabil of Minab - Attackers use fake LinkedIn PDF contract to harvest credentials
The article discusses a phishing campaign where cybercriminals impersonate LinkedIn, using Adobe's infrastructure to track victims. The phishing emails look like business inquiries with a fake 'contract' attachment that has double file extensions…
Malwarebytes - UK firms to boost cyber spend as AI risks and tensions rise
A recent report reveals that 68% of UK businesses plan to increase cybersecurity expenditure in response to rising AI risks and geopolitical uncertainties. The Q1 2026 Barclays Business Prosperity Index indicates that a significant number of business leaders…
Infosecurity - FBI warns of Kali365 phishing tool bypassing MFA in cloud firms
The FBI has issued a critical alert regarding the Kali365 phishing platform, which targets enterprise cloud environments and aims to hijack sensitive corporate information. This platform uses a method of token hijacking to bypass multi-factor authentication,…
SecurityOnline - FBI warns Silent Ransom Group targeting US law firms via phishing
The FBI has issued a warning about the Silent Ransom Group (SRG), an extortion gang targeting U.S. law firms through phishing emails and social engineering tactics. SRG impersonates IT support, urging employees to provide remote access to their systems. They…
SecurityWeekLuna Moth - Netherlands Blocks Kyndryl €100m Solvinity Deal Over Security
The Dutch government has rejected Kyndryl's €100 million bid to acquire Solvinity due to national security concerns, particularly regarding the control of critical digital infrastructure used for various public services in the Netherlands. This decision…
Security Affairs - Moxa Linux Flaw Lets Local Users Gain Root Access via Dirty Frag
Moxa has issued a critical security advisory (MPSA-263140) concerning vulnerabilities in its Linux-based operating systems that allow local attackers to gain root privileges. The weaknesses are identified as 'Copy Fail' (CVE-2026-31431) and 'Dirty Frag'…
- FreePBX Attackers Deploy JOMANGY Malware for Toll Fraud via CVEs
Cyble Research & Intelligence Labs has identified a significant exploitation campaign targeting FreePBX systems, perpetrated by a threat group known as INJ3CTOR3, which has been active since 2019. This campaign involves a new malware strain called JOMANGY,…
- NVIDIA Releases Critical Security Patches for AI Frameworks
NVIDIA has released critical security updates addressing multiple vulnerabilities in its TensorRT-LLM AI frameworks and the Isaac Launchable platform. Key vulnerabilities include a high-severity deserialization flaw (CVE-2025-33255) in the Message Passing…
SecurityOnlineCVE-2025-33255 - New PureLogs malware spreads via fake purchase order phishing
A new variant of the PureLogs infostealer malware has been identified, distributed via phishing emails featuring fake purchase orders. These emails contain a malicious JavaScript that initiates a multi-stage infection on Windows systems. Once executed, the…
Infosecurity - AI chatbots inadvertently lead users to cryptojacking malware sites
A recent article discusses the emergence of AI chatbots that mistakenly redirect users to cryptojacking malware sites, raising concerns about cybersecurity risks associated with AI technologies. The piece highlights the need for greater vigilance and better…
The Hacker News - Global Ghost CMS Poisoning Campaign Exploits Enterprise Blogs
A critical security alert has emerged regarding a cyber assault targeting web servers globally, driven by a Ghost CMS poisoning campaign exploiting vulnerabilities to distribute malware. The attack leverages a high-risk SQL injection vulnerability…
SecurityOnlineCVE-2026-26980 - Microsoft SharePoint Has a New RCE Flaw. If You Haven’t Patched Yet, Go Do That.
A critical vulnerability in Microsoft SharePoint, identified as CVE-2026-45659, allows for remote code execution (RCE) with a CVSS score of 8.8. This flaw results from the deserialization of untrusted data and poses a significant risk as it requires minimal…
- Anthropic debuts sandbox and security plugin for Claude AI
Anthropic introduced two new security features for its Claude AI: a self-hosted sandbox and a security guidance plugin. The sandbox allows operations in a user-controlled environment, enhancing security by keeping files within user perimeters and applying…
SecurityWeek - SEO poisoned AI installer tricks devs into data stealing malware
A sophisticated cyber campaign targets software engineers using social engineering tactics, including a deceptive malicious AI installer. Threat actors employ SEO poisoning to ensure fake installation links appear before legitimate ones in search results.…
SecurityOnline - Google CEO Pichai Outlines AI First Strategy After I/O 2026
The content discusses a significant interview with Google CEO Sundar Pichai post the Google I/O 2026 symposium, highlighting the company's shift towards an 'AI-first' strategy amid competition from generative AI advances. Key points include: 1. **Internal…
SecurityOnline - Google boosts Gemini limits as video task devours developer quotas
Google has expanded its Gemini resource quotas in response to developer dissatisfaction, tripling five-hour and weekly usage limits. However, actual compute metrics remain significantly lower than expected. A recent incident highlighted a severe depletion of…
SecurityOnline
