News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Today, Tue 3 Nov | 27 so far | 2 |
Developing
Thu 28 May65 articles
- GreyVibe uses AI in flawed attacks via spear phishing on Ukraine
GreyVibe, an emerging threat actor possibly linked to Russia, targets Ukrainian entities using sophisticated AI tools to enhance their cyberattack capabilities. WithSecure researchers identify GreyVibe's operational methods, which mix state-sponsored…
SecurityWeekGreyVibe - Critical flaw in Gogs Git service lets users run arbitrary code
The article discusses a critical vulnerability in Gogs, an open-source self-hosted Git service, allowing any authenticated user to execute arbitrary code. This security flaw underscores the importance of patching and updating software to prevent potential…
The Hacker News - Geordie secures £30m Series A to scale AI agent security platform
Geordie, an AI security and governance startup based in London, has raised $30 million in a Series A funding round, bringing its total funding to $36.5 million. Founded in early 2025, Geordie provides a platform for securing and governing AI agents used by…
SecurityWeek - 12 cybersecurity firms highlighted by TVC before Gartner summit
The TVC Analyst Group has identified twelve notable cybersecurity companies ahead of the Gartner Security & Risk Management Summit scheduled for June 1-3, 2026. This event focuses on cybersecurity innovations and operational strategies for chief information…
SecurityOnline 2 articles this day · SecurityWeek first · 2 outlets
FortiClient EMS flaw used to deploy EKZ Infostealer via fake patch · FortiClient EMS bug exploited to deliver EKZ InfostealerShow 2 articlesHide 2 articles
- FortiClient EMS flaw used to deploy EKZ Infostealer via fake patch16:05Security Affairs
- FortiClient EMS bug exploited to deliver EKZ Infostealer12:55SecurityWeek
- FortiClient EMS flaw used to deploy EKZ Infostealer via fake patch
- How Agentic AI Deployments Open Doors to Classic Cyber Attacks
The article discusses the risks associated with deploying agentic AI systems, emphasizing that the technology itself isn't inherently risky, but rather the way organizations implement it can lead to vulnerabilities. Research shows that many developers are…
Dark Reading - Attackers use fake plugin names to dodge typosquatting checks
The article discusses a new analysis by Sonatype revealing that attackers have evolved from simple typosquatting tactics to more sophisticated methods of package impersonation. Instead of merely misspelling well-known project names, attackers are now…
Infosecurity - Microsoft and Resecurity Halt Fox Tempest Malware Signing
Resecurity collaborated with Microsoft to disrupt Fox Tempest, a cybercriminal service that provided malware-signing capabilities using fake Microsoft certificates. This operation aimed to enhance the legitimacy of malware, making it easier for…
Security AffairsFox Tempest - Attackers exploit FortiClient EMS flaw to steal credentials
The article discusses the exploitation of a critical vulnerability in FortiClient EMS by threat actors to deploy credential-stealing malware. This flaw targets endpoint security systems and emphasizes the importance of timely updates to mitigate such risks.…
The Hacker News - Gentlemen ransomware uses PsExec to encrypt and leak data
The Gentlemen ransomware is a sophisticated ransomware-as-a-service (RaaS) that combines strong encryption with aggressive self-propagation capabilities to exploit networks. Its encryption uses the Curve25519 keys and XChaCha20 cipher, and it employs various…
MicrosoftThe Gentlemen 2 articles this day · Malwarebytes first · 2 outlets
Carnival breach exposes 6 million via social engineering attack · Carnival breach exposes 6 million after employee account hijackedShow 2 articlesHide 2 articles
- Carnival breach exposes 6 million via social engineering attack14:45SecurityWeek
- Carnival breach exposes 6 million after employee account hijacked12:04Malwarebytes
- Carnival breach exposes 6 million via social engineering attack
- Microsoft slams public zero day disclosure after GitHub takedown
Microsoft criticized the public disclosure of zero-day vulnerabilities, coinciding with the removal of a GitHub researcher's account, sparking a debate on ethical disclosure practices in cybersecurity. This incident raises concerns about the potential risks…
The Hacker News - MFA bypass by Kali365 exposes Azure flaws before World Cup 2026
The ThreatsDay Bulletin discusses various cybersecurity threats and vulnerabilities as of May 28, 2026. Key topics highlight the Claude Security Plugin, Azure privilege escalation issues, and a bypass of Multi-Factor Authentication (MFA) by Kali365.…
The Hacker NewsKali365 - IBM warns of critical CVE-2026-7524 flaw in Langflow AI framework
IBM has issued a critical security alert regarding a vulnerability in the Langflow open-source AI framework, identified as CVE-2026-7524, with a critical CVSS score of 9.8. This flaw enables attackers to read arbitrary system files and execute remote code,…
SecurityOnlineCVE-2026-7524 - CISA warns of Daemon Tools, TanStack and Nx Console flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities catalog: 1) CVE-2026-8398 - Daemon Tools Lite, a supply chain attack affecting downloaded installers; 2)…
- BTMOB Android RAT hijacks devices through phishing lures
The BTMOB remote access trojan (RAT) poses a significant threat to Android users, primarily due to its capabilities for data theft and device takeover. ESET describes BTMOB as derived from SpySolr malware and distributed via phishing attacks that entice…
SecurityWeek - Cloudflare unveils Town Lake data platform with AI agent Skipper
Cloudflare built a data platform called Town Lake and an AI agent named Skipper to manage and optimize access to their vast and complex data resources. The platform addresses issues of data sprawl, disjointed systems, and governance challenges by providing a…
Cloudflare - IBM launches $5bn Lightwell to secure open source supply chain
IBM and its subsidiary Red Hat launched "Project Lightwell," a $5 billion initiative aimed at securing open source software in enterprise supply chains. The project establishes an AI-powered "enterprise clearinghouse" to address vulnerabilities in open source…
SecurityWeek - Cyber insurance drives firms to quantify ransomware and AI risks
The article discusses the evolving role of cyber insurance in enterprise risk management, highlighting its necessity in quantifying risks and fostering discussions around the financial impacts of cyberattacks. Key points include: 1. **Market Evolution**:…
Dark Reading - OpenVPN Connect macOS flaw lets attackers gain admin control
The article discusses a critical security flaw found in the OpenVPN Connect macOS client, identified as CVE-2026-9560, which carries a CVSS score of 9.4. This vulnerability allows local attackers to gain full administrative control over affected Apple…
SecurityOnlineCVE-2026-9560 - Edamame releases runtime guard to halt AI coding agent code drift
Edamame Technologies has introduced a new security solution to address the risks associated with AI coding agents, which can diverge from their intended function, leading to potential security breaches. This phenomenon, known as code drift, can cause agents…
SecurityWeek - Microsoft slams researchers over six unpatched flaw disclosures
Microsoft has condemned security researchers for releasing information about six unpatched vulnerabilities in its products, which it claims puts customers at risk. The vulnerabilities include various privilege escalation and denial-of-service flaws.…
Infosecurity - Jinx0164 hits crypto firms using fake LinkedIn to deliver Audiofix malware
A new threat actor, designated Jinx-0164, has been identified targeting cryptocurrency companies with custom macOS malware. This actor utilizes tactics similar to North Korean groups but operates independently without shared infrastructure. Intrusions…
InfosecurityJINX-0164 - Few power users drive most enterprise AI risk, report finds
The article discusses a report highlighting that the majority of enterprise AI risks are concentrated among a small group of 'power users'. This concentration raises significant security concerns for organizations relying on AI technologies. The report…
The Hacker News - Unauthenticated Gitea flaw leaks private images (CVE-2026-27771)
A vulnerability in the open-source Git service Gitea allows unauthenticated attackers to access private container images from over 30,000 affected instances. This flaw, tracked as CVE-2026-27771, is related to access control issues in Gitea's container…
SecurityWeekCVE-2026-27771 - Agentic AI Attacks Push Firms to Revamp Cybersecurity Tactics
The article discusses the impact of AI on cybersecurity, emphasizing the necessity for organizations to integrate a cybersecurity strategy as AI technologies evolve. With the rise of agentic attacks, traditional security methods are becoming obsolete,…
SecurityWeek - Your Windows PC has a security deadline in June 2026
In June 2026, Microsoft will replace the Secure Boot certificates expiring from 2011 with new 2023-dated certificates across supported Windows devices. Secure Boot is a UEFI firmware feature that validates the boot loader to prevent unauthorized access. Most…
Malwarebytes - Third party visa site leaked 100k UK passports and selfies online
A third-party UK visa application site, not affiliated with the British government, exposed at least 100,000 passports and selfies on a public AWS server. Operated by Active Leadgen LLC, the site charged fees for electronic travel authorizations, which could…
Security Affairs - Romanian gets 56 months for Oregon government network hack
Catalin Dragomir, a 46-year-old Romanian national, has been sentenced to 56 months in prison for selling unauthorized access to Oregon state government computer networks and other U.S. entities. Dragomir obtained access in June 2021 and sold it along with…
DataBreaches - AI vendor vetting urged as transparency concerns rise
This blog post discusses how organizations can effectively evaluate AI cybersecurity vendors to ensure safe and effective adoption of AI tools. It outlines five key categories for assessment: governance, data gathering and training, model choice, performance…
darktrace.com - Fake ChatGPT site spreads data stealing malware on Windows, Mac
A fake ChatGPT download website (`openew.app`) is infecting Windows and Mac users with malware aimed at stealing sensitive data. Windows users receive a credential-stealing loader, while Mac users are targeted by Atomic Stealer (AMOS), a malware platform for…
Malwarebytes - CISOs who have handled real world breaches inspire most trust
A recent study by ISC2 reveals that cybersecurity professionals prefer Chief Information Security Officers (CISOs) who have firsthand experience managing substantial cyber incidents. The research, based on feedback from 796 cybersecurity experts, indicates…
Infosecurity - Experts Warn Cyber Threats Loom Over 2026 FIFA World Cup
The article discusses the anticipated cyber threats surrounding the 2026 FIFA World Cup, the largest sporting event, occurring over 39 days in three countries: the USA, Canada, and Mexico. It highlights potential attack vectors, including geopolitical…
Unit 42 - Google unveils AI Threat Defense to fight AI driven cyber attacks
Google Cloud has launched an autonomous cybersecurity platform called Google AI Threat Defense to combat AI-powered cyberattacks. The platform uses AI to quickly identify and neutralize threats, helping organizations prioritize real-world risks and…
SecurityWeek - State-Sponsored Actors Operationalize ROADtools Framework in Cloud Campaigns
The article discusses the recent detection of three critical vulnerabilities, including CVE-2026-48027 and CVE-2026-45321, related to the ROADtools cloud attack toolkit, which is being used by hackers to infiltrate secure cloud infrastructures. It highlights…
- CISA adds LiteSpeed cPanel flaw CVE-2026-48172 to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical security vulnerability (CVE-2026-48172) in the LiteSpeed cPanel plugin to its Known Exploited Vulnerabilities catalog. This vulnerability, which has a CVSS score of 10.0,…
- GCHQ chief urges UK firms to boost cyber defences vs AI threats
Anne Keast-Butler, director of GCHQ, warns UK businesses to urgently enhance cybersecurity as AI alters threat dynamics. During her speech on May 27, she emphasized cybersecurity as a national defense issue, urging immediate action from companies and…
Infosecurity - North Korean Hackers Use InvisibleFerret Against Developers
The article discusses recent developments in North Korea-aligned cyber threats, specifically focusing on the Void Dokkaebi Cython malware. This malware has evolved by shifting from readable Python scripts to compiled binaries using Cython, enhancing its…
SecurityOnline
