News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 70 | 7 |
| Today, Tue 3 Nov | 0 so far | 0 |
Developing
Fri 5 Jun54 articles
- Attackers Exploit PANOS Flaw to Bypass GlobalProtect VPN
Palo Alto Networks' Unit 42 has reported active exploitation of a vulnerability in PAN-OS (CVE-2026-0257) by an unidentified actor targeting GlobalProtect. This vulnerability allows attackers to bypass authentication controls and establish unauthorized VPN…
- UNC3753 voice phishing hits US law firms, steals data
The Mandiant report documents a targeted extortion campaign by the threat cluster UNC3753 targeting US law firms and professional services from January to May 2026. The group employs techniques such as voice phishing and social engineering to gain remote…
Google CloudUNC3753 2 articles this day · SecurityWeek first · 2 outlets
Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet · Cisco SDWAN flaw lets attackers gain root via CLI exploitShow 2 articlesHide 2 articles
- Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet13:35Security Affairs
- Cisco SDWAN flaw lets attackers gain root via CLI exploit05:47SecurityWeek
- Cisco SD-WAN Has a New Root-Level Problem, and There’s No Fix Yet
- AI chatbot tricks spread fake tools for cryptojacking attacks
SecurityWeek’s latest cybersecurity roundup highlights significant threats and developments in the industry. Key stories include: 1. **AI Chatbot Exploitation:** Attackers use AI chatbot recommendations and SEO tricks to distribute fake utilities, gaining…
SecurityWeek - White House rolls out AI cybersecurity agreement with firms
The White House has issued an executive order aimed at enhancing federal cybersecurity by creating a voluntary framework for private sector developers to share frontier AI models with the government. This initiative, part of Trump's administration's…
Dark Reading - New OP512 Threat Targets IIS Servers with Custom Web Shell
The article discusses a new cyber threat cluster named OP-512 that specifically targets Microsoft IIS servers using a custom web shell framework. This cluster is characterized by its espionage tactics, aiming to exploit vulnerabilities in IIS to gain…
The Hacker News - CISA warns of active SolarWinds ServU exploit CVE-2026-28318
On June 5, 2026, CISA added a new vulnerability, CVE-2026-28318, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation. This vulnerability, associated with SolarWinds Serv-U, represents a significant risk to federal…
- Cisco patches SSRF flaw in Unified CM enabling root access
Cisco has issued fixes for CVE-2026-20230, a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager and Session Management Edition. This flaw can lead to root-level compromise when the WebDialer service is enabled.…
- ShinyHunters Leak Exposes 2.6M DentaQuest Dental Records
The ShinyHunters extortion group has leaked 234 GB of data allegedly taken from DentaQuest, a dental benefits administrator affecting approximately 2.6 million accounts. The leaked data includes personal and health information such as names, addresses,…
SecurityWeekShinyHunters - Lloyds Treats AI Agent Security as Engineering Challenge
Lloyds Banking Group is advancing its approach to agentic AI security by treating it as an engineering challenge rather than a theoretical concept. During a session at the OWASP GenAI Security Summit, Manija Poulatova and Kirsty Montignani detailed the…
Infosecurity - Only 10% of SOCs See Real Value From AI Security Tools
The article discusses the challenges faced by Security Operations Centers (SOCs) in deriving value from Artificial Intelligence (AI) in security operations. It highlights that only 10% of SOCs report obtaining excellent value from AI tools. Key points…
The Hacker News - Chrome 149 Patches 429 Vulnerabilities
Google has released Chrome 149, addressing a record 429 vulnerabilities, significantly outpacing prior security fixes. Over 100 of these were marked as critical or high-severity, primarily involving use-after-free and insufficient validation flaws. The most…
SecurityWeekCVE-2026-10881 - Brave launches $60 privacy browser dropping crypto, AI rewards
Brave Software has launched Brave Origin, a premium version of their browser focused on user privacy by removing cryptocurrency features, AI components, and rewards systems. It follows a paid model costing $59.99 for a license usable on up to 10 devices,…
SecurityOnline - OWASP releases agentic AI security framework for governance
The Open Worldwide Application Security Project (OWASP) has introduced a new agentic AI security maturity framework to help organizations align their AI deployments with appropriate governance measures. This framework, detailed in their paper "State of…
Infosecurity - Trump signs voluntary AI security order for prerelease testing
President Donald Trump signed an executive order establishing a voluntary framework for federal assessment of advanced AI models' national security risks prior to public release. This order allows a 30-day testing period for government agencies to evaluate…
SecurityWeek - PCPJack builds 230 node cloud email relay on AWS, Azure and GCP
Researchers from Hunt.io revealed that a threat actor known as PCPJack created a 230-node cloud-based email relay network using servers from Amazon Web Services, Google Cloud, and Microsoft Azure. This discovery was made after PCPJack mistakenly left access…
Security AffairsPCPJack - Vect Ransomware Hits Supply Chains, Fuelling Double Extortion
The article provides an in-depth analysis of the Vect Ransomware, which surfaced on December 31, 2025. This financially motivated ransomware-as-a-service group utilizes a structured affiliate program and has rapidly expanded its operations. Vect conducts…
SOCRadarVect - Infosecurity Europe: AI Coding Tools Need Built-In Security for Agentic Development Era
At Infosecurity Europe,Boaz Barzel, field CTO of Ox Security, emphasized the need for built-in security in AI coding tools to address emerging risks in an era of rapid development cycles. Traditional application security methods can't keep up with the…
Infosecurity - AI: Threat, tool, or both?
The article discusses the evolving public perception of Artificial Intelligence (AI), highlighting a Pew Research survey indicating increased concerns over AI's societal impacts, such as job displacement and misinformation. Awareness of AI technologies is…
Malwarebytes - Five Eyes Warns of Chinese Spies Using Fake Job Posts
The Five Eyes intelligence alliance (FBI, MI5, ASIO, CSIS, NZSIS) has issued an alert regarding Chinese military intelligence posing as recruiters to target government and military personnel for sensitive information. Using fake job postings on platforms…
SecurityWeek - Hackers Exploit Everest Forms Pro Flaw to Seize WordPress Sites
Hackers have been exploiting a critical vulnerability in the Everest Forms Pro WordPress plugin, allowing them to take control of affected websites. This flaw has raised significant security concerns among users and web administrators. The article emphasizes…
The Hacker News - Healthcare Must Adopt AI Defences Against Surge in Cyber Attacks
Experts warn that healthcare organizations (HCOs) must adopt AI-powered tools to effectively detect and manage cyber threats, as reactive security approaches are inadequate. At Infosecurity Europe, Sher Baig emphasized the sector's vulnerability due to…
Infosecurity - Large-Scale Malvertising Network Floods Asia-Pacific Social Media Platforms
Broad Malvertising Infrastructure Reuses Templates at Scale Security researchers recently uncovered a massive underground fraud network stretching across
SecurityOnline - Fake Context Alignment attack hijacks Google Gemini via WhatsApp
A researcher at SafeBreach, Or Yair, identified a new attack method called Fake Context Alignment, which allows malicious actors to exploit Google’s Gemini voice assistant via WhatsApp notifications. This method involves using indirect prompt injection…
Security Affairs - The Digital Sovereign: Google Wallet Pioneers Cryptographic Identity and Streamlined Commerce in Europe
Google is expanding its mobile ecosystem by introducing Digital ID support in selected EU countries this summer, partnering with Sparkasse for a privacy-centric age verification protocol. Users will undergo a stringent onboarding process involving a video…
SecurityOnline - RCI Hospitality breach via IDOR flaw leaks 40k personal records
RCI Hospitality Holdings, a major adult nightclub operator in the U.S., reported a data breach affecting around 40,000 individuals. The breach was due to an insecure direct object reference (IDOR) vulnerability found in one of its IIS web servers, which…
SecurityWeek - World Cup 2026 scams surge: fake sites, banking malware
The article discusses the emerging cybersecurity threats associated with the FIFA World Cup 2026, highlighting scams that include fake websites, banking malware, and stolen logins. It emphasizes the importance of vigilance and updated security measures to…
The Hacker News - Malware hides in MSI branded JPEG via WeTransfer link
The blog post by Xavier Mertens discusses a newly discovered malware technique involving a malicious JavaScript payload hidden in an MSI-branded JPEG file. The payload originates from a WeTransfer link and executes PowerShell commands to decode further…
SANS ISC - New Remcos RAT variant evades detection via phishing batch file
The article discusses the emergence of a new variant of the Remcos RAT (Remote Access Trojan) discovered by G Data Analysts, which employs advanced evasion tactics to infiltrate corporate networks. The infection chain begins with a phishing email featuring a…
SecurityOnline - PCPJack uses 230 cloud servers for covert SMTP relay
The article discusses the PCPJack cyber threat, which has compromised 230 servers across AWS, Google Cloud, and Azure to create a covert SMTP relay network. This threat allows attackers to carry out anonymous email campaigns and other malicious activities by…
The Hacker News - FreeRADIUS releases patch for critical remote execution flaw
The FreeRADIUS development team has released an emergency maintenance update addressing critical security flaws that expose networks to traffic-based remote execution threats. Key vulnerabilities include unauthenticated buffer overflow issues that could lead…
SecurityOnline - TP-Link Patches Critical Setup Flaw Across Multiple Tapo Smart Devices
The article discusses a critical vulnerability affecting TP-Link's Tapo smart devices, identified as CVE-2026-34126, which has a high CVSS score of 7.3. The flaw allows unauthorized local attackers to gain control over household appliances due to an…
SecurityOnlineCVE-2026-34126 - Police close Spanish fake ID workshop, seize 800 forged docs
International law enforcement has dismantled a major counterfeit document production facility in Alicante, Spain, part of a coordinated effort led by French police. The operation uncovered advanced methods for producing fake identification documents used by…
SecurityOnline - Bulgaria led Europol operation dismantles streaming rings
International law enforcement agencies, led by Bulgaria and supported by Europol, successfully dismantled numerous illegal streaming networks from September 2025 to April 2026. This operation targeted the entire piracy ecosystem, uncovering extensive…
SecurityOnline - Teamwork Cloud RCE bug leaves modelling open to attackers
A critical remote code execution (RCE) vulnerability in Teamwork Cloud poses a severe risk to corporate modeling architectures, with a CVSS severity score of 9.8. The flaw arises from untrusted deserialization in the platform's core, allowing unauthenticated…
SecurityOnline - Poly VoIP Phone Vulnerability Revealed with Public Exploit Code Disclosed
A critical vulnerability (CVE-2026-0826) has been identified in Poly VoIP phones, particularly the VVX 450 series, with a high severity CVSS score of 9.2. Discovered by Rapid7, the flaw arises from improper validation in session protocol handling, allowing…
SecurityOnlineCVE-2026-0826 - CVE-2026-41283 flaw in OpenStack Mistral lets hackers run code
The content details a critical security vulnerability in the OpenStack Mistral workflow service, identified as CVE-2026-41283, which has a CVSS score of 9.9. This flaw arises from insufficient access controls that allow unauthorized users to bypass policies,…
SecurityOnlineCVE-2026-41283 - Threat Level Stays Green as SANS ISC Stormcast Covers June 5
The content outlines the current threat level as 'green' and indicates the handler on duty is Xavier Mertens. It references a SANS ISC Stormcast for June 5th, 2026, and provides links to various educational classes, journal articles, and community engagement…
SANS ISC - IBM WebSphere bugs risk remote code execution, patch now
The article addresses critical vulnerabilities in IBM WebSphere that pose significant remote code execution risks. It notes three high-severity flaws: CVE-2026-9311, a security control bypass; CVE-2026-9330, a data deserialization issue; and CVE-2026-9319,…
SecurityOnlineCVE-2026-9311
