News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Today, Mon 2 Nov | 14 so far | 3 |
Developing
Fri 19 Jun55 articles
- Forget Data Leakage: Shadow AI's Real Threat Is Access Control
The article titled "Forget Data Leakage: Shadow AI's Real Threat Is Access Control" emphasizes that while data leakage remains a concern, the primary risk associated with Shadow AI lies in inadequate access control measures. This highlights the need for…
The Hacker News - Dutch Police Lead Global Takedown of SocGholish Malware Botnet
Operation Endgame has successfully disrupted the SocGholish malware network, which was part of a global police initiative against cybercrime. The Dutch police announced the takedown, which involved dismantling a botnet linked to 15,000 infected websites,…
InfosecurityEvil Corp - FortiBleed Reveals Credential Reuse Threat to Fortinet Devices
The article discusses FortiBleed, a large-scale credential theft campaign targeting Fortinet devices, particularly FortiGate firewalls and SSL VPN gateways. The operation is driven by credential reuse, using stolen credentials from previous breaches.…
SOCRadar - Klue supply chain breach leaks OAuth tokens via Salesforce API
A recent supply chain attack on the market intelligence platform Klue has led to unauthorized access to sensitive data. This incident, which began on June 11, allowed hackers to exploit Klue's backend servers and execute malicious commands that harvested…
SecurityWeekIcarus - CERT Polska warns of Ghostwriter Gmail phishing aimed at elites
Poland's national cyber team, CERT Polska, warns of an active phishing campaign by the group UNC1151 (also known as Ghostwriter) targeting Gmail accounts, particularly high-profile users, since March 2026. This Belarus-linked group aims to steal credentials,…
SecurityOnlineGhostwriter - Salesforce disables Klue app after OAuth token leak
Salesforce has disabled its Klue app integration following incidents of OAuth token abuse, which compromised customer data. This incident highlights ongoing concerns regarding cloud security and data breaches in tech applications.
The Hacker News - Half of Firms Unsure About Threat Detection in Slack and Teams
A recent study highlights growing concerns among cybersecurity leaders regarding the detection of cyber threats in non-email platforms like Slack and Microsoft Teams. Conducted at Infosecurity Europe 2026, the survey revealed that 50% of cybersecurity…
Infosecurity 2 articles this day · SecurityOnline first · 2 outlets
F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws · F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)Show 2 articlesHide 2 articles
- IBM X Force ties Interlock and Rhysida ransomware via tools
IBM X-Force's research reveals a two-year overview of the Interlock and Rhysida ransomware ecosystem, detailing connections between initial-access brokers, crypters, and backdoors. Interlock has been active since September 2024, using a custom toolkit, while…
SecurityOnlineInterlock - Dialog network leak reveals elite members' personal data
A significant data breach at Peter Thiel's exclusive Dialog network exposed sensitive personal details of its members, including participation in events, personal biographies, and login tokens. Discovered by hacktivist maia arson crimew, an open directory on…
Security Affairs - CVE-2026-8713 lets attackers delete files in Avada Builder plugin
A critical vulnerability, CVE-2026-8713, has been detected in the Avada Builder plugin for WordPress, impacting around 1 million sites. This flaw allows unauthenticated attackers to delete any server file, including critical WordPress files, by exploiting…
SecurityOnlineCVE-2026-8713 - APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs
The article discusses the APT37 NarwhalRAT malware, a sophisticated Python-based backdoor that targets Korean users via spear-phishing attacks. Attackers impersonate Microsoft in deceptive emails, prompting users to download malicious attachments. The…
SecurityOnlineAPT37 - Cisco acquires WideField Security to strengthen Splunk’s Agentic SOC
Cisco has announced its acquisition of WideField Security to enhance the capabilities of Splunk’s Agentic SOC. The deal, details undisclosed, aims to strengthen identity lifecycle security by integrating WideField's technology, which helps organizations…
SecurityWeek - Belgian bank targeted by phishing using IPv4 mapped IPv6 trick
Xavier Mertens reported on a phishing email targeting a major Belgian bank, utilizing an interesting technique by embedding an IPv4-mapped IPv6 address within a URL. The phishing link is disguised as 'hxxp://[::ffff:5511:74be]/kWC5PHA1', which can be…
SANS ISC - Google Calendar gains RGB colour picker and expands palette
Google has announced an update to Google Calendar, increasing the color options available for event organization. Key changes include an expansion from 11 to 24 default color choices and the introduction of a full RGB color picker, allowing users to choose…
SecurityOnline - Anthropic compensates Claude Code users after server outage
On June 19, a server issue at Claude Code affected around 3% of the premium subscriber base, preventing users from sending messages due to quota misrepresentation. Anthropic announced a compensatory reset for affected users, including a five-hour allocation…
SecurityOnline - Global police take down SocGholish malware, protect 15k WP sites
Law enforcement from four countries collaborated with Europol to dismantle the SocGholish malware infrastructure, affecting nearly 15,000 compromised WordPress websites. Known since 2017, SocGholish is a malware framework utilized for deploying various…
SecurityWeekMustard Tempest - Apple Patches Beats Studio Buds After Mic Eavesdropping Flaw
Apple has issued a patch for its Beats Studio Buds to address a significant security flaw that allowed nearby attackers to use the device's microphone for eavesdropping. The vulnerability posed a risk where users could unknowingly be spied on, prompting the…
The Hacker News - SiderAI and MaxAI extensions suffer critical zero day flaws
Recent research has unveiled critical vulnerabilities in two widely used Chrome extensions, SiderAI and MaxAI, with over ten million combined installations. These flaws, named Spyder and MaXSS, allow attackers to exploit users' browsers without requiring any…
SecurityOnline - Massive 24 Billion Credential Leak Found in Exposed Elasticsearch
A massive data leak has exposed 24 billion stolen credentials, including usernames, emails, and plaintext passwords, mainly from infostealers and Telegram channels associated with cybercrime. Researchers discovered an Elasticsearch cluster with over 8.3…
Security Affairs - Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
A critical vulnerability in Splunk Enterprise, identified as CVE-2026-20253, is being actively exploited, prompting urgent patching for affected versions (10.2 < 10.2.4 and 10.0 < 10.0.7). This vulnerability allows unauthenticated attackers to perform file…
- Apple enables third party store payments in Brazil via iOS 26.5
Apple has announced significant changes for iPhone users in Brazil, allowing them to download apps from third-party marketplaces and integrate alternative payment systems. This follows a three-year antitrust battle initiated by MercadoLibre against Apple's…
SecurityOnline - Critical iba Deserialization Vulnerability Exposes ibaPDA and ibaDatCoordinator to RCE (CVE-2026-8024)
A critical vulnerability identified as CVE-2026-8024 affects ibaPDA and ibaDatCoordinator, allowing remote attackers to execute arbitrary code without authentication. Rated 9.3 on the CVSS scale, it poses a significant risk to industrial data acquisition and…
SecurityOnlineCVE-2026-8024 - OpenBSD vulnerability allows auth bypass using empty credentials
A critical vulnerability, CVE-2026-55706, has been discovered in OpenBSD, allowing an authentication bypass in the PAP login process. This issue, which has remained unnoticed for 27 years, enables attackers to authenticate without credentials due to improper…
SecurityOnlineCVE-2026-55706 - LiteLLM bug lets attackers bypass auth via Host header, CVSS 9.5
A critical vulnerability, CVE-2026-49468, has been identified in LiteLLM, an open-source AI gateway product. This flaw allows for authentication bypass via a Host header injection, achieving a CVSS rating of 9.5. The vulnerability affects versions below…
SecurityOnlineCVE-2026-49468 - Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450)
A critical vulnerability (CVE-2026-55450) in Langflow, an open-source platform, allows unauthenticated users to upload unlimited data, leading to potential denial-of-service conditions and information leaks. The CVSS score is 9.3, indicating a high severity.…
SecurityOnlineCVE-2026-55450 - Canadian hacker pleads guilty to charges for cyberattack on Texas Republican website
Alexandra Posadzki reports that Canadian hacker Aubrey Cottle has pleaded guilty to three charges related to a cyberattack on the Texas Republican Party, associated with the hacktivist group Anonymous. Cottle admitted to fraudulently obtaining computer…
DataBreachesAnonymous Sudan - Blue Fish Pediatrics breach exposes data of 41,485 Texas patients
A data breach at Blue Fish Pediatrics in Houston may have exposed personal and protected health information of 41,485 Texans. The breach occurred between July 11 and July 17, 2025, but notifications to patients are only being sent now. The compromised…
DataBreaches - Amazon-owned One Medical Faces ShinyHunters Data Leak Threat
One Medical, acquired by Amazon in 2023, is under scrutiny after the cybercriminal group ShinyHunters claimed to have stolen 8.8 terabytes of its data, threatening to publish it unless negotiations are initiated by June 22. The authenticity of the claim is…
DataBreachesShinyHunters - Texas Parks & Wildlife breach exposes 3 million driver licences
A data breach at a Texas state government department compromised the driver’s license information and passport numbers of over 3 million individuals, as reported by the state's attorney general. This breach is recognized as one of the largest data incidents…
DataBreaches - Spencer Gifts Plan Pays $450k After HIPAA Breach Affecting 10k
The U.S. Department of Health and Human Services (HHS) announced a settlement with Spencer Gifts LLC's health plan over HIPAA violations related to a data breach that potentially affected the personal health information (PHI) of 10,023 individuals. Following…
DataBreaches - Rockwell Automation patches multiple ICS flaws
Rockwell Automation has announced vulnerabilities in its FactoryTalk Historian and FLEX I/O devices, urging critical manufacturing operators to patch immediately. The most severe issue in the FactoryTalk Historian, identified as CVE-2025-13036, is an…
SecurityOnlineCVE-2025-13036 - AutoGen Studio bug lets rogue web code execute local commands
The article discusses a security vulnerability discovered in AutoGen Studio, a framework for AI agents, referred to as "AutoJack." This vulnerability allows untrusted web content loaded by an AI agent to execute arbitrary processes on the local host due to a…
Microsoft
Thu 18 Jun73 articles
- New USB Spread Crypto Clipper malware hijacks wallets via Tor
Microsoft has detected a new self-propagating malware known as Crypto Clipper, which spreads via USB drives to steal cryptocurrency credentials. The malware monitors clipboard contents for wallet addresses and seed phrases, capturing screenshots and sending…
Ars Technica - CISA Adds Splunk Auth Bypass Flaw to KEV Catalog, Urging Patches
CISA has added CVE‑2026-20253 to its Known Exploited Vulnerabilities catalogue. The flaw affects Splunk Enterprise and is named the Splunk Enterprise Missing Authentication for Critical Function Vulnerability. It allows an unauthenticated attacker to create…
- Novo Nordisk breach exposes 1.3TB after GitHub token leak
The article discusses a significant breach at Novo Nordisk, highlighted by the exploitation of a GitHub access token that led to unauthorized access to sensitive data. The attackers accessed essential information, including personal data from clinical trials…
Dark ReadingFulcrumSec - Apple patches Beats Buds eavesdropping bug CVE-2025-20701
Apple has released a firmware update for its Beats Studio Buds to address a severe eavesdropping vulnerability identified as CVE-2025-20701. This flaw allowed nearby hackers to exploit improper authentication in the earbuds' Bluetooth firmware, potentially…
Ars TechnicaCVE-2025-20701 - Operation Escaneo Signals Shift in LatAm Threat Landscape
The article discusses "Operation Escaneo," a sophisticated cyber intrusion campaign attributed to a financially motivated threat actor, identified as MexicanMafia, which targets critical infrastructure in Latin America. This operation signifies a shift in the…
Dark ReadingMexicanMafia - Tor based clipboard malware steals crypto via USB shortcuts
A new clipper malware, tracked by Microsoft Threat Intelligence since February 2026, is targeting cryptocurrency wallets by hijacking the clipboard through malicious USB shortcut files. This malware operates through the Tor network, making it difficult to…
Security Affairs
