News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Today, Mon 2 Nov | 14 so far | 3 |
Developing
Mon 22 Jun66 articles
- Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
Google has set a September 30, 2026 deadline for Android developers in four countries to complete verification processes. The article outlines the importance of this initiative for enhancing mobile security and ensuring compliance with the latest industry…
The Hacker News - Google Uncovers UNC6508 Cyber Espionage Campaign
The article discusses a cyber espionage campaign attributed to the UNC6508 threat actor, believed to be linked to China. This group targeted North American academic, medical, and military research organizations using bespoke INFINITERED malware, achieving…
SecurityOnlineUNC6508 - Five Eyes warn AI heightens cyber risk, urge stronger defences
The Five Eyes cyber security agencies have issued a call to action regarding the rapidly transforming landscape of artificial intelligence (AI) and its impact on cyber risk. They emphasize that, while AI enhances cyber defenses, it also accelerates and…
NCSC - Protecting AI Agents from Legacy System Vulnerabilities
The article discusses the importance of protecting AI agents from being compromised by legacy infrastructure, highlighting vulnerabilities that can lead to attacks on these AI systems. It emphasizes the need for organizations to implement modern…
The Hacker News - Gravity SMTP Plugin Flaw (CVE-2026-4020) Exposes Site Data
Threat actors are exploiting a medium-severity vulnerability (CVE-2026-4020) in the Gravity SMTP WordPress plugin, affecting versions before 2.1.5. This vulnerability allows unauthenticated users to access sensitive system information through a REST API…
SecurityWeekCVE-2026-4020 2 articles this day · SecurityWeek first · 2 outlets
North Korean hackers breach Mastra via tainted npm packages · North Korean Group Targets NPM Supply Chain, 8M Devs at RiskShow 2 articlesHide 2 articles
- North Korean hackers breach Mastra via tainted npm packages11:30Infosecurity
- North Korean Group Targets NPM Supply Chain, 8M Devs at Risk11:10SecurityWeek
- North Korean hackers breach Mastra via tainted npm packages
- Smart TV botnet rises amid browser bugs and Android Trojan surge
The article discusses key cybersecurity incidents and advancements from the past week, highlighting various security vulnerabilities and threats. Key points include: 1) The emergence of browser bugs and their implications. 2) The potential risks of endpoint…
The Hacker News - ShinyHunters shift focus to stolen credentials and token abuse
The article discusses the evolving tactics of cybercriminals, specifically the ShinyHunters collective, who are increasingly targeting identities and authentication processes rather than exploiting software vulnerabilities. Key points include: 1) Attackers…
SecurityWeekShinyHunters - Russian hackers steal 110M credentials from 430k FortiGate devices
The article details the FortiBleed operation, a significant Russian credential-harvesting campaign affecting over 430,000 FortiGate firewalls and capturing around 110 million credentials. Conducted by SOCRadar's Threat Research Unit (STRU), the report…
Security Affairs 2 articles this day · SecurityWeek first · 2 outlets
Klue breach leaks OAuth tokens, puts cybersecurity firms on alert · Klue supply chain breach leaks Salesforce data after hackShow 2 articlesHide 2 articles
- Klue breach leaks OAuth tokens, puts cybersecurity firms on alert10:15Infosecurity
- Klue supply chain breach leaks Salesforce data after hack09:03SecurityWeek
- Klue breach leaks OAuth tokens, puts cybersecurity firms on alert
- New BootROM flaw Usbliter8 puts iPhone A12/A13 models at risk
A new BootROM exploit, named Usbliter8, has been disclosed by the European cybersecurity firm Paradigm Shift, affecting millions of iPhones and Apple Watches. This exploit targets Apple’s SecureROM, which is critical for the secure boot process. Usbliter8…
SecurityWeek - Malicious VBScript spreads via WhatsApp, drops RMM on victims
A malware campaign has been identified that distributes malicious VBScript files via WhatsApp, primarily targeting users of WhatsApp Desktop and Web in multiple countries including Malaysia, Brazil, and India. The attack employs social engineering tactics,…
securelist.com - Fortinet Alerts Users to Massive Credential Harvesting Campaign
Fortinet is currently facing a large-scale credential-harvesting campaign termed 'FortiBleed,' which has compromised over 86,000 credentials for its firewalls and VPNs across 194 countries. Unlike typical attacks, this incident does not exploit new…
SecurityWeek - QNAP patches critical QuMagie flaws exposing private photos
QNAP has addressed four significant vulnerabilities in their QuMagie photo management app, impacting versions prior to 2.9.1 and 1.9.56 with a high severity score of 9.8 (CVSSv3). These vulnerabilities allow unauthenticated access to personal media files, AI…
SecurityOnlineCVE-2026-44083 - UK Information Commissioner Resigns Over Harassment Allegations
John Edwards, the UK Information Commissioner, resigned following an HR investigation that substantiated complaints regarding inappropriate behavior in the workplace. His conduct was deemed unacceptable for a public official, with evidence of vulgar language…
Infosecurity - Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
On June 22, 2026, Canada’s spy agency utilized a groundbreaking warrant to cleanse devices infected by botnets, marking a significant step in digital cybersecurity. The operation is aimed at enhancing IoT security by directly addressing the growing concerns…
The Hacker News - Steam Wallpaper Engine exploited to spread malware to gamers
Hackers are utilizing the Steam Workshop to spread malware through malicious Steam wallpapers, primarily targeting gamers in China and Russia. This campaign leverages the Wallpaper Engine app, allowing users to create and share animated backgrounds that can…
SecurityOnline - NCSC urges Fortinet users to act after FortiBleed leak
The UK's National Cyber Security Centre (NCSC) has issued urgent guidance for Fortinet customers affected by a credential theft campaign dubbed "FortiBleed," which exposed about 75,000 compromised usernames, email addresses, and plaintext passwords from…
Infosecurity - AryStinger malware turns 4,300 old routers into spy network
The article discusses the emergence of AryStinger malware, which has compromised over 4,300 outdated routers, turning them into a covert network for reconnaissance. Detected by QiAnXin's XLab, the malware exploits vulnerabilities from 2013 and 2016 to infect…
Security Affairs - CVE-2025-66336 exposes Apache Doris MCP Server to data theft
The content discusses a significant SQL injection vulnerability (CVE-2025-66336) affecting Apache Doris MCP Server version 0.1.0 through 0.6.0, allowing attackers to bypass authentication and access restricted database metadata. The flaw poses serious risks…
SecurityOnlineCVE-2025-66336 - Alleged FortiBleed Access Auction, Sens Unique Paris Data Sale, and libsodium DoS Claims
The SOCRadar Dark Web Team reported various illegal activities, including an auction for alleged FortiBleed-related access, a claimed 529,892-record customer database from Sens Unique Paris, and listings for exploits concerning libsodium and NaCl. Key…
SOCRadar - Microsoft Edge to Get Google Login, Improving User Convenience
Microsoft Edge will soon allow users to log in using Google accounts, enhancing user convenience without data synchronization between Edge and Chrome. Existing strategies let users import data from Chrome to Edge seamlessly. This integration comes after user…
SecurityOnline - BootROM flaw in Apple A12/A13 chips allows arbitrary code via USB
The article discusses the discovery of the usbliter8 exploit affecting Apple A12 and A13 devices, allowing arbitrary code execution within the SecureROM. This BootROM-level vulnerability is unpatchable and requires physical access, DFU mode, and a USB…
Security Affairs - SHEETCREEP RAT Uses Google Sheets to Spy on Indian Diplomats
SHEETCREEP is a C# remote access trojan (RAT) discovered by Securonix, targeting Indian diplomatic entities using a phishing lure based on a fake UAE-India event. The malware operates without a traditional command-and-control server, utilizing the Google…
SecurityOnline - A week in security (June 15 – June 21)
The Malwarebytes blog post highlights key cybersecurity events from the week of June 15-21, 2026. Noteworthy incidents include the cleaning of nearly 15,000 infected websites linked to the SocGholish malware, patches for vulnerabilities in Apple's Beats…
Malwarebytes - Legacy routers hijacked by AryStinger malware build proxy network
The article discusses the AryStinger malware, which has infected approximately 4,300 legacy routers to establish a reconnaissance proxy network. It highlights the malware's capability to exploit vulnerabilities in older devices, emphasizing the importance of…
The Hacker News - Google’s reCAPTCHA beta tests hand gesture check to block bots
Google's reCAPTCHA has introduced a hand gesture verification system in beta to combat advanced bots. This innovative mechanism requires users to record brief hand movements that are sent to Google for analysis, extracting 21 knuckle coordinates without…
SecurityOnline - Interpol notes AI linked phishing ransomware rise in Asia Pacific
INTERPOL has issued a warning highlighting the rise of phishing, ransomware, and AI-driven scams across the Asia-Pacific region. The increase in cybercriminal activities is linked to growing vulnerabilities exploited by artificial intelligence technologies.…
The Hacker News - Microsoft previews Windows 11 26H2, set for Oct 2026 release
Microsoft has announced the early preview of Windows 11 version 26H2, which is set to launch officially around October 2026. This update introduces a streamlined enablement package architecture that activates existing features without altering the core…
SecurityOnline - Texas wildlife breach via third party leaks 3 million records
The Texas Parks and Wildlife Department (TPWD) reported a data breach affecting about 3 million individuals, stemming from a cybersecurity incident involving a third-party vendor handling hunting and fishing licenses. The breach potentially exposed email and…
SecurityWeek - Google ends Gemini CLI, urges shift to Antigravity CLI June 2026
Google has officially deprecated the Gemini CLI, transitioning developers to the new Antigravity CLI as of June 18, 2026. Individual users of Gemini CLI can no longer access the platform, although enterprise customers retain access temporarily. The migration…
SecurityOnline - Windows Recycle Bin bug shows file names in June 2026 update
Microsoft's June 2026 update introduced a bug in the Windows Recycle Bin where users see internal filenames (e.g., $Rxxxxx.ext) instead of original filenames during the delete confirmation dialog. This occurs only when permanently deleting files from the…
SecurityOnline - Symantec spots DragonForce Backdoor.Turn using Teams TURN relay
Symantec has identified a new backdoor malware, Backdoor.Turn, used by the DragonForce ransomware group against a U.S. services firm. This malware, notable for its use of Microsoft Teams' TURN relay to obfuscate its command-and-control (C2) communications,…
SecurityOnlineDragonForce - 2,060 New Flaws Hit Week, Oracle Leads, Four Actively Exploited
The weekly CVE report from June 15-21, 2026, highlights 2,060 new vulnerabilities with 358 classified as critical and 861 as high severity. Four of these vulnerabilities are actively exploited and included in the CISA Known Exploited Vulnerabilities catalog.…
SecurityOnline - Undici npm package flaws threaten Node.js apps with leaks and DoS
The undici package, widely used in Node.js with over 133 million weekly downloads, has four disclosed vulnerabilities including denial of service and SOCKS5 proxy security flaws. The highest severity of these issues is rated at 7.5 (High, CVSSv3), with no…
SecurityOnlineCVE-2026-6734 - ISC Stormcast For Monday, June 22nd, 2026 https://isc.sans.edu/podcastdetail/9980, (Mon, Jun 22nd)
The ISC Stormcast for Monday, June 22nd, 2026, highlights the current threat level as green, indicating a low-level threat. The handler on duty is Xavier Mertens. The page includes links to previous entries and upcoming podcasts, as well as information on…
SANS ISC - ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites
The ErrTraffic malware, a ClickFix distribution framework, is sold as a service by the threat actor known as 'LenAI'. It primarily targets visitors to compromised WordPress sites and developers via fake AI platforms. Attackers inject malicious JavaScript,…
SecurityOnlineLenAI - Avo Flaw CVE-2026-55518 Enables Privilege Escalation in Rails Apps
The report discusses the critical vulnerability CVE-2026-55518 in the Avo admin panel framework, which enables privilege escalation and cross-tenant data exposure. This flaw affects versions up to 3.32.0 and the beta releases between 4.0.0-beta.1 and…
SecurityOnlineCVE-2026-55518
