News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–14 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Today, Sun 1 Nov | 16 so far | 0 |
Developing
Fri 26 Jun59 articles
- Immobiliare Labs npm packages hijacked to steal cloud credentials
Multiple npm packages maintained by Immobiliare Labs were compromised on June 26, 2026, running a malicious payload during installation via a 'binding.gyp' hook. Affected packages include various Backstage plugins, which harvest credentials from GitHub…
StepSecurity - Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories
Researchers at Wiz identified a high-severity vulnerability in the Amazon Q Developer extension for Visual Studio Code that could enable attackers to steal cloud credentials by exploiting malicious code repositories. This vulnerability allows unauthorized…
SecurityWeekCVE-2026-12957 - Klue supply chain hack leaks Salesforce data at two dozen firms
A supply chain attack targeting the market intelligence platform Klue compromised the Salesforce instances of approximately two dozen customers between June 11 and 12. Hackers utilized old credentials to gain access, exfiltrating data including business…
SecurityWeekIcarus - Weekly Security Roundup: Cellebrite, Tata Hack, AI Warnings
SecurityWeek's latest cybersecurity news roundup covers several significant events: 1) Russia used Cellebrite software to hack an activist's phone, highlighting ongoing surveillance issues. 2) Two members of the Scattered Spider hacker group pleaded guilty to…
SecurityWeekScattered Spider - Iranian dual citizen arrested in Montenegro for $3.4bn US hack
An Iranian national, Amir Barati, who also holds Turkish citizenship, was arrested in Montenegro for hacking attacks on U.S. infrastructure, causing damages estimated at $3.4 billion. He is wanted in New York for conspiracy, computer fraud, and identity…
DataBreaches - Amazon Q Developer flaw lets malicious repos run code
The article highlights a security vulnerability in Amazon's Q Developer platform, allowing malicious repositories to execute code through misconfigured MCP settings. This flaw raises concerns about potential exploitation by cybercriminals, prompting…
The Hacker News - Cambridge Hospital staff accessed boy's crocodile attack records
The medical records of a young boy who was attacked by a crocodile at a Cambridgeshire zoo were accessed by around 40 staff members at Addenbrookes’ Hospital. Cambridge University Hospitals (CUH) is investigating the reasons for these accesses and has…
DataBreaches - Meeting Trump's 2030 Quantum Deadline Will be Expensive, Complex
The article discusses the challenges and upcoming mandates for organizations as they prepare for quantum readiness by 2030, following recent executive orders from President Trump. Key points include the requirement for federal agencies to implement…
Dark Reading - ICO uncovers data protection flaws in UK edtech firms
The UK Information Commissioner's Office (ICO) released a report titled 'EdTech examined — Key Findings from Our Audits,' focusing on data protection practices among 28 edtech providers used in UK primary and secondary schools. The audits revealed positive…
DataBreaches - Linux 'pedit COW' flaw gives attackers root via binary poisoning
The article discusses a new exploit discovered in Linux systems, referred to as the 'pedit COW exploit', which allows attackers to gain root access by poisoning cached binaries. This highlights a serious vulnerability that security researchers and users need…
The Hacker News - Dark Reading seeks original input, urges AI free submissions
The article from Dark Reading acknowledges the overwhelming number of submissions received from the cybersecurity community and explains the delays in response times. Senior Editor Becky Bracken expresses gratitude for the contributions and requests that…
Dark Reading - Malicious PDF Email Spreads Chrome Extension to Hijack Sessions
Researchers have discovered malware that hijacks Chrome session cookies through an email attachment disguised as a PDF. This malware uses a malicious Chrome extension for data collection and to execute PowerShell commands on the host system, leveraging…
Malwarebytes - Nebulock raises $25M Series A to expand AI driven threat hunting
Nebulock, a cybersecurity startup focused on autonomous threat hunting, has raised $25 million in a Series A funding round, totaling over $33 million in funding. The investment, led by FirstMark, aims to enhance the company’s AI-powered solutions for…
SecurityWeek - CISA warns of active PTC Windchill RCE exploited via web shells
CISA has added an exploited Remote Code Execution (RCE) vulnerability in PTC Windchill to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is being actively targeted in web shell attacks, prompting organizations to apply necessary patches and…
The Hacker News 3 articles this day · SecurityWeek first · 3 outlets
Cisco SD-WAN Zero-Day Exploited in Attacks · CISA adds critical PTC Windchill, Cisco UC flaws to KEV listShow 3 articlesHide 3 articles
- Cisco SD-WAN Zero-Day Exploited in Attacks12:11SecurityOnline
- CISA adds critical PTC Windchill, Cisco UC flaws to KEV list10:35Security Affairs
- PTC Windchill Faces Attack, CISA Orders Patch for CVE-2026-1256908:15SecurityWeek
- Cisco SD-WAN Zero-Day Exploited in Attacks
- DirtyClone Flaw Lets Linux Users Escalate to Root Access
The article discusses a newly discovered vulnerability in the Linux kernel, referred to as DirtyClone, which allows local users to gain root access through the exploitation of cloned packets. This flaw presents significant security risks, enabling…
The Hacker News - Guardian Agents Boost Identity Security Amid Evolving AI Threats
The article discusses the emergence of Guardian Agents as a crucial layer in identity governance, enhancing cybersecurity measures against sophisticated attacks. It emphasizes the importance of managing AI's role in identity security and governance,…
The Hacker News - Linux Foundation launches Akrites to boost OSS security response
The Linux Foundation has launched a new initiative called Akrites, aimed at improving the security of open source software (OSS) by establishing a shared Security Incident Response Team (SIRT). This effort focuses on the efficient discovery, patching, and…
SecurityWeek - Cellebrite tools used by Russian to crack activist's iPhone
Russian security services accessed activist Andrey Pivovarov's iPhone using Cellebrite's tools, despite the company's announcement to cease sales to Russia. Pivovarov was detained in May 2021, and his devices were searched weeks later with the forensic tools,…
Security Affairs - Miasma malware targets npm, GitHub Actions in supply chain hack
The article discusses a supply chain attack carried out by the Miasma malware, which specifically targets npm packages and GitHub Actions, posing significant risks to developers and organizations. The malware exploits vulnerabilities within software…
The Hacker News - Microsoft to keep Windows 10 free updates until 2027
Microsoft has extended its Windows 10 Extended Security Updates (ESU) program to October 2027, allowing general consumers to continue receiving security patches beyond the original end date of October 2025. This decision comes amidst concerns that many users…
SecurityOnline - China Linked Hackers Use New TinyRCT Malware in SE Asia Energy
The article discusses a sustained cyber campaign attributed to China-linked hackers, specifically a group named CL-STA-1062, targeting critical infrastructure in Southeast Asia, particularly state-owned energy sectors. The campaign involves the use of a new…
InfosecurityUAT-7237 - Polymarket to refund users after $3m hack via vendor breach
Polymarket, a decentralized prediction market platform, has announced it will fully refund users affected by a recent hacking incident. The platform admitted that a third-party vendor had been compromised, leading to the injection of malicious scripts that…
SecurityWeek - Microsoft warns hotels of new Node.js phishing ZIP attack
Microsoft has issued a warning about a new phishing attack targeting hotels, which employs a malicious Node.js implant embedded in ZIP files posing as photo files. This campaign aims to trick victims into downloading and executing the harmful software.…
The Hacker News - WhatsApp malware spreads VBScript with hidden RMM payloads
A new WhatsApp malware campaign has been identified, involving a threat actor that hijacks accounts to send malicious VBScript files to users, primarily in Malaysia. The scripts are disguised as financial documents and use localization to trick victims. Once…
SecurityOnline 2 articles this day · The Hacker News first · 2 outlets
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets · Google uncovers Turla's STOCKSTAY backdoor targeting UkraineShow 2 articlesHide 2 articles
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets08:55SecurityWeek
- Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine07:15The Hacker News
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets
- Russia pulls activist iPhone data via Cellebrite after sales stop
The article discusses Russia's use of Cellebrite technology on the iPhone of a jailed activist, occurring months after the company ceased sales to Russian agencies. It highlights the implications for digital privacy and security, raising concerns over the…
The Hacker News - Polymarket confirms $2.94M theft after third party breach
A recent security breach at Polymarket, caused by compromised third-party vendor software, resulted in a theft of approximately $2.94 million in cryptocurrency from affected user wallets. Hackers injected malicious code into the platform, draining funds from…
Security Affairs - Over 55 fake Samsung and Adidas shops scam European consumers
Recent cybersecurity threats revealed over 55 fake shop campaigns targeting consumers in 12 European countries, with the perpetrators impersonating well-known brands like Samsung and Adidas. These campaigns, which operated between March and May 2026,…
SecurityOnline - FOSSBilling Template Injection Flaw Exploited in the Wild
A critical vulnerability (CVE-2026-28496) in FOSSBilling allows for template injection, rated with a CVSS score of 9.4, enabling attackers to access sensitive data and execute remote code. The flaw stems from improper input validation in the application’s…
SecurityOnlineCVE-2026-28496 - MCP update adds stateless layer, sparks security worries
The Model Concept Protocol (MCP) is transforming from a single-user AI integration tool to a robust enterprise-ready version by July 28, 2026. This change introduces a stateless protocol layer and involves six Specification Enhancement Proposals (SEPs).…
SecurityWeek - UK CMC flags Canvas data breach hitting 160 universities
The UK’s Cyber Monitoring Centre (CMC) has released an analysis regarding a recent data breach involving Instructure’s Canvas, affecting around 160 UK higher education institutions and approximately 9,000 globally. The breach involved unauthorized access and…
Infosecurity - Gaslight malware tricks AI analysts with fake macOS messages
The article discusses a new malware named macOS.Gaslight, attributed to North Korean hackers, which targets macOS systems. This Rust-based infostealer implants fabricated system messages designed to confuse AI-assisted malware analysts, ultimately…
Security Affairs - Google Ads spread OXLOADER malware, dropping CASTLESTEALER
The article discusses the discovery of a new malware loader named OXLOADER, which delivers the CASTLESTEALER infostealer targeting Windows users through malicious Google Ads that impersonate Node.js downloads. This campaign, tracked as REF8372, utilizes a…
SecurityOnline - India Targeted Phishing Uses Bitmap Hidden Remcos RAT Steals Data
The article reports on a phishing campaign involving Remcos RAT, a type of malware delivered via a steganographic loader hidden in a bitmap image. This attack primarily targets Windows users in India and employs a multi-stage .NET loader chain. The initial…
SecurityOnline - Uber names former Coinbase CSO Philip Martin as new CISO
Philip Martin has been appointed as the Chief Information Security Officer (CISO) at Uber. He previously served as Chief Security Officer at Coinbase, managing cybersecurity and risk compliance for over 250 employees. His career includes roles at Palantir…
SecurityWeek - Critical auth flaw in Python.org API lets anyone gain admin
A critical authentication bypass vulnerability was identified in the python.org release management API, allowing unauthorized admin access using an admin username and arbitrary API key. This flaw, reported by researcher Splitline Ng on February 23, 2026,…
SecurityOnline
