News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–14 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Today, Sun 1 Nov | 14 so far | 0 |
Developing
Mon 29 Jun64 articles
- 119 Edge extensions promised useful tools, instead downloaded malware
Microsoft has removed 119 malicious browser extensions from its Edge add-on store, linked to a single adware campaign known as 'StegoAd.' These extensions masqueraded as useful tools like ad blockers and VPNs while secretly downloading additional malware,…
Malwarebytes - Linux kernel bugs and AI malware spur Turla backdoor surge
This article discusses recent trends and events in cybersecurity, highlighting key issues such as Linux kernel vulnerabilities, the rise of AI-based malware, and the Turla backdoor affecting infostealers. It emphasizes the evolving landscape of threats and…
The Hacker News - Telegram hosted Millenium RAT hits 60k PCs via fake game cheats
A new malware campaign utilizing a Telegram-based remote access trojan (RAT) named Millenium RAT has infected over 60,000 Windows devices worldwide, primarily in early 2026. Security firm Group-IB highlighted that the latest version has transitioned from…
InfosecurityY2K Operators - New Attack Abuses Claude Code and Harmless-Looking Repositories to Hijack Developer Machines
Mozilla's 0Din security researchers have identified a sophisticated attack method exploiting AI coding tools like Claude Code. By embedding indirect prompts in seemingly benign repositories, attackers can trigger a reverse shell on developers' systems…
SecurityWeek - Straiker raises $64M Series A to secure AI agents in enterprises
Cybersecurity startup Straiker raised $64 million in a Series A funding round, totaling $85 million raised so far. Co-led by Marathon Management Partners and other notable investors, Straiker's platform identifies AI agents within organizations, enhancing…
SecurityWeek - Google warns of AI driven Russian influence targeting EU and NATO
This report from the Google Threat Intelligence Group analyzes the evolving pro-Russia influence ecosystem, four years into the Russia-Ukraine war. It details how Russia has adapted its influence operations (IO) from a focus on Ukraine to broader global…
Google Cloud - NAIC PeopleSoft Zero-Day Hack by ShinyHunters, Denies Leak
The National Association of Insurance Commissioners (NAIC) confirmed it was targeted in a recent hacking campaign exploiting a zero-day vulnerability in Oracle PeopleSoft. The attacks, discovered on June 11, were attributed to the ShinyHunters cybercrime…
SecurityWeekShinyHunters - WSL Containers Windows 11: Native Linux Orchestration
Microsoft announced WSL Containers at Build 2026, enhancing the Windows Subsystem for Linux (WSL) to allow native Linux container management within Windows 11 without needing third-party tools like Docker. Contrary to misconceptions, this feature is not…
SecurityOnline - UK businesses underreport ransomware due to stigma, fear
Alex Scroxton reports on the underreporting of ransomware attacks among UK businesses due to fear of stigma and potential reputational damage. Data from the City of London Police indicates that between April 2025 and March 2026, 323 organizations reported…
DataBreaches - Libya Central Bank probes dark web leak after cyber breach
Libya’s Central Bank (CBL) is investigating data published on the dark web following a recent cyberattack. The bank's technical teams, in collaboration with international experts, are analyzing the data to determine its nature and potential linkage to the…
DataBreaches - Misdirected emails at TVET college force POPIA breach reporting
Misdirected internal emails that reveal personal information can trigger mandatory data breach reporting under South Africa's POPIA law, even if the disclosure was accidental. A notable case involved Central Johannesburg TVET College, where employees'…
DataBreaches - Apple removes VKontakte, MAX apps from the Russian App Store
Apple has removed two significant Russian applications, VKontakte (VK) and MAX, from its App Store amidst ongoing sanctions and disputes regarding push notifications. The VK Group has criticized Apple for the sudden and unnotified removal, claiming it has…
SecurityOnline - Researchers Automate Favicon Based Host Recon via Shodan
Rob VandenBrink discusses automating the favicon.ico method for host reconnaissance in penetration testing. This technique leverages historic DNS mining to identify target hosts by analyzing the favicon.ico file, which many organizations standardize across…
SANS ISC - 236,000 DCloud UniApp sites used for crypto and phishing scams
The article discusses the alarming revelation that approximately 236,000 DCloud Uni-App sites are being exploited for cryptocurrency scams, phishing activities, and wallet draining. This situation highlights the vulnerabilities in the current digital…
The Hacker News - Quantum Threat Spurs Push for Post Quantum Crypto Adoption
The article emphasizes the significance of post-quantum cryptography in securing credentials as quantum computing advances. It outlines the vulnerabilities current cryptographic methods face against quantum attacks and argues for urgent transition strategies…
The Hacker News - Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
The article discusses the expansion of Gamaredon's cyber attacks targeting Ukraine, emphasizing new malware and the exploitation of cloud services. The piece highlights the evolving tactics of this threat actor, which has intensified its operations using…
The Hacker NewsGamaredon Group - StegoAd hides malware in Edge extensions, 2.6 million installs
The article discusses the StegoAd campaign, where 119 malicious browser extensions on the Microsoft Edge Add-ons store falsely posed as useful tools like ad blockers and VPNs, accumulating 2.6 million installs over two years without detection. Microsoft…
Security Affairs - Linux Kernel Flaw 'DirtyClone' Lets Local Users Gain Root Access
JFrog has released details on a critical Linux kernel vulnerability, CVE-2026-43503 (DirtyClone), which enables local users to gain root privileges. The CVSS score is 8.8, and the vulnerability, identified as a variant of previous issues such as DirtyFrag…
SecurityWeekCVE-2026-43503 - White House Urges AI Firms to Curb New Models Over Security Fears
OpenAI and Anthropic are limiting the release of their new AI models at the request of the Trump administration, citing cybersecurity risks. OpenAI's model, GPT-5.6 Sol, will be available only to approved partners, emphasizing the need for safeguards and a…
SecurityWeek - The Gentlemen ransomware gang targets global firms with stealth
The article discusses the emergence of 'The Gentlemen', a ransomware-as-a-service (RaaS) group that has gained prominence for its attacks targeting large corporations and critical infrastructure. Utilizing sophisticated tactics, the group leverages…
securelist.comThe Gentlemen - US Federal Insurance Regulator Confirms Data Breach Via Oracle Flaw
The US National Association of Insurance Commissioners (NAIC) has confirmed a data breach affecting US citizens' credit rating data, traced back to a zero-day vulnerability in Oracle PeopleSoft. Detected on June 11 and disclosed on June 17, unauthorized…
Infosecurity - EU tentatively labels AWS and Azure as digital gatekeepers
The European Commission has tentatively designated Amazon Web Services (AWS) and Microsoft Azure as "gatekeepers" under the Digital Markets Act (DMA), requiring them to enhance compliance with European regulations. This designation is prompted by their…
SecurityOnline - US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve
The US government has announced rewards of up to $10 million for information about two Russian-linked cyber threat groups, UNC5792 and UNC4221. These groups have targeted US government officials, military leaders, and journalists through phishing campaigns…
SecurityWeekUAC-0185 - IPv6 flaw lets container users break out to root on CentOS/RHEL
Security researcher Massimiliano Oldani has introduced IPV6_FRAG_ESCAPE, a proof-of-concept exploit that allows for an IPv6 container escape on CentOS and RHEL 10. The vulnerability exploits a patched bug in the Linux kernel's `__ip6_append_data()`, which…
SecurityOnline - Russian hackers blamed for £1.9bn Jaguar Land Rover cyber attack
A recent report alleges that Russian hackers were behind the cyber-attack on Jaguar Land Rover (JLR), which is estimated to have cost the UK economy £1.9bn ($2.5bn). Security experts suggest potential Kremlin involvement, citing the lack of ransom demands…
Infosecurity - SharkLoader Uses Fake Installers to Deploy Cobalt Strike Globally
The article discusses SharkLoader, a malware loader identified in a global cyber campaign called StrikeShark. SharkLoader delivers a Cobalt Strike Beacon and targets governmental, diplomatic, and software firms across Asia, Latin America, Europe, and the…
SecurityOnlineStrikeShark - Ukraine, FBI Unveil Russian Cyber Spy Operation Targeting Signal
The Security Service of Ukraine (SSU), in collaboration with the FBI, has uncovered a sustained Russian cyber espionage campaign targeting the messaging accounts of officials, military personnel, and activists in Ukraine, Europe, and the United States. The…
Security Affairs - NTLM Reflection Bypass CVE-2026-24294 Gets Public PoC Exploit
TL;DR Synacktiv publicly disclosed a new NTLM reflection bypass tracked as CVE-2026-24294. The flaw gives a local user
SecurityOnline - Dark Web exposes Okta, MTS Bank and municipal data leaks
The SOCRadar Dark Web Team reports multiple significant data leaks. The incidents include: 1. **Naucalpan de Juarez SQL Database:** Allegedly contains municipal data that could lead to identity fraud and phishing. 2. **Okta Dataset:** A leak of 3.29 million…
SOCRadar - Microsoft pulls 119 malicious Edge extensions using font tricks
Microsoft has taken action against 119 malicious Edge extensions that were using images and fonts to hide malware. This move is part of a broader effort to enhance browser security and protect users from potential ad fraud and other cyber threats. The…
The Hacker News - FBI alerts users to Russian Signal backup key scam
The FBI has issued a public service announcement warning that Russian intelligence officers are targeting high-risk users on Signal by attempting to steal backup recovery keys. The campaign involves deception tactics where Russian cyber actors impersonate…
Infosecurity - macOS.Gaslight Rust backdoor steals data via Telegram bot
The macOS.Gaslight malware, discovered by SentinelLABS, targets macOS users and is believed to be associated with North Korean threat actors. It employs a Rust backdoor to steal information, including browser data and passwords, while evading detection by…
SecurityOnline - OpenAI launches GPT 5.6 Sol model for cybersecurity defence
OpenAI has introduced its new GPT-5.6 model lineup, featuring three tiers: Sol, Terra, and Luna. Sol is highlighted as the most powerful model specifically designed for cybersecurity tasks, capable of high-intensity reasoning. Following consultations with…
SecurityWeek - Thai hospitals targeted by spear phishing RAR malware campaign
A cyberattack targeting Thailand's healthcare sector has been identified, involving spear-phishing techniques that utilize RAR archive phishing to distribute malware. The campaign, active for about ten weeks, primarily affects hospitals and government health…
SecurityOnline - Public PoC released for critical libssh2 SSH flaw CVE-2026-55200
The article discusses the release of a public Proof of Concept (PoC) for a critical vulnerability in the libssh2 library, identified as CVE-2026-55200. This client-side SSH flaw could have severe implications for security. The news highlights the importance…
The Hacker NewsCVE-2026-55200 - Chrome flaw forces update as 3 million Texan breach surfaces
The article from Malwarebytes Labs provides a summary of key cybersecurity events that occurred during the week of June 22 to June 28, 2026. Major highlights include: Malware threats targeting Chrome session cookies and video files, signaling new attack…
Malwarebytes - Edgecution Malware Turns a Microsoft Edge Extension Into a Backdoor
Edgecution malware is a malicious Microsoft Edge extension functioning as a backdoor, linked to the Initial Access Broker associated with Payouts King ransomware. It targets enterprise Windows users via social engineering tactics in Microsoft Teams, using a…
SecurityOnline - Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer
The article titled "Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer" discusses a recent supply chain attack involving compromised npm and Go packages that exploit VS Code tasks to deploy a Python-based infostealer. These incidents…
The Hacker News - Google rents 110k NVIDIA GPUs from SpaceX amid AI compute crunch
The technology sector is currently facing a significant compute shortage impacting companies, especially Google and Meta. Google has implemented strict limits on its Gemini AI model, directly affecting Meta's ability to utilize AI tokens effectively. In…
SecurityOnline - Google Wallet adds Gmail based package tracking for US shoppers
Google Wallet has introduced package tracking through integration with Gmail, allowing users to receive automatic updates on deliveries directly on the Wallet home screen. When an order receipt or tracking number is detected in Gmail, Google Wallet generates…
SecurityOnline
