News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–14 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Today, Sun 1 Nov | 0 so far | 0 |
Developing
Fri 10 Jul69 articles
- HalluSquatting Turns AI Hallucinations into Malware Delivery Tool
The article discusses the emerging risk of HalluSquatting, a technique where attackers exploit AI models' tendency to generate plausible yet incorrect resource names. This vulnerability allows AI agents to fetch malicious content instead of intended…
SOCRadar - Apache Camel fixes SSRF, header injection and Keycloak auth bugs
The Apache Camel project has patched four high-severity vulnerabilities across multiple components, primarily allowing attackers to inject control headers and execute server-side request forgery (SSRF) attacks, alongside a critical authentication bypass in…
SecurityOnline - Nine flaws found in ATM CryptoPro software spark security worries
A security researcher has uncovered nine vulnerabilities in CryptWare CryptoPro Secure Disk software used in ATMs and corporate security programs. The discovery raises questions about the software's effectiveness, particularly as it relates to a major ATM…
Dark Reading - CVE-2026-47291 Flaw in Windows IIS Allows Kernel Code Execution
The Zero Day Initiative's report details CVE-2026-47291, a remote code execution vulnerability in the Windows HTTP.sys protocol stack, discovered by the TrendAI Research Team. The vulnerability arises from insufficient validation of incoming HTTP requests…
thezdi.comCVE-2026-47291 - More Countries Jump on the Social Media Ban Wagon
The article discusses the increasing trend of countries implementing age restrictions and bans on social media for minors, primarily driven by concerns over mental health and safety. Countries like Australia, Canada, and the UK have introduced new laws to…
Dark Reading - AI coding assistants hijacked to run hidden malicious code
Researchers have raised concerns about the security implications of AI tools like Anthropic's Claude Code and OpenAI's Codex, which are designed to automate vulnerability discovery and patch management. A report from the AI Now Institute highlights a…
Infosecurity - Microsoft warns of new destructive Windows malware GigaWiper
The article discusses a new Windows malware called GigaWiper, identified by Microsoft. This modular backdoor, seen in cyber intrusions since October 2025, combines remote access capabilities with multiple destructive functions. Key features include various…
Malwarebytes - Critical flaw in Gardyn IoT Hub lets attackers run code remotely
The Gardyn IoT Hub has three critical vulnerabilities (CVE-2026-13768, CVE-2026-55726, CVE-2026-54477) that can affect its smart gardening devices, with CVE-2026-13768 scoring 10.0 (critical) on the CVSS scale, enabling remote code execution via hard-coded…
SecurityOnlineCVE-2026-13768 - New MODBEACON RAT exploits gRPC stealth for encrypted attacks
The article discusses a new Remote Access Trojan (RAT) named MODBEACON, which utilizes gRPC streaming to facilitate encrypted command and control (C2) traffic. This advanced technology allows malicious actors to bypass traditional detection methods by…
The Hacker NewsVoid Arachne - AI coding tools boost output but raise security and cost worries
The article discusses the intersection of AI coding tools and security risks. While AI tools, costing $19-$200/month/user, have been adopted by 91% of organizations, concerns over security vulnerabilities and hidden costs must be considered. Reports indicate…
Dark Reading - New Ransomware Exploits Malicious Driver to Remove Cybersecurity Protections
The article discusses the emergence of the GodDamn ransomware, a variant of the Beast ransomware, which exploits Microsoft-signed malicious drivers to disable cybersecurity protections. First identified in May 2026, this ransomware is part of the Hyadina…
Infosecurity - Cloudflare Adds Region Hints to Smart Tiered Cache to Cut Latency
The article discusses improvements to the Smart Tiered Cache at Cloudflare, specifically for public cloud regions. Launched in 2021, Smart Tiered Cache enhances cache efficiency by selecting the best data center based on real-time latency. However,…
Cloudflare - Florida expert jailed 70 months for helping BlackCat ransomware
Angelo Martino, a cybersecurity expert in Florida, was sentenced to 70 months in prison for aiding a ransomware gang while acting as a ransomware negotiator. He pleaded guilty in April and is among three individuals charged for such activities; the other two…
SecurityWeekBlackCat (ALPHV) - Over 9,000 ransomware attacks; US leads, healthcare worst hit
Since 2018, there have been over 9,000 confirmed ransomware attacks globally, with roughly 1,400 to 1,550 reported annually since 2023. The U.S. accounts for about half of these incidents, followed by France, Germany, Japan, Canada, and the UK. Major…
Security Affairs - Saudi MSSP market to double as top 10 providers named for 2026
The article discusses the top 10 Managed Security Service Providers (MSSPs) in Saudi Arabia for 2026, emphasizing the country's growing cybersecurity market with projected expansion from USD 4 billion in 2025 to USD 8.9 billion by 2030, driven by regulatory…
SOCRadar - Chinese and Indian hackers breach Pakistani police for two years
New research from SentinelOne reveals that cyberespionage groups linked to China and India infiltrated Pakistani law enforcement networks, particularly targeting the Balochistan Police, over a two-year span from February 2024 to April 2026. The attacks,…
SecurityWeek - XQUIC XRING flaw lets remote clients crash HTTP/3 servers
The article discusses a severe unpatched vulnerability in the XRING implementation of XQUIC that allows remote clients to crash HTTP/3 servers. Launched on July 10, 2026, it highlights the importance of quick mitigation by server operators to avoid potential…
The Hacker News - Lumen scales asset tracking to 1.1M with exposure management
The article discusses how Lumen Technologies transitioned from managing 17,000 to 1.1 million assets by implementing a comprehensive exposure management strategy. Key points include the adoption of advanced tools for asset visibility and risk assessment,…
The Hacker News - Hacker server exposed after WP-SHELLSTORM infects WordPress sites
The article discusses the exposure of a hacker server responsible for backdooring thousands of WordPress sites using the WP-SHELLSTORM malware. It highlights the significant rise in cybercrime and the vulnerabilities exploited in WordPress, urging website…
The Hacker News - Top 10 Cyber Threat Exposure Management Platforms
The article discusses the top 10 Cyber Threat Exposure Management (CTEM) platforms, highlighting their roles in helping organizations manage their cyber exposure effectively. It explains that CTEM is a continuous program aimed at reducing vulnerabilities…
SOCRadar - Vishing Attack Hits Microsoft 365 Users via Fake Passkey Logins
A new vishing campaign targeting Microsoft 365 users has been identified, described by Okta as employing voice calls that lead victims to counterfeit login pages prompting passkey registration. The campaign, tracked as O-UNC-066, has chiefly impacted sectors…
SecurityWeek - Criminals Exploit Students in Mule Betting Scams to Launder Money
Mule betting scams involve criminals recruiting individuals to open online gambling accounts using their personal details, often without their knowledge. These accounts are then used to launder money, making the source of funds difficult to trace. Vulnerable…
Malwarebytes - Study finds free Android VPN apps leak data and track users
The article discusses a study that examined 281 free Android VPN applications, revealing significant security issues including traffic leaks, unencrypted data transmission, and extensive user tracking. These vulnerabilities pose risks to user privacy and…
The Hacker News - Two Chrome updates in two days fix critical vulnerabilities
Google released two Chrome updates on July 8 and 9, 2026, addressing 27 security vulnerabilities, including two critical 'use-after-free' vulnerabilities. The updates are designated versions 150.0.7871.114/.115 for Windows and macOS, and 150.0.7871.114 for…
Malwarebytes - Fake Entra passkey trick lets hackers breach Microsoft 365
The article discusses a cybersecurity incident where hackers exploited a fake Microsoft Entra passkey enrollment to gain unauthorized access to Microsoft 365 accounts. It highlights the techniques used by attackers in social engineering, emphasizing the need…
The Hacker News - Fake Go Packages Power Malware Network Aimed at Crypto Users
Researchers identified 222 GitHub repositories involved in a malware operation through fake Go packages, known as "Muck and Load." This operation was initiated from a malicious Go module that masqueraded as a legitimate DNS scanning tool and led to the…
Security Affairs - Microsoft boosts Windows patches with AI, CISA follows suit
Microsoft has announced an expected increase in the number of security updates for Windows, attributing this surge to the integration of AI in security analysis. By employing AI techniques, Microsoft aims to identify more zero-day vulnerabilities and enhance…
Infosecurity - FastNetMon launches Netomics, a self‑hosted BGP tool for ISP
FastNetMon has launched Netomics, a self-hosted BGP routing intelligence platform designed for ISPs, cloud providers, IXPs, and large enterprises. It consolidates live routing data, RPKI validation, and historical data into a single on-premises application,…
SecurityOnline 2 articles this day · The Hacker News first · 2 outlets
Former ransomware negotiator jailed for aiding BlackCat gang · Ransomware negotiator jailed 70 months for BlackCat roleShow 2 articlesHide 2 articles
- Former ransomware negotiator jailed for aiding BlackCat gang09:21Security Affairs
- Ransomware negotiator jailed 70 months for BlackCat role08:10The Hacker News
- Former ransomware negotiator jailed for aiding BlackCat gang
- Microsoft rolls out WSL Containers for Docker free Linux on Win10
Microsoft has introduced WSL (Windows Subsystem for Linux) Containers, allowing users to run containers on Windows 10 without needing Docker Desktop. This feature works on Windows 10, even after mainstream support has ended, provided the system is at least…
SecurityOnline - Microsoft warns of GigaWiper malware that wipes disks and spies
GigaWiper is a sophisticated malware identified by Microsoft that operates as a destructive backdoor and wiper, exhibiting multiple system-level sabotage capabilities. First observed in October 2025, it is built on Go and includes features for executing…
SecurityWeek - Phishing email hides huge HTML padding to dodge AI scanners
The article discusses a phishing email that employs "comment stuffing" in an HTML attachment to evade AI-based detection tools. The email, disguised as a Microsoft Teams notification, exhibits several unusual characteristics, such as an empty envelope sender…
SANS ISC - Ill Bloom exploit steals $3.1M from crypto wallets exposing flaws
The article discusses the 'Ill Bloom' vulnerability that has enabled attackers to drain $3.1 million from cryptocurrency wallets. This serious cybersecurity threat highlights vulnerabilities within cryptocurrency platforms, emphasizing the need for improved…
The Hacker News - NHS warns staff of jail risk for illegal patient data access
The NHS has issued a warning to its staff regarding unauthorized access to patient data, emphasizing potential jail time for violators. Jim Mackey, head of the NHS, described such access as a significant breach of trust. This warning coincides with a…
Infosecurity - CVE-2026-13753 exposes HP Deskjet 2800 WiFi Direct, SNMP data
A security vulnerability, tracked as CVE-2026-13753, has been identified in the HP Deskjet 2800 printer series, which exposes sensitive device configuration data due to missing authorization checks in the printer's API. This flaw allows unauthenticated…
SecurityOnlineCVE-2026-13753 - HalluSquatting Exploits AI Hallucinations to Build Hidden Botnets
Researchers from Tel Aviv University, Technion, and Intuit have introduced 'HalluSquatting', a novel attack method exploiting AI assistants’ hallucination tendencies. Unlike traditional prompt injection attacks, HalluSquatting uses untargeted promptware to…
SecurityWeek - Microsoft finds GigaWiper Go backdoor blends espionage and wipe
Microsoft has discovered GigaWiper, a new type of Go-based backdoor that merges functionalities from three existing malware families. This sophisticated malware incorporates espionage features, remote control, and various destructive wiping capabilities.…
Security Affairs - Anthropic releases Reflect to monitor Claude AI usage
Anthropic introduced 'Reflect', a digital health and efficiency dashboard for its AI tool, Claude. Currently in beta, it is accessible to Free, Pro, and Max subscribers. The tool offers users insights into their AI usage patterns, encouraging healthier…
SecurityOnline - Linux Kernel FUSE Flaw Lets Local Users Escalate to Root
CVE-2026-31694 is a critical vulnerability in the Linux kernel related to FUSE that allows local users to exploit a page cache overflow to gain root privileges. The issue has a CVSS score of 7.8 (high) and affects a range of recent Linux kernel versions. It…
SecurityOnlineCVE-2026-31694
