News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Today, Sat 31 Oct | 11 so far | 2 |
Developing
Mon 20 Jul58 articles
- JadePuffer's ENCFORGE ransomware erases AI models via Langflow
JadePuffer, a ransomware campaign operated by a large language model, has returned with a new variant called ENCFORGE, specifically designed to destroy AI model artifacts. This campaign utilizes a targeted approach, impacting various file formats critical to…
InfosecurityJadePuffer - Attackers exploit OAuth IDs to check Microsoft Entra accounts
Proofpoint has uncovered a technique called OAuth client ID spoofing, allowing attackers to enumerate Microsoft Entra ID accounts and validate credentials without a successful sign-in. This method exploits the handling of OAuth client IDs and involves the…
SecurityOnline - UK to Ban Ransom Payments for Public Sector as Attacks Surge
The ransomware landscape is increasingly complex, with nearly half of targeted companies paying ransoms, as outlined by Sophos in 2025. The UK government is moving to prohibit ransom payments for public sector entities, reflecting rising concerns over…
Ars Technica - Cybersecurity Key to Securing Events Like the World Cup
The article discusses the crucial role of cybersecurity in ensuring the safety and security of high-profile events, highlighting recent major celebrations like the World Cup and the U.S.'s 250th anniversary. Author Olga Polishchuk emphasizes that threats…
Dark Reading - AI crafted WordPress exploit chain triggers urgent CVE patches
Security researchers at Searchlight Cyber have developed a complete exploit chain for two critical vulnerabilities in WordPress, utilizing OpenAI’s GPT-5.6 Sol Ultra. The vulnerabilities, identified as CVE-2026-63030 and CVE-2026-60137, affect multiple…
- WordPress and SonicWall flaws fuel AI driven SharePoint attacks
The article discusses significant recent developments in cybersecurity, including vulnerabilities in WordPress and SonicWall, as well as new threats related to AI services and SharePoint. It highlights the emergence of AI as a powerful tool in cybersecurity,…
The Hacker News - CVE-2026-58319 Exposes Doris Frontend to Unauthorised Access
The critical vulnerability CVE-2026-58319 affects Apache Doris version 2.1.0 due to improper authentication in the Frontend HTTP API, allowing unauthorized remote administrative operations. Currently, there is no confirmed exploitation in the wild. Users are…
SecurityOnlineCVE-2026-58319 - Russia uses hacked IP cameras to monitor NATO weapons shipments
The Dutch intelligence services AIVD and MIVD have reported that Russian state actors are exploiting hacked IP cameras to gather military intelligence on NATO logistics and weapons deliveries to Ukraine. This ongoing operation, escalated since Russia's…
Security Affairs - CVE-2026-56451: CVSS 10 Siemens Opcenter X Flaw Grants Full Unauthorized Access
Siemens has identified a critical authentication bypass vulnerability in Opcenter X, tracked as CVE-2026-56451, which has a maximum severity score of 10.0 on CVSS. The flaw affects all versions prior to V2604, allowing unauthenticated remote attackers to…
SecurityOnlineCVE-2026-56451 - HollowByte bug lets attackers crash OpenSSL with 11-byte payload
A recently discovered vulnerability in OpenSSL, termed 'HollowByte', can allow attackers to cause denial of service (DoS) by exploiting a buffer pre-allocation flaw. This issue, uncovered by Okta's red team, can be triggered using an 11-byte malicious…
SecurityWeek - New HollowGraph Malware Hijacks Microsoft 365 Calendars for Covert C2 Communications
A new malware named HollowGraph has been discovered, which exploits the Microsoft Graph API to transform compromised Microsoft 365 calendars into covert two-way command and control (C2) channels. Researchers from Group-IB identified this malware as part of a…
Infosecurity - Russian spies hack NATO IP cameras to monitor military movements
The article reports on Russian intelligence operations that have hacked IP cameras across NATO states and Ukraine to monitor military logistics. This breach highlights vulnerabilities in Internet of Things (IoT) security and raises concerns about real-time…
The Hacker News - New Site Tracks 100+ Cyber Breaches to Improve Reporting Accuracy
Richard Bird, a cybersecurity executive, has launched a website that tracks disclosed material cybersecurity breaches, providing a necessary resource for professionals and the public. The site features two ledgers: one based on mandatory SEC disclosures and…
SecurityWeek - Navigate360 leak exposes 8.3 million tipster tips anonymity fears
In March 2026, Navigate360 experienced a breach that exposed 8.3 million anonymous tips from programs like Crime Stoppers, Safe2Tell, and SandyHookPromise. The company has faced criticism for its lack of transparency and failure to notify affected tipsters…
DataBreaches - Why Exposure Management Matters More Than Your Security Stack
The article "Mythos Didn't Break Your Security Program. Your Exposure Window Could" discusses the importance of exposure management in cybersecurity. It suggests that organizations should shift their focus from reactive approaches to proactive exposure…
The Hacker News - EY Warns Clients of Data Breach via Third Party Platform
Ernst & Young (EY) has notified clients of a data breach involving compromised personal and financial information due to a third-party service management platform. The breach occurred between March 28 and April 12 and was identified on April 23. EY is…
SecurityWeek - Fake game installs spread RenPy Loader, dropping Amatera Stealer
The article discusses how fake game downloads are being used to distribute malware known as **RenPy Loader**, which subsequently delivers **Amatera Stealer**, an infostealer targeting sensitive information. RenPy Loader exploits the legitimate Ren’Py game…
Malwarebytes - 7zip XZ file flaw lets hackers run code via malicious archive
A critical vulnerability in 7-Zip, affecting its handling of XZ-compressed files, has been discovered, allowing for potential remote code execution if a user opens a malicious archive. This flaw, identified by researcher Landon Peng, exploits a heap-based…
Security Affairs - Capital One launches AI security tool VulnHunter on GitHub
Capital One has open-sourced an AI-powered security tool called "VulnHunter" designed to identify and remediate software vulnerabilities. Unlike traditional vulnerability scanners, VulnHunter aims to reduce false positives and enhance developer workflows by…
SecurityWeek - Critical NGINX Flaw CVE-2026-42533 Allows Remote Code Execution
The article discusses a critical vulnerability in NGINX, identified as CVE-2026-42533, which has a CVSS score of 9.2. F5 released patches to address this flaw that can allow unauthenticated attackers to execute remote code or cause server crashes through…
Security AffairsCVE-2026-42533 - UK Police Urge Cybercrime Risk Orders After TfL Hack Sentencing
In the wake of a major cybercrime case involving the Transport for London (TfL) hack, police chiefs are advocating for Cybercrime Risk Orders (CCROs) as a means to enhance legal powers against cyber offenders. The case saw two young individuals sentenced…
Infosecurity - Hugging Face breached by autonomous AI agent, exposing data
Hugging Face, a machine learning collaboration platform, recently experienced a data breach due to a cyberattack executed by an autonomous AI agent. The attack targeted its production infrastructure, exploiting vulnerabilities in a data-processing pipeline,…
SecurityWeek - Malicious XZ archives can execute code via 7Zip flaw, patch urged
A newly discovered vulnerability in the 7-Zip file extraction tool can allow malicious XZ archive files to execute arbitrary code during the extraction process. This security risk has raised concerns regarding endpoint security, prompting users to update to…
The Hacker News - Hacker Uses Google Gemini AI to Run Eight PC Dental Botnet
The article discusses a Russian-speaking hacker utilizing Google Gemini CLI to manage a botnet comprised of eight computers in dental clinics. It highlights the rise of AI in cybercrime, focusing on the vulnerability of healthcare systems to such attacks.…
The Hacker News - Hugging Face Fixes AI Driven Agent Breach After Credential Leak
Hugging Face, a leading AI platform, reported an intrusion where an autonomous AI agent breached its production infrastructure, accessing internal datasets and service credentials. The attack stemmed from two code execution flaws in their data-processing…
Security Affairs - Chrome 150 patches critical memory safety bugs across core components
Google released Chrome 150, addressing seven memory safety vulnerabilities including three critical use-after-free issues in its CameraCapture, GPU, and Network components. The update also resolves three high-severity use-after-free bugs in other components…
SecurityWeek - HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars
The HOLLOWGRAPH malware, linked to the Cavern backdoor framework, exploits the Microsoft Graph API to hide its command-and-control (C2) operations within Microsoft 365 calendar events, specifically dated far into the future (2050). The malware operates via a…
SecurityOnline - New macOS Infostealer CrashStealer Targets Crypto Users
CrashStealer is a newly identified macOS infostealer developed in C++ that disguises itself as an Apple crash reporter, targeting macOS users, especially those involved in cryptocurrency. It utilizes a notarized dropper to bypass security measures, allowing…
SecurityOnline - SheetAgent RAT hits Indian job seekers via fake govt zip
Operation ShadowRecruit is a multi-stage malware campaign uncovered by Seqrite's APT Research Team, targeting Indian job seekers with a recruitment lure. The campaign uses a ZIP archive disguised as an Indian government job hiring notice, which installs a…
SecurityOnlineOperation C-Major - Zero day exploits hit SonicWall VPN, giving attackers root access
Volexity has uncovered a significant zero-day exploitation campaign targeting SonicWall SMA 1000 VPN appliances, where unidentified hackers utilized two vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to gain root access. The first vulnerability (CVSS…
- FaceTime scams surge as thieves trick users into handing cash
The article from Malwarebytes Labs covers key security updates and incidents from July 13-19, 2026. Notable highlights include a flaw in Shark vacuums exposing personal data, security updates for major software like Adobe and Chrome, and a concerning rise in…
Malwarebytes - New Rust based LabubaRAT masquerades as NVIDIA container runtime
The article discusses LabubaRAT, a newly identified remote access tool (RAT) documented by Blackpoint Cyber's Adversary Pursuit Group. LabubaRAT is notable for its implementation in Rust and disguises itself as an NVIDIA container runtime component. Key…
SecurityOnline - Hugging Face Breach Shows Urgent AI Agent Security Gaps
The article discusses a recent security breach at Hugging Face, the world's largest AI model repository, caused by an autonomous AI agent. The breach highlights significant vulnerabilities in AI systems and the urgent need for improved security measures. It…
The Hacker News - Codex trims context window, blocks rm rf $HOME to stop data loss
The recent updates to Codex involve lowering the context window from 372K to 272K to address billing issues and excessive consumption of resources. This change may lead to increased frequency of memory compression, potentially causing 'amnesia' in long tasks.…
SecurityOnline - WordPress flaws CVE-2026-60137 and CVE-2026-63030 allow RCE
The article discusses two recently discovered WordPress vulnerabilities, known as WP2Shell, identified as CVE-2026-60137 and CVE-2026-63030. These vulnerabilities affect versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 of WordPress, allowing for unauthenticated…
- SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
The article discusses the SleeperGem malware that utilizes three malicious RubyGems packages specifically targeting developer machines. It highlights the risk posed to software development environments and emphasizes the need for enhanced security measures…
The Hacker News - Microsoft releases patch for Dell laptops after USB C glitch
Microsoft released the out-of-band update KB5121767 to address compatibility issues with Intel USB-C drivers on various Dell laptops, following the problematic KB5101650 update. The original update caused unexpected shutdowns and degraded performance on…
SecurityOnline - Apple ends Mac Pro after scrapping M2 Extreme, M3 Extreme chips
Apple announced the discontinuation of the Mac Pro in March 2023, removing it from its website and confirming no successor will be produced. Bloomberg reporter Mark Gurman noted that the decision was not initially intended, as Apple had been secretly…
SecurityOnline - CISA Flags KEV Flaws as Vulnerability Spike Hits 2,757 in Week
The CVE WATCHTOWER briefing highlights a rise in cyber threats with 2,757 new vulnerabilities discovered from July 13 to July 19, 2026, necessitating urgent actions from security teams. The Cybersecurity and Infrastructure Security Agency (CISA) added 10…
SecurityOnline - SANS ISC Reports Green Threat Level: Johannes Ullrich On Duty
The SANS Internet Storm Center (ISC) provides insights into cyber threats and security awareness. On July 20, 2026, the threat level was marked as green, indicating a low threat level. The handler on duty was Johannes Ullrich, who is involved in teaching…
SANS ISC
