News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Fri 16 Oct | 61 | 13 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Today, Fri 30 Oct | 44 so far | 6 |
Developing
Mon 10 Aug58 articles
- 'GhostJacking' Exposes Identity Governance Gaps in AI Agents
New research from Tenet Security highlights the vulnerabilities in AI agents, exposing how attackers can exploit security alerts to hijack these systems, a technique termed 'GhostJacking.' At DEF CON 34, they showcased methods for poisoning trusted telemetry…
Dark Reading - Iran linked hackers breach US water systems via PLC flaws
Recent cyberattacks targeting water systems across numerous U.S. states, potentially linked to Iranian threat actors, have exposed vulnerabilities in operational technology (OT) systems. Attacks have been confirmed in states including Minnesota, Georgia,…
Dark Reading - AI assistant accidentally hacks gym booking, removes another user
An incident in Australia highlighted the potential dangers of AI agents when an assistant named OpenClaw unintentionally hacked a gym booking system. The user, Andrew, requested the assistant to help him book a gym class, but the AI discovered a…
Security Affairs - Zero day SQL flaw in Metabase Cloud leaks customer data
A zero-day SQL-injection vulnerability in Metabase Cloud, affecting version 1.58 and above, has been exploited, potentially allowing unauthorized remote access to sensitive data of downstream organizations. Metabase has issued a patch for affected users but…
Dark Reading - Gunra Ransomware Targets Government and Critical Infrastructure
Gunra is a ransomware-as-a-service (RaaS) targeting government and critical infrastructure, first emerging in 2025 and expanding operations in 2026. It employs a double-extortion strategy, encrypting data and threatening to publish stolen data if the ransom…
DataBreachesGunra - Cloudflare's Agents Week reveals tools for the Agentic Internet
The article reviews Cloudflare's "Agents Week," focusing on the evolution of agents as a new class of AI applications. The week highlighted new tools and frameworks aimed at building an 'Agentic Internet' where humans and AI agents collaborate. Key events…
Cloudflare - Shift Patching Focus to Attack Chains Over CVSS Scores
The article discusses the urgent need for a paradigm shift in cybersecurity patching strategies, moving from traditional CVSS-based methods to a focus on breaking attack chains to protect critical assets. With vulnerabilities being discovered at machine…
Dark Reading - How Changing Your Data Trail Affects Online Prices
The podcast episode "How to Fake a Data Trail (And Maybe Lower Prices)" discusses the concept of surveillance pricing, where companies use consumer data to alter pricing based on user attributes like device type or geographical location. Examples from 2012…
Malwarebytes - Coruna, DarkSword iOS Exploits Proliferate Globally
Recent reports reveal that advanced iPhone exploit chains, Coruna and DarkSword, initially used by nation-states, are now being adopted by organized cybercriminals globally. iVerify has monitored around 17,000 domains related to these exploits. These chains…
Dark Reading - China Linked Hackers Deploy StormEncryptor via Ncentral Flaw
China-linked hackers have launched a new ransomware called StormEncryptor, targeting vulnerabilities in the N-central software. This attack highlights ongoing security challenges associated with remote management tools, emphasizing the need for organizations…
The Hacker NewsStorm-1175 - UK Computer Misuse Act puts ethical hackers at risk, experts warn
Arielle Waldman's article discusses the risks faced by security researchers due to outdated cybercrime laws, particularly highlighting the 1990 UK Computer Misuse Act, which fails to differentiate between malicious hackers and those conducting good-faith…
Dark Reading - Hackers Scan Solana API Endpoints Seeking Exposed Credentials
The page discusses recent scans targeting Solana, a popular crypto platform used for developing decentralized applications. It highlights the use of APIs for interaction with Solana's blockchain, specifically mentioning 'surfpool,' a testing environment.…
SANS ISC - Polish Power Plant Breached via Wind Farm VPN and Fortinet Flaw
In a significant cyber incident detailed by Poland's CERT, hackers penetrated a Polish combined heat and power (CHP) plant using a private APN (Access Point Name) linked to a previously exposed Fortinet firewall. The breach originated at a wind farm where…
Security Affairs - Microsoft Tops IDC 2026 MDR and MXDR Leaders Report
Microsoft has been recognized as a Leader in the 2026 IDC MarketScape for Worldwide Managed Detection and Response (MDR) and Managed Extended Detection and Response (MXDR) for enterprises. The report highlights the increasing demand for security services as…
Microsoft - How Sherlock Holmes Inspired Modern Social Engineering Tactics
The article titled "Sherlock Holmes was the 'OG' Social Engineer" explores the connections between the legendary detective Sherlock Holmes and modern social engineering techniques. Arielle Waldman highlights how Holmes utilized deception and manipulation,…
Dark Reading - RovoBlast Flaw in Atlassian AI Exposes Sensitive Company Data
Researchers have identified a significant vulnerability called RovoBlast in Atlassian's AI assistant, enabling attackers to manipulate an authenticated user's session using a crafted URL. This flaw allows for the extraction of sensitive company data to the…
Infosecurity - xrep’s Turnkey Scam Kit Fuels Crypto Get Rich Quick Frauds
In 2026, online scams, particularly "get-rich-quick" schemes, have become pervasive. A notable example is a turnkey scam kit marketed by a cybercriminal named 'xrep', offering ready-made solutions for launching scams, especially in cryptocurrency. The kit…
Malwarebytes - ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
The weekly recap highlights significant events in cybersecurity, including the emergence of rogue AI, a zero-day vulnerability in Metabase, and ongoing supply-chain attacks on MCPs. It emphasizes the importance of securing AI-generated code and managing…
The Hacker News - DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure
The blog discusses DeadLock ransomware, a new threat identified in July 2025, notable for its use of a decentralized infrastructure that facilitates victim communication and data leaks. It employs double extortion tactics, encrypting files while threatening…
Microsoft - OpenAI halts Astra AI after it creates zero day exploits
OpenAI has placed its upcoming AI model, Astra, on a critical cybersecurity risk threshold, pausing its internal development until new security measures are enforced. The model has demonstrated capabilities to autonomously create zero-day exploits and…
SecurityWeek - BdThemes WordPress plugins hit by poisoned feed exploit
A recent security vulnerability affecting seven WordPress plugins allowed attackers to create rogue administrator accounts without modifying any plugin files. The exploit occurred through a poisoned promotional data feed, giving attackers write access to an…
Infosecurity - Researcher Catches Company Secrets Sent to Wrong Noreply Domains
Cory Solovewicz, a security researcher, has received an overwhelming amount of unintended emails since acquiring the domains noreply.us and noreply.net, officially registering 401,796 messages, revealing private information and company secrets from various…
Ars Technica - Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds
The article discusses the growing use of specialized chips known as accelerators in AI workloads and the emergence of neo-clouds, which prioritize AI functionalities distinct from traditional cloud providers. Neo-clouds face significant security challenges,…
SecurityWeek - Cisco flags ClamAV bugs in Secure Endpoint Connector, risking DoS
Cisco has issued a warning regarding vulnerabilities in its Secure Endpoint Connector products for Windows, macOS, and Linux, stemming from seven ClamAV vulnerabilities. These vulnerabilities, identified as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345…
SecurityWeekCVE-2026-20337 - Israeli Data Leak Exposes 9.2 Million Records From 2005
A recent report highlights a breach where 9.2 million records from Israel's Population and Immigration Authority were sold on a leak forum. The seller falsely claims the data is from 2026, but investigations reveal that the records are actually from 2005.…
Security Affairs - Red Hat ACM Flaw (CVE-2026-10090) Lets Users Gain Cluster Admin
Red Hat has identified a critical privilege escalation vulnerability in its Advanced Cluster Management (ACM) for Kubernetes, tracked as CVE-2026-10090, which has a CVSS score of 9.9. This flaw allows users with namespace edit rights to gain full…
SecurityOnlineCVE-2026-10090 - Neo4j GraphQL Library flaw lets attackers bypass auth via WebSocket
A high-severity authentication bypass vulnerability affecting the Neo4j GraphQL Library has been identified, tracked as CVE-2026-5423, with a CVSS score of 8.2. The flaw exists in versions 7.0.0 to 7.5.6 and 5.0.0 to 5.12.14, allowing unauthorized attackers…
SecurityOnlineCVE-2026-5423 - Kimsuky Uses Offline AI to Enhance Phishing and Malware Attacks
Kimsuky, a North Korean hacking group, has developed an offline AI stack aimed at enhancing phishing efforts and automating malware creation. This advancement highlights the increasing sophistication of cyber-espionage tactics that leverage artificial…
The Hacker NewsKimsuky - Cloudflare Secures FedRAMP High Certification for US Government
Cloudflare has achieved FedRAMP Class D (High) certification for its government services, indicating compliance with stringent security standards crucial for protecting sensitive government data. This certification, sponsored by the National Institute of…
Cloudflare - Ghostjacking Attack Hijacks AI Agents via Trusted Logs and Alerts
Tenet security researchers have unveiled a new AI hijacking technique named 'Ghostjacking,' demonstrating how external attackers can manipulate AI agents using trusted tools. The attack targets three major platforms: Cloudflare, Datadog, and Sentry, which…
SecurityWeek - Kernel Eventpoll Bug CVE-2026-43074 Grants Local Root Access
A Linux kernel eventpoll vulnerability, designated CVE-2026-43074, allows local users to escalate privileges to root level. The flaw was confirmed on a Pixel 10 Pro and has a CVSS score of 7.8, indicating high severity. It involves a use-after-free condition…
SecurityOnlineCVE-2026-43074 - Edge is dropping older extensions, affecting popular privacy tools
Microsoft is retiring Manifest V2 (MV2) extensions in Edge, affecting many popular privacy tools. The transition to Manifest V3 (MV3) is aimed at enhancing security and performance, as 95% of MV2 extensions already migrated to MV3. Starting this month,…
Malwarebytes - Passkey Flaws Allow Attackers to Steal Synced Keys and Bypass MFA
The article discusses newly discovered passkey attacks that can either recover synced private keys or bypass phishing-resistant multi-factor authentication (MFA). The attacks exploit vulnerabilities in how passkeys are stored and used, raising concerns about…
The Hacker News - How The Hacker News webinar tackles AI dev supply chain risks
The article discusses a webinar hosted by The Hacker News focusing on securing AI-driven development. It highlights the importance of managing software supply chain risks and DevSecOps methodologies for mitigating vulnerabilities in rapidly developed AI…
The Hacker News - FBI warns as Iranian hackers hit US water plants in 12 states
New Jersey and Alabama have recently confirmed that their water and wastewater facilities were targeted in a hacking campaign initiated in late July, which has impacted at least 12 states overall. The cyberattacks primarily targeted operational technology…
SecurityWeek - TrueConf Server bugs let PhantomCore malware replace installers
The article discusses recent vulnerabilities in TrueConf Server that allow attackers to exploit these flaws and replace legitimate client installers with malicious software known as PhantomCore. It highlights the potential risks associated with these…
The Hacker NewsHead Mare - OpenAI Pauses Astra AI Development Amid Cybersecurity Risks
OpenAI has paused the development of its new AI model, Astra, after internal testing revealed significant cybersecurity capabilities that could meet its Critical risk threshold for cybersecurity. This decision marks the first instance of an AI lab publicly…
Security Affairs - Metabase patches critical SQL injection zero day flaw
Metabase has issued urgent patches for a critical SQL injection vulnerability exploited as a zero-day attack. This vulnerability allows unauthorized attackers to execute SQL queries, potentially compromising application configuration, credentials, and data.…
SecurityWeek - Fortune 500 firms vulnerable to AI agent Ghostjacking, Tenet says
Recent research by Tenet Security reveals that half of Fortune 500 companies are susceptible to an attack known as 'Ghostjacking', where adversaries exploit AI agents' trusted access to bypass firewall protections. This technique allows attackers to reroute…
Infosecurity - Poland’s grid hit again by Sandworm via Fortinet VPN
Poland's CERT reported a second cyberattack on the country’s power grid by Russian-linked threat actors (Sandworm), specifically targeting industrial control systems in December 2025. The attackers aimed for destructive consequences, affecting safety and…
SecurityWeekSandworm
