News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 15 |
| Today, Thu 29 Oct | 11 so far | 3 |
Developing
Mon 17 Aug64 articles
- Stripe to acquire AI hub OpenRouter for over $7 billion
Stripe has agreed to acquire AI startup OpenRouter for over $7 billion, following OpenRouter's recent $113 million Series B funding round. OpenRouter is recognized as the largest AI API intermediary hub globally, offering robust features like intelligent…
SecurityOnline - Head Mare Uses TrueConf Zero Days to Drop PhantomCore Backdoor
The content discusses a cyber attack attributed to the Head Mare group targeting TrueConf video conferencing servers, discovered by Kaspersky in July 2026. The attackers exploited two previously unknown vulnerabilities to gain control over unpatched servers.…
SecurityOnlineHead Mare - McDonald’s employee data allegedly leaked, 1.7M records at risk
A data seller has allegedly claimed to have stolen 1.7 million records of McDonald’s employees from its Azure database. An analysis of an 8,000-row sample from the supposed leak confirms its authenticity, demonstrating details consistent with legitimate…
Security Affairs - China linked hackers exploit VMware flaw to drop Babuk ransomware
The article discusses a recent security incident involving a suspected China-nexus actor exploiting a vulnerability in VMware vCenter to deploy Babuk-derived ransomware. It highlights the increasing sophistication of cyber threats, particularly in relation…
The Hacker News - Kimwolf Botnet Targets Android TV Boxes via Open ADB, Boosts DDoS
The Kimwolf botnet malware, identified by Palo Alto Networks, targets Android TV boxes and set-top boxes, utilizing unauthenticated Android Debug Bridge (ADB) through residential proxies for distribution. It significantly enhances DDoS capabilities,…
SecurityOnline - Infostealers Harvest 1.7 Billion Credentials in Six Months
Security researchers have reported a significant increase in the prevalence of infostealer malware, with 7.4 million devices infected in the first half of 2026, leading to the harvesting of 1.7 billion credentials. Notable variants include Vidar, StealC, and…
Infosecurity - SonicWall VPN Gap Lets Akira Ransomware Try Safe Mode Evasion
The article discusses an Akira ransomware attack that utilized Safe Mode to circumvent Endpoint Detection and Response (EDR) systems. The attackers accessed a company's system via a Multi-Factor Authentication (MFA)-less SonicWall VPN, disabled security…
Security AffairsStorm-1567 - Apple rolls out iPhone alerts for mercenary spyware attacks
The article from Malwarebytes Labs summarizes cybersecurity news from August 10 to August 16, 2026. Key highlights include: 1. **Mercenary Spyware:** Apple has introduced iPhone alerts for users targeted by mercenary spyware. 2. **WhatsApp Updates:** A new…
Malwarebytes - TheHatman sells Azure tenant data from McDonald's, TCS, Vodafone
A threat actor identified as 'TheHatman' is selling data allegedly stolen from Azure tenants of multiple Fortune 500 companies, including McDonald's, TCS, and Vodafone. The leaked data, which includes millions of records, was reportedly exfiltrated using…
SecurityWeekTheHatman - Kaspersky reveals Project CAV3RN, a stealthy DNS espionage tool
Project CAV3RN is a cyber espionage operation targeting organizations in Israel, tracked by Kaspersky Labs. Key capabilities include DNS-based command selection and the use of Google Apps Script relays. The framework utilizes a local DLL broker to load and…
SecurityOnline - SpaceX Buys Cursor for $60B, Unveils Grok 4.6 Model
SpaceX has acquired the AI coding startup Cursor for $60 billion, integrating its team into SpaceX's AI division. This acquisition, formalized on August 14, follows a strategic alliance for model training announced in April. Cursor's access to SpaceX's…
SecurityOnline - Qualcomm Snapdragon C Targets $300 Windows Laptops to Rival MacBook Neo
Qualcomm launched the Snapdragon C computing platform at COMPUTEX 2026, designed for entry-level Windows laptops targeting students, families, and small businesses. Acer's Aspire Go 15 is the first model utilizing this platform, aimed at the $300 market…
SecurityOnline - Google lets users strip visible AI watermarks, keep trace tags
Google has announced a policy change allowing users to manually remove visible watermarks from media generated by its AI models, while still maintaining mandatory invisible tracking technologies like SynthID and C2PA metadata. This feature will be rolled out…
SecurityOnline - watchTowr publishes exploit for Citrix NetScaler RCE CVE-2026-8452
Researchers at watchTowr have published an exploit for the Citrix NetScaler RCE vulnerability, CVE-2026-8452, allowing unauthenticated attackers to execute code as root. This vulnerability, rated CVSS 9.8, affects several versions of NetScaler ADC and…
- Microsoft rolls out customisable context menu for Windows 11
Microsoft is developing a customizable right-click context menu for Windows 11, which will streamline user experience by addressing cluttered options. The new design allows users to collapse app-specific entries, primarily for Microsoft apps like Terminal…
SecurityOnline - Anthropic unveils covert watermark for Claude to meet EU AI rules
Anthropic has disclosed the mechanics of its text watermarking system in compliance with the EU AI Act. Unlike traditional watermarks, Claude uses a covert statistical algorithm, integrated within the text without any visible symbols or quality degradation.…
SecurityOnline - Google must ease third party app store access after court order
Google has begun hosting third-party app marketplaces like Aptoide on its Play Store, marking a significant shift towards an open ecosystem amidst ongoing antitrust scrutiny. However, Judge James Donato criticized the company for creating unnecessary…
SecurityOnline - Critical Metabase SQLi flaw lets attackers seize full admin control
The weekly threat intelligence report for mid-August 2026 highlights the discovery of 3,976 new vulnerabilities, emphasizing the need for immediate patching to protect enterprise systems. Key vulnerabilities include a critical SQL injection in Metabase…
- ISC Stormcast For Monday, August 17th, 2026 https://isc.sans.edu/podcastdetail/10054, (Mon, Aug 17th)
The content is an update from the Internet Storm Center, indicating that Didier Stevens is the handler on duty, with a current threat level categorized as green. It mentions a podcast episode dated August 17th, 2026, hosted by Dr. Johannes Ullrich. Links are…
SANS ISC - DeadLock Ransomware Infects 80 Firms Using Blockchain Chat
The DeadLock ransomware is recognized as a severe double extortion threat, employing a blend of modern file encryption and decentralized blockchain technologies. Microsoft Threat Intelligence reports that this malware has targeted over 80 organizations…
SecurityOnline
Sun 16 Aug11 articles
- Threema hit by DDoS attack, causing four hour messaging outage
Threema, a Swiss secure messaging service, faced significant disruptions due to multiple large-scale DDoS attacks that affected communication services, although on-premise users were unaffected. Users reported outages starting on Tuesday evening, initially…
Security Affairs - Wireshark 4.6.8 patches 28 security flaws and squashes 25 bugs
**Handler on Duty**: Didier Stevens **Threat Level**: Green **Wireshark 4.6.8 Released**: **Published**: August 16, 2026 **Last Updated**: August 16, 2026, 21:31:48 UTC **Details**: This release addresses 28 vulnerabilities and fixes 25 bugs. **Author**:…
SANS ISC - Kimsuky AI, Gunra Ransomware and New Botnets Fuel Global Threat
The Security Affairs Malware Newsletter Round 110 features a compilation of significant articles and research related to malware trends globally. Key highlights include: 1. Kimsuky enhancing its attack strategies using AI tools. 2. The ShieldBreak disclosure…
Security Affairs - Mustang Panda's CoolClient gains signed driver for stealth
Mustang Panda has enhanced its CoolClient backdoor with a signed kernel driver, improving stealth and making detection more difficult. This new variant can hide processes, files, and registry entries by communicating through IOCTL requests. Notably, the…
Security AffairsMUSTANG PANDA - Judge Dismisses TABB Data Leak Class Action Over Lack of Injury
A federal judge has dismissed a class action lawsuit against TABB Inc. related to a 2024 data leak, ruling that the plaintiff, Arthur Ojo, did not demonstrate a concrete injury necessary for federal jurisdiction. The ruling comes after TABB faced issues with…
DataBreaches - Anubis ransomware hits Fairlife, deletes keys then leaks data
The article discusses the Anubis group's attack on Fairlife, as reported by Marco De Felice in SuspectFile. Key points include that Anubis claims this was not a targeted attack, stating they exploit weak security ('open all doors with weak locks') and later…
DataBreachesAnubis - Rep. Thompson brings bipartisan rural hospital cybersecurity act to House
A bipartisan group of U.S. legislators has introduced the Rural Hospital Cybersecurity Enhancement Act to the House of Representatives. The act aims to strengthen the cybersecurity protections for rural hospitals. Key sponsors include Reps. Glenn Thompson,…
DataBreaches - French tax hack leaks 678,000 taxpayers' data as probe begins
In a sophisticated cyberattack, hackers have breached France's tax agency, exposing the personal data of 678,000 taxpayers, including both individuals and businesses. The attack, confirmed by France's tax administration, is being investigated by the Paris…
Security Affairs - Hackers Leverage Expired Domains for Malware, SAP, macOS Exploits
The latest edition of the Security Affairs newsletter, authored by Pierluigi Paganini, highlights recent cybersecurity threats and incidents, including: 1. **Expired Domain Threats**: Cybercriminals are purchasing expired domains to distribute malware. 2.…
Security AffairsCVE-2026-58231 - APT36 uses fake VPN installers to deploy PATCHCORD backdoor
Acronis has uncovered a sophisticated espionage campaign attributed to APT36, involving a backdoor known as PATCHCORD that targets Afghan telecom and South Asian critical infrastructure. This malware is spread through fake VPN installers that closely mimic…
Security AffairsOperation C-Major - Election officials pause ElectSure use after cybersecurity breach
The Wake County Board of Elections is halting its use of a software vendor, ElectSure, following a reported potential cyberattack. Although no voting machines, ballots, voter registration records, or vote-counting systems appear to have been compromised, the…
DataBreaches
Sat 15 Aug23 articles
- Sable Squirrel buys millions in expired domains for malware ops
Attackers are increasingly purchasing expired domains to exploit their historical reputation, traffic, and DNS records for illicit activities like malware distribution. In the first half of 2026, nearly 20% of new domain registrations were previously owned,…
Security AffairsSable Squirrel - Malware gang uses fake OnlyFans lures to hit US dental offices
CRPx0 is a malware group that gained attention for its tactic of offering free OnlyFans accounts to entice victims into clicking links that deploy malware. Since launching a leak site on August 7, it has listed 47 victims, primarily targeting dental…
DataBreachesCRPx0 - SAP Commerce Cloud CVE-2026-58231 Exploited in the Wild
A critical vulnerability in SAP Commerce Cloud, tracked as CVE-2026-58231 with a CVSS score of 10.0, is currently being exploited by attackers. This flaw allows unauthenticated users to abuse default authentication methods to execute arbitrary code due to…
Security AffairsCVE-2026-58231 - Apache patches five Struts 2 bugs, warns of remote DoS and leaks
Apache has fixed five vulnerabilities in Struts 2, including three denial-of-service (DoS) flaws and two data leakage issues in the JSON plugin. The DoS flaws allow remote attackers to exploit applications without authentication by sending oversized…
SecurityOnlineCVE-2026-73631 - UK Watchdog Rebukes ACRO Over GDPR Breach After Data Leak
The Information Commissioner reprimanded ACRO Criminal Records Office for violations of UK GDPR Articles 32(1), 32(1)(b), and 32(1)(d) following a cyber incident affecting up to 10,920 individuals. The breaches included multiple incidents of unauthorized…
DataBreaches - Sogang breach leaks 180k data, exPresident Park hit
A cyberattack on Sogang University has exposed personal information of approximately 180,000 students, alumni, and staff. The breach, confirmed by the university, involved the leak of student and staff ID numbers, names, affiliations, email addresses, mobile…
DataBreaches - Ransomware attacks on schools drop as CISA launches defence guide
A recent report indicates a decline in ransomware attacks on K-12 schools for the first half of 2026, while also highlighting ongoing cybersecurity threats targeting educational institutions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)…
DataBreaches - Roundcube fixes critical RCE and SSRF flaws in new update
Roundcube released two critical security updates (versions 1.6.18 and 1.7.3), fixing eleven vulnerabilities including a severe Remote Code Execution (RCE) flaw in a spam-training plugin and Security Server Request Forgery (SSRF) issues. These vulnerabilities…
SecurityOnline - Hackers exploit CVE-2026-65400 to mine Monero on macOS
Hackers are exploiting a critical macOS Screen Sharing vulnerability (CVE-2026-65400) that allows unauthorized access to systems where port 5900 is exposed online. The flaw, confirmed by the Dutch National Cyber Security Centre, enables attackers to gain…
