News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 15 |
| Today, Thu 29 Oct | 0 so far | 0 |
Developing
Thu 20 Aug85 articles
- Atlassian and Splunk fix over 250 critical flaws in updates
Atlassian and Splunk have recently issued patches for over 250 vulnerabilities across their products, addressing critical and high-severity flaws. Atlassian's update includes fixes for 10 critical and 162 high-severity issues in various products like Bamboo…
SecurityWeek 2 articles this day · Security Affairs first · 2 outlets
MLflow SSRF flaw leaks secrets, CISA urges immediate patch · SSRF bug in MLflow (CVE-2026-64849) exposes cloud secretsShow 2 articlesHide 2 articles
- MLflow SSRF flaw leaks secrets, CISA urges immediate patch12:05SecurityWeek
- SSRF bug in MLflow (CVE-2026-64849) exposes cloud secrets08:55Security Affairs
- MLflow SSRF flaw leaks secrets, CISA urges immediate patch
- Zombie Card flaw lets expired Visa cards work contactless again
The article discusses the 'Zombie Card Attack,' a cybersecurity vulnerability that allows expired Visa cards to be reactivated for contactless payments. It examines how hackers can exploit this flaw, emphasizing the urgency for financial institutions to…
The Hacker News - ClarityCheck leaks millions of personal photos online
A researcher discovered a cloud database containing over 9 million unsecured images of people's faces, traced to ClarityCheck, a US company. Despite ClarityCheck's claim of not using facial recognition, its services identify individuals through reverse image…
Malwarebytes - Using PowerShell with Microsoft Graph to purge M365 accounts
Rob VandenBrink's article discusses the use of Microsoft Graph and PowerShell to manage and gather information on stale accounts and licenses within M365 environments. It highlights the functionalities of Microsoft Graph, particularly in listing user…
SANS ISC - Cisco patches 15 flaws, including four critical Crosswork bugs
Cisco recently announced patches for 15 vulnerabilities across its products, including critical flaws in Crosswork and Secure Workload, with four vulnerabilities rated as CVSS 10/10 and one at 9.9/10. Key issues include SQL injection, authentication…
SecurityWeek - Cyber Leaders Warn of Governance Gap as 'Shady AI' Threats Rise
The article discusses the impending governance challenges associated with 'shady AI' technologies in the cybersecurity landscape, emphasizing the potential security threats posed by AI applications. It highlights that traditional security frameworks may…
The Hacker News - CDN Tsunami Attack Uses HTTP/3 for 350× DoS Amplification
The article discusses a significant security vulnerability linked to a new Denial-of-Service (DoS) attack named the CDN Tsunami Attack, which exploits HTTP/3 translation. This vulnerability can amplify the attacks by up to 350 times, making it critical for…
The Hacker News - Manic Android malware steals data using nearby infected phones
The article discusses a newly discovered Android malware known as Manic, which is capable of exfiltrating data from offline devices by utilizing nearby infected devices. This spyware targets user data without needing an internet connection, raising…
The Hacker News - AI-Assisted Tool Helped Secure Satellite Communication System After 2022 Russian Hacking
The article discusses the launch of Atalanta's new AI-assisted cybersecurity tool, "Argo," designed to enhance the resilience of satellite communications networks like Viasat's, which suffered a hacking attack during Russia's invasion of Ukraine in 2022.…
SecurityWeek - NASA AIT GUI bug lets hackers send commands to spacecraft
The article discusses critical vulnerabilities in NASA's AIT-GUI, which allow unauthenticated attackers to issue commands to spacecraft. It highlights the potential risks to critical infrastructure due to these security flaws and emphasizes the need for…
The Hacker News - AI Powered Attacks Target Siemens S7 PLCs in Water, Energy
Industrial control system (ICS) operators are warned about AI-driven attacks specifically targeting Siemens S7 Series programmable logic controllers (PLCs). Threat actors are leveraging AI to create exploitation scripts and compromise operational technology…
Infosecurity - ToxicPanda 2.0 and GoldDigger raise Android banking fraud fears
The article discusses the expansion of Android banking malware, focusing on two threats: ToxicPanda 2.0 and GoldDigger. These types of malware enhance their on-device fraud capabilities, posing significant risks to mobile security. Various cybersecurity…
The Hacker News - OpenAI boosts AI security with new containment monitoring rules
OpenAI has introduced new security protocols for its AI models, implementing stricter containment and monitoring measures in response to recent incidents highlighting vulnerabilities. The updated system includes enhanced sandboxes for executing untrusted…
SecurityWeek - Hackers exploit trusted chat apps to steal enterprise identities
The article discusses the growing threat of identity abuse through trusted communication channels within enterprise collaboration platforms. It highlights how organizations have shifted towards cloud-based collaboration tools, which threat actors exploit…
Unit 42 - Android Trojan ToxicPanda 2.0 now hits 140 apps, 349 banks
A new variant of the Android banking Trojan, named ToxicPanda 2.0, has been identified, significantly increasing its target range to 140 banking and cryptocurrency apps and an overlay mechanism for 349 financial institutions. Discovered by Zimperium's zLabs,…
Infosecurity - Typosquatted dependency hijacks Rust crate arrayref
A security incident involving the Rust crate `arrayref` version 0.3.10 has been reported, where a compromised release introduced a malicious dependency on a typosquatted `proc-macro1` crate. During building, this crate executes a remote payload from a…
StepSecurity - Def Con Attendees Targeted by Persistent Phishing Campaign
A phishing campaign has targeted attendees of cybersecurity conferences such as Black Hat and Def Con, as reported by Huntress. A researcher was contacted via X, impersonating a CoinDesk official, and was sent deceptive Google Docs that requested an…
Infosecurity - Fake Firefox Web3 Extensions Found Stealing Crypto Wallet Secrets
The article discusses the discovery of 40 malicious Firefox extensions masquerading as legitimate Web3 products, aimed at stealing users' cryptocurrency wallet secrets. It emphasizes the importance of browser security and the need for vigilance in the face…
The Hacker News - US Indicts 17 Iranian Hackers Over 31TB University Data Theft
The US has indicted 17 members of the Mabna Institute, an Iranian cyber espionage group, for a hacking campaign that lasted several years, stealing 31TB of data from universities, businesses, and government agencies worldwide. The group, tied to Iran's…
Security AffairsSilent Librarian - Citrix fixes NetScaler auth bypass flaw CVE-2026-19490
Citrix has released patches for two vulnerabilities in its NetScaler ADC and NetScaler Gateway, one of which (CVE-2026-19490) is a critical authentication bypass issue with a CVSS score of 9.3. This flaw allows remote attackers to exploit the system without…
- Jewelbug APT uses fake updates to spy on governments
A cyber espionage campaign attributed to the Jewelbug APT group, suspected to be based in China, has been uncovered by the Threat Hunter Team. The group conducts both espionage against Middle Eastern and Asian government sectors and cryptocurrency fraud by…
SecurityOnlineREF7707 - GitLab Flaw CVE-2026-19478 Exploited in Days, Urges Patch
A critical-severity vulnerability in GitLab (CVE-2026-19478) has been exploited within two days of its disclosure, allowing unauthenticated attackers to remotely modify or delete public projects and user data. The flaw, which has a CVSS score of 9.4, was…
SecurityWeekCVE-2026-19478 - StopAndProtect turns 2,000 hacked WordPress sites into malware hubs
StopAndProtect is a cybercrime operation identified by Check Point Research that has transformed nearly 2,000 hacked WordPress websites into a platform for malware distribution, data theft, and ransomware. The operation began in May 2026 and uses a deceptive…
Security Affairs - Hackers Using AI to Target Siemens PLCs in Critical US Sectors
A joint cybersecurity advisory from multiple U.S. government agencies, including NSA, CISA, and FBI, warns critical infrastructure organizations about hacker attacks targeting Siemens programmable logic controllers (PLCs). The attackers, potentially using…
SecurityWeek - Chinese linked JWR phishing kit targets Shopify, PayPal via SMS
Cisco Talos has identified a new phishing framework called JWR, operated by suspected Chinese-speaking cybercriminals. This tool, labeled as "Phishing-as-a-Service (PhaaS)", allows real-time monitoring of victims through deceptive login pages targeting…
SecurityOnline - Evooo1Bot Linux Botnet Hijacks Routers via SSH Brute Force
The report discusses the Evooo1Bot Linux botnet, which utilizes a DDoS engine derived from Mirai and targets various internet-facing devices such as routers and IP cameras. The malware exploits known vulnerabilities and employs tactics like SSH brute force…
SecurityOnline - Critical Elementor Pro flaw lets hackers upload and run PHP code
The article discusses a security vulnerability in Elementor Pro that allows unauthenticated attackers to upload PHP files and execute code, posing a significant web security risk. The vulnerability highlights the importance of ensuring proper authentication…
The Hacker News - Splunk patches critical RCE flaw in MCP Server app, urges updates
Splunk has addressed 17 vulnerabilities across its apps and add-ons, with the most severe being CVE-2026-76404, a critical remote code execution flaw in the MCP Server app, scoring 9.1 on the CVSS scale. None of the vulnerabilities have been confirmed to be…
SecurityOnlineCVE-2026-76404 - Google gives US college students a free year of AI Pro access
Google is offering eligible college students in the U.S. a free year of Google AI Pro, normally $19.99/month, which includes enhanced access to Google Gemini and 5TB of storage. International students will receive Google AI Plus with similar benefits.…
SecurityOnline - Microsoft Defender update flaw halts scans at 99%
**Critical Alert on Microsoft Defender:** A flaw in a recent update caused Microsoft Defender to fail during scans, stopping at 99%. Microsoft acknowledged the issue, stating it was not a malware attack but due to a defective update. They have released a…
SecurityOnline - Splunk patches 60 flaws, three critical CVSS 9.4 bugs expose data
On August 19, 2026, Splunk resolved 60 vulnerabilities within its Splunk Enterprise software, with three critical flaws assigned a CVSS score of 9.4. These vulnerabilities allow unauthenticated users to access sensitive data and affect system integrity. No…
SecurityOnline - CVE-2026-70496 & CVE-2026-66794: Privilege Escalation in Red Hat ACM Hits CVSS 9.9
Red Hat has disclosed three high-severity vulnerabilities in its Advanced Cluster Management and Multicluster Engine for Kubernetes. The most critical, CVE-2026-70496, has a CVSS score of 9.9 and allows for Kubernetes privilege escalation to cluster-admin…
SecurityOnlineCVE-2026-70496 - Zimbra flaw (CVE-2026-73570) lets attackers run arbitrary code
A critical vulnerability, CVE-2026-73570, affecting Zimbra Collaboration versions prior to 10.1.20 has been actively exploited, according to CERT Polska. The flaw has a CVSS score of 8.9 and allows unauthenticated remote code execution (RCE) due to improper…
- CVE-2026-20030: Cisco Crosswork SQL Command Injection Scores CVSS 10.0
Cisco has addressed a critical SQL injection vulnerability (CVE-2026-20030) in its Crosswork platform, rated 10.0 on the CVSS scale, alongside three other critical vulnerabilities, maintaining an overall status of no confirmed exploitation. The…
SecurityOnlineCVE-2026-20030 - Splunk patches AI Toolkit OS command injection flaw CVE-2026-20266
Splunk has patched a critical OS command injection vulnerability in its AI Toolkit, identified as CVE-2026-20266, which has a CVSS score of 9.1. This flaw allows an admin user to execute arbitrary commands on the host system. Alongside this, four additional…
SecurityOnlineCVE-2026-20266 - CVE-2026-20315 & CVE-2026-20317: Cisco Secure Workload Auth Bypass, Privilege Escalation Hit CVSS 10
Cisco has released security hardening updates for the Secure Workload product on August 19, 2026, addressing multiple vulnerabilities, including two critical flaws rated CVSS 10 (CVE-2026-20315 and CVE-2026-20317). These vulnerabilities involve improper…
SecurityOnlineCVE-2026-20315 - ISC Daily Update: Green Threat Level, New Podcast and SANS Tips
The content provides an update from the ISC (Internet Storm Center) for August 20, 2026, noting that Rob VandenBrink is the handler on duty and the current threat level is green. It also mentions a link to a podcast episode related to the day's updates.…
SANS ISC - CVE-2026-47627: CVSS 9.8 Denial of Service Hits NVIDIA Triton
NVIDIA has patched a critical vulnerability in the Triton Inference Server, identified as CVE-2026-47627, with a CVSS score of 9.8, indicating a severe denial of service risk. The flaw allows remote, unauthenticated attackers to exploit it without any user…
SecurityOnlineCVE-2026-47627
