News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 93 | 18 |
| Today, Wed 28 Oct | 0 so far | 0 |
Developing
Tue 8 Sep82 articles
- Google Finds Hackers Automating Credential Theft With AI Agents
Google Threat Intelligence Group (GTIG) says adversaries increasingly moved from simple prompting to agentic AI workflows and automated attack pipelines during the second quarter of 2026. In one Mandiant investigation, a suspected financially motivated actor…
Google Cloud - Cloudflare Cuts TLS Delays by Learning Each Origin’s Key Support
Cloudflare has rolled out Automatic Key Exchange, an extension of its Automatic SSL/TLS system, to optimise origin handshakes in TLS 1.3 by learning which key-exchange algorithms each origin supports and prefers. Instead of always guessing X25519, Cloudflare…
Cloudflare - Outsider Phishing Kit Resurfaces After Global Law Enforcement Takedown
The Outsider Phishing Kit, a PhaaS platform linked to the threat actor “ChenLun,” has again demonstrated its reach despite a high-profile law-enforcement disruption. Researchers describe a sizeable operation that used smishing to lure mobile users to fake…
SecurityOnlineChenLun - ChatGPT Sandbox Flaw Let Attackers Steal Data Through Hidden Tasks
Checkpoint Research uncovered a covert cross-account data leakage channel inside ChatGPT’s sandboxed environment. By abusing a shared internal service used for delivering software packages, attackers could instruct a victim’s ChatGPT session to perform…
Check Point - Grindr Agrees £26m Settlement Over Alleged Privacy Breaches
Grindr has agreed to pay £26 million to settle a UK group action over claims it unlawfully processed users’ personal data and misused private information before 2020. The settlement was reached on 2 September 2026 and disclosed to investors in a filing with…
Infosecurity - Crypto Thieves Stole $240 Million Through Google and Gemini Scams
A high‑profile cryptocurrency theft, carried out in August 2024, resulted in more than 4100 bitcoin being stolen, worth over $240 million at the time, with the perpetrators attempting to launder the proceeds through multiple exchange platforms. The case…
SecurityWeek - Grindr Agrees to £26m UK Settlement Over Sensitive Data Sharing
Grindr has agreed to settle a UK privacy lawsuit for £26 million (around $35 million), after claims that it shared highly sensitive user data with advertisers without proper consent. The action, brought on behalf of about 12,000 UK Grindr users, relates to…
Malwarebytes - Reflectiz Unveils AI Pentesting Platform for Wider Web Coverage
Reflectiz has unveiled a new agentic pentesting platform for websites, pitched as delivering up to ten times more coverage than traditional pentests. The approach uses a coordinated team of specialised AI agents that start from a live, existing model of each…
SecurityOnline - Google Warns AI Coding Tools Fuel Software Supply Chain Attacks
Google Threat Intelligence Group (GTIG) warns that AI-assisted coding tools have become a prime target for threat actors, contributing to several large-scale software supply chain compromises in 2025 and early 2026. The rise of large language models in…
InfosecurityUNC6508 - WeChat Bug Let Attackers Hijack Accounts Through Silent Calls
Researchers at security firm Calif demonstrated a zero-click worm capable of taking over a WeChat account via an incoming call, without the target needing to answer or interact with their device. In a three-phone demonstration, an Android device called an…
The Hacker News - Chainguard Doubles Container Builds with AI-Powered Security Automation
Chainguard has disclosed that its Chainguard Factory has surpassed 1 billion container build manifests in six months, up from 500 million, with more than 3,000 unique container images and 675,000 image versions in its catalog. A build manifest, as defined by…
The Hacker News - FBI Arrests Alleged Ringleader in $240 Million Bitcoin Heist
The article reports that a network of young men pulled off one of the largest cryptocurrency thefts in U.S. history, duping a stranger out of bitcoin worth more than $240 million. The August 2024 incident involved a sophisticated scheme to launder the…
DataBreaches - FreeIPA Flaws Let Anonymous Attackers Create Administrator Credentials
A chain of vulnerabilities in FreeIPA and the underlying 389 Directory Server could let an anonymous client create a Kerberos identity and gain administrator-like credentials on a default install. Red Hat says CVE-2026-76578, a critical flaw in FreeIPA, can…
The Hacker NewsCVE-2026-76578 2 articles this day · Malwarebytes first · 2 outlets
MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain · MikroTik Routers Face Takeover Risk From Active MikroTrick AttacksShow 2 articlesHide 2 articles
- MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain11:15SecurityWeekExploited
- MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks09:49MalwarebytesExploited
- MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain
- THost9 RAT Worm Spreads by Scanning Exposed Android ADB Services
A packed Android remote access trojan (RAT) known as THost9 has combined a concealed loader with a worm that scans for exposed Android Debug Bridge (ADB) services and installs itself on reachable devices. Dark Atlas described the malware’s structure, with…
Infosecurity - Vietnam-Linked APIS Database Exposed 220 Million Travel Records
Kinryū Labs disclosed a publicly exposed Advance Passenger Information System (APIS) database linked to Vietnam that contained about 220.8 million passenger and crew records dating from January 2017 to April 2026. The dataset includes sensitive details such…
Security Affairs - N-able N-central Flaws Let Attackers Create Admin Accounts Remotely
Rapid7 has disclosed two authentication bypass vulnerabilities in N-able N-central, tracked as CVE-2026-86206 (Semicolon/Forwarded access-control bypass) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass). When chained, these flaws could let a…
Rapid7CVE-2026-86206 - Mathspace Breach Exposes Data of 1 Million After Metabase Flaw
Mathspace disclosed a data breach affecting over 1 million individuals after hackers compromised a self-hosted Metabase instance that served its reporting database. The intrusion was detected last week, reportedly about three weeks after the vulnerability…
- N-able Patches Exploited N-central Zero-Day Allowing Server Takeover
N-able has rolled out an urgent fix for an unauthenticated remote code execution vulnerability in its N-central endpoint management platform, tracked as CVE-2026-86218, which security researchers describe as a zero-day that had been exploited. The flaw…
- BigBear 2.0 Phishing Service Steals 5,100 Microsoft 365 Credentials
Security researchers have uncovered a new phishing‑as‑a‑service operation dubbed BigBear 2.0, built on the Evilginx2 adversary‑in‑the‑middle framework. CloudSEK says the operation has already exfiltrated more than 5,100 Microsoft 365 credential records from…
InfosecurityBigBear 2.0 - Adobe Patches Actively Exploited Magento Flaw Enabling Server Takeover
Adobe has released security patches for Adobe Commerce and Magento Open Source to fix a critical, actively exploited vulnerability tracked as CVE-2026-75650 (CVSS 10.0), codenamed StyleSmuggler by Sansec. Exploitation in the wild began around 4 September…
- North Korean Hackers Hide HAProxy Backdoor in South Korean Networks
North Korea‑linked threat actors have concealed a backdoor inside the HAProxy load balancer, affecting edge devices in two South Korean networks. Rapid7’s analysis describes a Linux toolkit, dubbed the ted backdoor by researchers, that is not a separate…
Security Affairs - Trezor Data Breach Expands by 67,000 After ShipMonk Exposure
Trezor has disclosed that a breach at its shipping partner, ShipMonk, has expanded the scope of affected customers well beyond initial estimates. An update dated 4 September 2026 confirms that data stolen from ShipMonk also encompassed order data from…
Infosecurity - BengalSEO Hijacks Bing Results to Deliver MayaBot Malware and Scams
Cybersecurity researchers have disclosed a large-scale SEO poisoning operation aimed at hijacking Bing search results to push malware payloads and tech-support scams. The operation, named BengalSEO and traced to Rajasthan, India, has been active since at…
The Hacker News - Phantom Deal Scam Posed as Executives to Steal €626,735.45
Cybersecurity researchers at Gen Digital have uncovered an executive impersonation scam dubbed the Phantom Deal campaign. The operation targeted corporate legal, finance, and M&A executives by posing as company leaders and trusted advisers to manufacture a…
SecurityOnline - SAP Patches Critical EPP Flaw Exposing Systems to Memory Corruption
On 8 September 2026 SAP released 19 security notes and one update as part of its monthly Patch Day, addressing several high‑severity flaws across Extended Passport Processing, NetWeaver, and Cloud Application Programming. The advisory flags five CVEs in…
SecurityOnlineCVE-2026-44756 - Fake IT Support Calls Let Attackers Hijack Microsoft 365 Sessions
Attackers are bypassing endpoint security by calling victims and impersonating internal IT help desk staff, directing executives to rogue authentication portals. The campaign, tracked as PREY-0058, focuses on Microsoft 365 and SaaS environments, where…
Security Affairs - Microsoft Teams Phishing Attack Uses Node.js Implant to Reach Domain Controllers
Microsoft Teams is being abused in a phishing-driven intrusion campaign in which an actor poses as internal IT support in external tenant messages or calls. Victims grant a remote session, after which a silent MSI installer is delivered and executed,…
SecurityOnline - Grindr Agrees £26m Settlement Over Sharing Users’ HIV Data
Grindr has agreed to pay £26 million to settle a UK class-action alleging the dating app shared users’ personal data, including HIV status and last tested dates, with third parties for commercial purposes. The settlement, disclosed in a U.S. Securities and…
The Hacker News - Chinese Hackers Hijack Brazilian Government Sites to Push Betting Scams
Security researchers have traced a broad operation, attributed with medium-to-high confidence to Gambling Goblin, a Chinese-speaking actor linked to Earth Berberoka, that target Brazilian federal, state and municipal government websites. The campaign begins…
SecurityOnlineGambling Goblin - ASUS Fixes Flaw Letting Nearby Users Control Active Sessions
ASUS has released security updates for Control Center Express and Armoury Crate on 8 September 2026 to fix a range of flaws. The most serious is CVE-2026-19397, a missing-authentication vulnerability in the Control Center Express Agent that could allow an…
SecurityOnlineCVE-2026-19397 - Linux Kernel Flaw Lets Local Users Gain Root Through RDS PoC
Security researchers have publicly disclosed a high‑severity local privilege escalation in the Linux kernel, tracked as CVE-2026-43502, arising from the RDS network protocol’s zerocopy send path. The flaw, nicknamed ZcopyReaper, allows an unprivileged local…
SecurityOnlineCVE-2026-43502 - Liquid Network Hack Drains $320 Million as Attacker Returns Bitcoin
The Liquid Network, a Bitcoin sidechain, suffered a major security incident that led to a full suspension of its services. An attacker, presenting as a white-hat researcher, exploited a fundamental flaw in the network’s software and illicitly moved 4,000…
SecurityOnline - Windows 11 Tests an iOS-Style Widget for Connected Device Batteries
Microsoft is piloting a new battery and peripheral widget for Windows 11, uncovered in a preview build and reported by outlets citing a Discord user. The feature, still in development, is expected to provide a consolidated view of power levels and connection…
SecurityOnline - Pegasus Zero Click Attack Targets Serbian Student Activist Before Election
Citizen Lab and the SHARE Foundation confirmed a Pegasus spyware infection on the iPhone of a Serbian student activist, detected following an Apple Threat Notification in early September 2026. The interview and forensic work indicate the Pegasus deployment…
SecurityOnline - ISC Stormcast For Tuesday, September 8th, 2026 https://isc.sans.edu/podcastdetail/10084, (Tue, Sep 8th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
SANS ISC - SonicWall SMA Flaws Let Attackers Gain Root Access in the Wild
Two newly disclosed vulnerabilities in SonicWall SMA 1000 devices are reported to be exploited in the wild, enabling attackers to chain three flaws for remote code execution. The security write-up identifies two CVEs, CVE-2026-83548 and CVE-2026-83549, both…
- JetBrains Patches Critical Hub and YouTrack Flaws Enabling Takeover
JetBrains has disclosed a batch of 29 security flaws across its Hub and YouTrack offerings, together with related issues in accompanying tooling. The round-up lists six CVEs across the affected products, with two rated as critical. CVSS v3 scores for the…
SecurityOnlineCVE-2026-86478 - Attackers Abuse Node.js to Evade Defences and Plant Ransomware Footholds
Attackers are exploiting the Node[.]js runtime to slip past endpoint defenses across global corporate networks, with multiple campaigns observed since February 2026. The Symantec Threat Hunter Team and Zscaler outline that technology firms, hotels and…
SecurityOnline
