News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 75 | 20 |
| Today, Tue 27 Oct | 89 so far | 17 |
Developing
Wed 9 Sep83 articles
- Microsoft Maps Cloud App Attack Paths in New Threat Matrix
Microsoft has introduced the Cloud web applications threat matrix, a MITRE ATT&CK-aligned framework designed to help defenders understand, prioritise, and mitigate threats to cloud-hosted web apps and serverless platforms. The matrix maps techniques across…
Microsoft - AI Finds Thousands of Flaws, but Humans Patch Fewer Than 1%
A new analysis of public data from Anthropic’s Project Glasswing shows a widening gap between AI-generated vulnerability findings and those that actually reach disclosure or remediation. The Claude Mythos model produced 26,153 findings across various…
Dark Reading 3 articles this day · SecurityOnline first · 3 outlets
BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws · Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on WindowsShow 3 articlesHide 3 articles
- BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws20:55Ars Technica
- Chrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows16:34The Hacker News
- Chinese-Linked Spies Exploit Chrome and Windows Zero-Days11:42SecurityOnline
- BlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws
- US Agencies Warn Chinese AI Firms Stole Billions of Model Tokens
United States government agencies have alleged that several Chinese AI firms conducted “industrial-scale” distillation campaigns to extract and repurpose proprietary capabilities from leading US frontier models. In a joint advisory published on 8 September…
Dark Reading - US Disrupts Xinbi Scam Marketplace and Freezes $52 Million
The U.S. Department of Justice has disrupted Xinbi Guarantee, an illicit Telegram‑marketplace for scam services, seizing control channels and freezing funds as part of its Scam Center Strike Force operations. In coordinated action, DoJ also drained two Xinbi…
The Hacker News - US Agencies Accuse Six Chinese AI Firms of Model Distillation
US federal agencies have published an advisory alleging that six Chinese AI firms have conducted industrial-scale extraction campaigns against US frontier models to accelerate their own development. The joint alert from the NSA, CISA and the FBI names…
Security Affairs - Attackers Scan Obsolete Proxmox VE 7 Servers for API Access
The ISC note reports that Proxmox has published an advisory about a vulnerability in older Proxmox VE versions, specifically affecting the Proxmox VE 7 line, which has not been supported for several years. According to the diary, the issue has drawn…
SANS ISC - Microsoft Exposes Passkey Bait Campaign Targeting Microsoft 365 Data
Microsoft Security Research outlines a multi-stage cloud intrusion campaign that begins with passkey-themed social engineering and culminates in identity compromise, persistence, reconnaissance, and targeted data exfiltration across Microsoft 365 workloads.…
Microsoft - HelmGuard Raises $7.3 Million to Expand AI Risk Platform in the US
HelmGuard, a UK-based startup focused on agentic governance, risk and compliance (GRC) and security, has raised $7.3 million in a seed round. The funding was co-led by Infinity Ventures and Frontline, with additional participation from FinTech Collective,…
SecurityWeek - Hackers Use Fake IT Calls to Hijack Microsoft 365 Accounts
Hackers are targeting senior Microsoft 365 accounts with highly tailored vishing campaigns that mimic internal IT helpdesk calls. The PREY-0058 operation, which aligns with UNC6671/BlackFile in some threat intelligence, starts with a phone call to executives…
SecurityOnlinePREY-0058 - Palo Alto Firewalls Exposed to Root Code Execution Flaw in PAN-OS
On 9 September 2026, Palo Alto Networks disclosed a high-severity vulnerability in PAN-OS (CVE-2026-0310) that could allow unauthenticated remote attackers to execute arbitrary code with root privileges or cause a denial of service. The flaw resides in the…
SecurityOnlineCVE-2026-0310 - Google Warns AI Is Giving Hackers Nation State Level Reach
Google’s Threat Intelligence Group (GTIG) warns that AI is increasingly enabling attackers with lesser resources to operate at “nation-state-level” reach. The piece describes a shift from basic prompt injection into enterprise AI systems to the development…
SecurityWeek - Google Patches 180 Android Flaws, Including Critical Wi-Fi RCE
Google’s September 2026 Android security updates patch a total of 180 vulnerabilities across multiple components, with the rollout split into two patch levels. The first part, 2026-09-01, addresses 95 defects across Android runtime, Framework, System, Setup…
SecurityWeekCVE-2026-28662 - Cisco Warns Attackers Are Exploiting Critical FMC Flaws for Root Access
Cisco Talos researchers say two critical flaws in Cisco Secure Firewall Management Center (FMC) are being actively exploited in the wild. The vulnerabilities are CVE-2026-20079, an authentication bypass in the FMC web interface, and CVE-2026-20316, a flaw…
- AMD, Arm and Nvidia Patch GPU Flaws Threatening Linux Systems
Chipmaker Patch Tuesday brought a trio of security advisories from AMD, Arm and Nvidia, detailing fixes for recently disclosed flaws across their graphics and compute products. AMD’s advisory addresses CVE-2026-43603, a NULL pointer dereference in the Linux…
SecurityWeekCVE-2026-43603 - GnuTLS CI Leak Exposed GitLab Token With Owner Access to 55 Projects
Truffle Security researchers detected a critical token leak tied to GnuTLS in June 2026, exposing a GitLab personal access token used by a public CI artifact. The token carried api scope and Owner privileges across 55 open‑source projects, including GnuTLS,…
SecurityOnline - Credentialed Port Discovery Reveals Hidden Services Behind Firewalls
Credentialed pre-port discovery lets a scan engine skip outside-in probing and instead ask the host which ports it is listening on, provided the engine already has valid credentials for that host. Where a credential matches, the engine connects to the port…
Rapid7 - Fake Shops Target 44,000 Brands in Vast DoppelCart Network
Researchers from Nebty have identified a vast network of fake online shops branded as “DoppelCart.” The cluster comprises almost 119,000 domains, with 118,787 of them using the .shop top‑level domain, amounting to about 2.72% of the .shop population they…
Malwarebytes - WeChat Zero Click Worm Can Hijack iPhones and Android Devices
A team of researchers at Calif, a Palo Alto-based cybersecurity startup, says it has built a tool capable of hacking Android and iPhone devices via a simple incoming call. The exploit, named WeWorm, hinges on a remote code execution (RCE) flaw in WeChat’s…
Infosecurity - AI Workflows Let Attackers Hijack Privileged Actions Through Benign Requests
Security researchers have identified a new AI-driven attack flow dubbed “workflow identity hijacking,” which exploits an authorisation design flaw in modern enterprise AI pipelines. The gist is that threat actors can bypass standard security controls by…
Dark Reading - Check Point Patches Critical VPN Flaws Enabling Remote Code Execution
Check Point has issued emergency security updates on 9 September 2026 to fix two critical VPN flaws in the Quantum Security Gateway line. The vulnerabilities, CVE-2026-85102 and CVE-2026-85103, are rated CVSS v3.1 at 9.8 (Critical) and could allow…
- Fortinet Patches Critical Flaws Enabling JWT Bypass and Traffic Hijacking
Fortinet has released patches for ten vulnerabilities across its product line, including two critical flaws. The most severe is CVE-2026-84390, a source-code information exposure affecting the FortiMonitorOnSight web portal. Fortinet says a remote,…
SecurityWeekCVE-2026-84390 - Gigabud Trojan Hides Banking Fraud Inside Android Work Profiles
The Android banking trojan Gigabud has been enhanced to clone banking apps into a separate Android work profile, enabling fraudsters to dissociate a malware alert from subsequent transactions. Group-IB’s research, published on 9 September 2026, ties Gigabud…
InfosecurityGoldFactory - Infostealer Logs Expose Thousands of Reusable AI Session Tokens
Threat researchers and identity security firms have warned that infostealer logs harvested from popular stealer families such as Lumma Stealer and Vidar contain a trove of credentials, session tokens and API keys that can be replayed to access AI services…
The Hacker News - Google Patches Chrome’s Seventh Zero Day of 2026 Under Attack
Google has released a Chrome update to address a string of actively exploited vulnerabilities in 2026, including the seventh zero-day cased in the wild. The standout flaw is CVE-2026-87491, an out-of-bounds write in the V8 engine with a CVSS score of 8.8,…
- ClickFix Campaign Hijacks Crypto Trades Through Malicious Browser Scripts
A campaign named ClickFix has moved from tricking users into running commands on their computers to convincing them to inject malicious JavaScript into their own browsers, with the aim of fraud in the cryptocurrency sector. Cisco Talos researchers published…
Infosecurity - Cloudflare Rebuilds Workers’ Node.js Module Loading for Speed
Cloudflare has rebuilt the Node[.]js compatibility story for its Workers runtime by overhauling the module registry inside workerd, the core open‑source component of Workers. The aim is to make module loading faster, more standards‑compliant, and better…
Cloudflare - Compromised AI Agents and API Keys Now Lead Enterprise Intrusions
A new SpyCloud study claims that compromised non-human identities (NHIs), including AI agents, service accounts, API keys and authentication tokens, are now the number one entry point for hackers into enterprises. Based on a survey of 750 cybersecurity…
Infosecurity - US agencies warn Chinese AI firms are distilling frontier models at scale
The NSA, CISA and FBI warn that Chinese AI firms are systematically “distilling” outputs from US frontier AI models to train their own systems. In a report cited by the agencies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z[.]AI are said to have…
SecurityWeek - New Jersey School District Network Outage Linked to Ransomware Attack
Westfield Public Schools in New Jersey experienced a district-wide network outage during the first week of the new school year, initially attributed to equipment failure before officials said the cause remained under investigation. The district later…
DataBreachesInc - Russian Web Developer Extradited to US Over Bank Account Takeovers
A Russian web developer, Sergei Anatolyevich Filimonov, 36, has been extradited from Georgia to the United States to face an indictment in a bank account takeover scheme. He appeared in a federal court in Atlanta on 4 September and has pleaded not guilty to…
DataBreaches - SpyCloud Report Finds Non-Human Identities Lead Enterprise Attacks
SpyCloud has released its 2026 Identity Threat Report, which finds that non-human identities (NHIs) — including AI agents, service accounts, API keys and authentication tokens — are now the leading route into the modern enterprise. In the survey of 750…
SecurityOnline - Meta Unveils Muse AI Agent to Handle Users’ Everyday Tasks
Meta has rolled out Muse, a personal AI agent aimed at helping adults with day-to-day tasks such as scheduling, shopping, and long-term planning. The service is currently US-only and requires users to be 18 or older. Muse runs on a dedicated, secure virtual…
SecurityWeek - Tines Shows How Security Teams Can Cut CVE Response Times
The Hacker News reports on a forthcoming expert webinar hosted by the Tines security team, framed around the challenge security operations teams face when a new CVE appears. The session, titled Outpacing AI-Era Attacks Starts With Faster Time to Answer,…
The Hacker News - DeepSeek AI Coding Agent Flaw Let Attackers Disable Its Sandbox
A vulnerability in DeepSeek Harness allowed a sandboxed AI coding agent to disable its own sandbox without an extra approval prompt. The flaw arose because the tool’s local web interface, which the agent can reach from inside its environment, did not require…
The Hacker NewsCVE-2026-82533 - ICS Patch Tuesday Fixes Critical Schneider, Siemens Flaws
Schneider Electric’s September 2026 Patch Tuesday advisory batch centres on its ICS portfolio, with four new advisories and updates to four others. The most critical flaw is an authentication vulnerability in the Modicon M580 and Modicon M580 Safety…
- Alby Lightning Wallet Flaw Put Internet-Facing Hubs at Risk
Alby has disclosed a critical flaw in its Alby Hub self-hosted Lightning Wallet service that could have allowed an attacker to take over a wallet and siphon funds, but only if the Hub was exposed to the internet. The vulnerability affects Hub versions 1.7.0…
The Hacker News - Ivanti Patches Critical Flaws Enabling Remote Code Execution
Ivanti has released security updates across three enterprise products—Neurons for ITSM, Sentry and Endpoint Manager Mobile (EPMM)—to address a set of critical and high-severity flaws. Neurons for ITSM accounts for the bulk of the fixes, with eight identified…
SecurityWeekCVE-2026-12645
