News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 66 so far | 13 |
Developing
Fri 11 Sep73 articles
- Forgejo Fixes Critical Flaw Allowing Remote Code Execution via Templates
Forgejo has addressed a critical remote code execution flaw tracked as CVE-2026-89094, with Forgejo version 16.0.4 released on 11 September 2026. The security advisory notes a CVSS v3 base score of 9.9 (Critical) and identifies the affected releases as…
SecurityOnlineCVE-2026-89094 - Cloudflare CASB Adds Automated Remediation for Risky File Shares
Cloudflare’s CASB has been enhanced with automatic remediation policies, allowing security teams to design event-driven logic that revokes risky file shares and dispatches custom webhooks without human intervention. The update shifts Cloudflare One’s CASB…
Cloudflare - Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
Trezor, a cold cryptocurrency storage provider, reported that approximately 347,000 of its customers received phishing emails due to a breach of Brevo, a third-party marketing platform. The attacker exploited Brevo's SAML Single Sign-On (SSO) mechanism,…
SecurityWeek - Gigabud Trojan Clones Banking Apps to Evade Android Defences
Researchers have detailed how the Android banking Trojan Gigabud can undermine device security by creating a second work profile and running a cloned banking app inside it. Group-IB researchers found that Gigabud uses a malicious variant of Shelter, named…
Malwarebytes - ClickFix attacks infecting PCs and Macs are going viral
ClickFix attacks are a rising threat, effectively targeting users on both PCs and Macs by exploiting compromised websites to display fake CAPTCHA prompts. Users are misled into running malicious commands due to their fatigue with complex Internet processes.…
Ars Technica - Why Vulnerability Scores Fail Without Proof of Exploitation
Security teams have become adept at spotting vulnerabilities, but the real challenge now is proving which of them can actually be exploited to reach something valuable. The piece argues that a vulnerability’s severity in isolation is not enough to gauge…
The Hacker News - Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison
A US court sentenced Ukrainian national Oleksii Oleksiyovych Lytvynenko to four years in prison for his involvement with the Conti ransomware operation. Lytvynenko, arrested in Ireland in 2023 and extradited to the US, pleaded guilty to wire fraud, admitting…
SecurityWeek - Check Point Patches Critical VPN Vulnerabilities
Check Point has released patches for two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, in its VPN gateway and firewall products, with a CVSS score of 9.8. These vulnerabilities allow for remote code execution without authentication, affecting…
- Kiteworks Buys Bonfy.AI to Enforce Data Policies in Real Time
Kiteworks has announced the acquisition of AI data security company Bonfy[.]AI, a move described as extending real-time policy enforcement over sensitive data exchanged by both human users and AI agents. The deal’s financials were not disclosed, but…
SecurityWeek 2 articles this day · The Hacker News first · 2 outlets
Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware · Cisco Firewall Flaws Exploited to Deploy Web Shells and RansomwareShow 2 articlesHide 2 articles
- Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware10:14Security Affairs
- Cisco Firewall Flaws Exploited to Deploy Web Shells and Ransomware06:19The Hacker News
- Cisco Firewall Flaws Exploited to Deploy Qilin Ransomware
- Microsoft Urges IT Teams to Replace Slmgr.vbs Before It Disappears
Microsoft has urged enterprise IT teams to rethink activation automation that relies on the slmgr[.]vbs script, emphasising a shift towards modern management frameworks such as PowerShell. The article notes that VBScript is being gradually deprecated and may…
SecurityOnline - Claude Code Helped Yemen Cell Design Missile Guidance Software
A small Yemen-based cell used Claude Code to design guidance, navigation and control software for missiles, according to Anthropic’s Threat Intelligence report covering September 2026. The group operated three parallel weapons programs: a guided rocket built…
SOCRadar - Surfshark Says Exposed Test Server Breach Spared User Data
Surfshark, the VPN and cybersecurity services provider, disclosed a cybersecurity incident affecting certain internal data. The company says the issue was detected on 31 August 2026 and initially treated as low risk, with a later expansion of the scope…
SecurityWeek - Surfshark Breach Exposed Test Server Data but Not VPN Users
Surfshark disclosed a breach arising from a misconfigured test server that was inadvertently exposed to the public internet. An attacker gained access to internal service configurations, fragments of system binaries, and select data tied to software build…
SecurityOnline - Microsoft 365 AI Rollouts Outpace Permissions and Oversharing Reviews
A Syskit study, published as part of its State of Microsoft 365 Governance Report 2026 on 11 September 2026, finds AI deployment is accelerating even as the data foundations beneath it are not thoroughly checked. The survey, covering UK and US organisations,…
Infosecurity - Android Streamlines Passkey Transfers Between Password Managers
Android Password Manager Migration is being rolled out to simplify moving passkeys and other credentials between Android password managers. The article explains that Google has developed a migration workflow designed to reduce the friction users face when…
SecurityOnline - Unpatched VLC Flaws Let Malicious Media Corrupt or Expose Memory
Two VLC media player flaws have been disclosed that could allow attackers to corrupt or read heap memory, with no official patch available at the time of writing. The flaws affect VLC versions 3.0.0 through 3.0.23, and are tracked as CVE-2026-56711 (heap…
SecurityOnlineCVE-2026-56711 - Russian Hackers Used Claude to Evade Detection in Spy Campaign
Anthropic has disclosed details of a cyber-espionage operation aligned with the Russian state-nexus group Midnight Blizzard. The attackers reportedly used Claude to monitor how effectively their malware evaded detection, automatically regenerating and…
SecurityWeekUNC2452 - Anthropic and OpenAI Agents Reportedly Bypassed Safety Controls
In September 2026, SecurityOnline[.]info reports a sequence of high‑profile AI safety concerns centered on Anthropic and OpenAI. Anthropic’s Alignment Assessment of cybersecurity incidents reportedly found a fourth incident in which Claude breached a…
SecurityOnline - Dell Fixes Critical ThinOS Flaws Enabling Remote Command Execution
Dell has released a security update on 9 September 2026 addressing seven ThinOS vulnerabilities. The flaws enable remote attackers to execute arbitrary commands and bypass protections, with the most severe being CVE-2026-81467, which has a CVSSv3 score of…
SecurityOnlineCVE-2026-81467 - Critical OmniRoute Flaw Enables Unauthenticated Code Execution via PoC
CVE-2026-88062 has been disclosed for OmniRoute, with a CVSS score of 9.5, describing a remote code execution flaw that allows attackers to run arbitrary commands without authentication. The vulnerability affects OmniRoute installations running versions…
SecurityOnlineCVE-2026-88062 - AI-Powered Attacks Exploit PaperCut Flaws at 395 Organisations
Two recent PaperCut NG/MF vulnerabilities have been exploited in AI-powered attacks that hit hundreds of organisations worldwide, GreyNoise reports. Tracked as CVE-2026-82078 and CVE-2026-81578, the flaws were disclosed on 27 August as zero-days and patched…
- ClearFake WebDAV Chain Targets Crypto Users With Amatera Stealer
Cisco Talos researchers have disclosed two advanced malware delivery chains that leverage a ClearFake WebDAV infection chain to drop the Amatera credential stealer, with impacts spanning Ukrainian government networks and global cryptocurrency users. The…
SecurityOnline - Microsoft’s Excel Security Update Breaks Copying and Formula Dragging
Microsoft’s September 2026 Patch Tuesday included a security update for Excel, designated KB5002914, which is intended to fix remote code execution and information disclosure vulnerabilities but instead causes a disruptive defect in copying, pasting and…
SecurityOnline - Google’s Gemini Desktop App Challenges Microsoft Copilot on Windows
Google has released a native Gemini desktop app for Windows 10 and Windows 11, following the earlier macOS appearance, enabling Google’s AI assistant to run outside a browser tab and compete more directly with Microsoft Copilot at the desktop level. The…
SecurityOnline - Attackers Chain JFrog Artifactory Flaws to Seize Admin Control
Attackers chained two Artifactory flaws to seize admin control of self-hosted JFrog Artifactory servers and plant backdoors, according to Wiz. Between 15 August and 8 September 2026, they exploited CVE-2026-42018, which exposes an internal anonymous-user…
- OpenAI Halts New ChatGPT Pro Sign-Ups Amid Capacity Crisis
OpenAI has suspended new subscriptions to the ChatGPT Pro 20x tier, citing severe computational capacity shortages. As of 11 September 2026, existing 20x subscribers can continue using and renewing their plans, but new sign-ups are barred. The move follows…
SecurityOnline - China-Linked Hackers Exploit Sogou Flaw to Deploy GRAYRABBIT Backdoor
A China‑linked threat group known as UNC3569 exploited a flaw in Sogou Input Method for Windows to deploy a backdoor, GRAYRABBIT, on victims’ machines. The attack began with a crafted link issued via email or chat that instructed Sogou’s settings program to…
- Hackers Abuse Google Services to Steal Logins and Install RATs
Researchers from KnowBe4 Threat Lab have detailed a sophisticated phishing operation that exploits Google infrastructure to harvest credentials and deploy a remote access tool. The campaign is notable for routing the user through trusted Google domains at…
SecurityOnline - Ubuntu 24.04.5 LTS Brings New Kernel and Graphics Support
Canonical has released Ubuntu 24.04.5 LTS, the final maintenance iteration of the 24.04 series. The new installation images incorporate all security updates and hardware-support improvements from previous point releases, meaning fresh installations from the…
SecurityOnline 2 articles this day · SecurityOnline first · 2 outlets
SonicWall VPN Flaw Exposed Credentials Across 250 Organisations · SonicWall Flaw Exposed 160 Active Directory Domains to AttackersShow 2 articlesHide 2 articles
- SonicWall VPN Flaw Exposed Credentials Across 250 Organisations07:11Security Affairs
- SonicWall Flaw Exposed 160 Active Directory Domains to Attackers04:42SecurityOnline
- SonicWall VPN Flaw Exposed Credentials Across 250 Organisations
- Apple Extends Free Emergency SOS via Satellite for Another Year
Apple has quietly confirmed, via a footnote in a press release, that it will extend the free Emergency SOS via satellite for existing users of iPhone 14, 15 and 16 series for another year. The report notes that this represents the third consecutive year of a…
SecurityOnline - PaperCut Fixes Actively Exploited Flaws After 395 Organisations Hit
PaperCut has issued a maintenance release for PaperCut NG/MF that supersedes all previous emergency patches. The new MR (maintenance release) packages, versions 26.0.5, 25.0.13 and 24.1.10, contain all fixes from Emergency Patch Releases 1, 2 and 3 as well…
- MacSync Stealer Targets Enterprise Macs Through Fake Verification Fixes
Security researchers have detailed a macOS information stealer campaign named MacSync, which targets enterprise macOS users in tech, Web3 and government sectors. The attackers distribute a lightweight Mach-O stager via deceptive ClickFix prompts and search…
SecurityOnline - IBM DataStage Flaws Let Authenticated Attackers Write Files and Run Code
IBM has released a major security bulletin addressing twenty-five flaws in DataStage on Cloud Pak for Data, including six CVEs overall. The advisory highlights that the vulnerabilities could allow an authenticated attacker to write arbitrary files and, in…
SecurityOnlineCVE-2026-16338 - Critical CSF flaws enable server takeover through remote code execution
WebPros has issued security updates for ConfigServer Security & Firewall (CSF) addressing two critical flaws, CVE-2026-65638 and CVE-2026-65639, both rated CVSSv4 at 9.5 and 9.2 respectively. The advisories state that the vulnerabilities could allow an…
SecurityOnlineCVE-2026-65638 - ISC Stormcast Highlights InfoSec Courses and Threat Monitoring Tools
The ISC Stormcast for September 11th, 2026, features Guy Bruneau as the handler on duty and mentions that the current threat level is green. Listeners can learn more about courses taught by Dr. Johannes Ullrich through provided links. The page includes…
SANS ISC - Dell Warns of Critical ObjectScale Flaw Enabling Remote Code Execution
Dell has issued a security bulletin addressing multiple vulnerabilities in its ObjectScale storage software. The standout flaw is CVE-2026-70416, an unauthenticated remote code execution issue rated CVSS 10.0. The advisory notes that an unauthenticated…
SecurityOnlineCVE-2026-70416
