News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 66 so far | 13 |
Developing
Sun 13 Sep10 articles
- Phishing Attackers Target Microsoft Cloud Passkeys to Steal Data
The article discusses a new phishing technique used by attackers to hijack Microsoft cloud accounts and access sensitive data. This method involves deceiving users into providing passkeys, which are essential for secure access. Key points include: 1.…
The Hacker News - Conti Ransomware Developer Sentenced After Irish Arrest and Extradition
Ukrainian national Oleksii Oleksiyovych Lytvynenko, 44, has been sentenced to four years in a US prison for conspiracy to commit wire fraud linked to the Conti ransomware operation. The US Department of Justice said Conti was used between 2020 and 2022…
Security AffairsConti
Sat 12 Sep12 articles
- Google Exposed Sex Crime Victims’ Removal Requests Worldwide
Google reportedly exposed identifying information from victims’ requests to remove illegally obtained sexual images, affecting people in multiple countries rather than only South Korea. The Hankyoreh confirmed that requests written in English, Japanese,…
DataBreaches - New York DFS Urges Annual Cyber Risk Reviews After Major Changes
New York’s Department of Financial Services (DFS) issued guidance on 10 September 2026 setting out its expectations for cybersecurity risk assessments by DFS-regulated entities. The guidance covers the assessments’ scope, frequency and role in shaping…
DataBreaches - Revolut Exposed Customer Data After Fraudulent Government Request
Revolut confirmed on 12 September 2026 that it disclosed sensitive customer information to an unauthorised third party after processing a fraudulent request sent from an email account operating within a genuine government agency’s domain infrastructure. The…
Security Affairs - Anthropic Finds AI Scaling Credential Theft and Global Operations
Anthropic’s Threat Intelligence report for December 2025 to August 2026 portrays AI not merely as a tool but as a functioning operational layer for diverse actors. A standout case involved a financially motivated operation that harvested credentials from…
Security Affairs - CISA Flags Artifactory, ScreenConnect and RouterOS Attacks
The U.S. CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. The flaws are CVE-2026-42016 (8.1), an incorrect authorization…
- Chrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge
BlueMoon is an exploit kit that security researchers say was rapidly adopted by multiple espionage groups in opportunistic, rushed campaigns. The China-linked Violet Typhoon (also known as APT31, JungleBamboo, TA412 and Tide Castle) first deployed BlueMoon…
- Malicious Twitch Extension Exposed Tokens From 31,000 Users
Security researchers have uncovered a malicious Twitch extension, marketed as a quality-of-life tool to improve video playback, that secretly harvested active authentication tokens from more than 31,000 users. The extension was distributed via the Chrome Web…
SecurityOnline - AI Alerts Surge 685%, But SOCs Face a Flood of False Positives
The Hacker News report analyzes a surge in AI-related activity within enterprise security operations centres (SOCs) over the past year. It notes that AI-related alerts still make up a tiny share of total alerts—about 0.43%—but that volume has grown by 685%…
The Hacker News - RubyGems Supply Chain Attack Linked to Swarm of OpenAI Agents
A new public analysis ties a May 2026 RubyGems supply-chain attack to a swarm of OpenAI agents. Researchers say hundreds of junk gems were uploaded to RubyGems between 11 and 12 May 2026, with the earliest package appearing on 5 May 2026, and a further…
The Hacker News - CISA Warns of Active ScreenConnect Flaw Enabling File Execution
CVE-2026-84869 affects ConnectWise ScreenConnect and has been exploited in the wild, prompting emergency patching. The vulnerability allows unauthorized attackers to transfer and execute malicious files during active remote sessions, effectively bypassing…
- Anthropic Says Houthis Used Claude to Develop Guided Rockets
Anthropic has said that Claude users in northern Yemen, an area controlled by Iran-backed Houthi rebels, attempted to use the AI model to help develop more sophisticated weaponry. While the firm identified and blocked these users, it stated they did not…
SecurityWeekHouthis - Critical Chef Automate Flaw Lets Attackers Seize Infrastructure Control
Progress Software has published a critical advisory for Chef Automate, warning of CVE-2026-80462 with a CVSS v3 score of 10.0. The flaw permits unauthenticated attackers to gain elevated administrative privileges by bypassing identity checks through the…
SecurityOnlineCVE-2026-80462
Fri 11 Sep73 articles
3 articles this day · SecurityWeek first · 3 outlets
CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files · GitLab Patches CVSS 10 Flaw Exploited to Steal SecretsShow 3 articlesHide 3 articles
- CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files20:33CISA
- GitLab Patches CVSS 10 Flaw Exploited to Steal Secrets16:30The Hacker News
- Attackers Exploit Critical GitLab Flaw Within a Day of Patches16:11SecurityWeek
- CISA Flags Actively Exploited GitLab Flaw Exposing Arbitrary Files
- CISA Warns of Exploited JFrog Artifactory Authentication Flaw
CISA has added CVE-2026-42018 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects JFrog Artifactory and is named the JFrog Artifactory Improper Authentication Vulnerability. It can return an internal anonymous-user token to an…
- CISA Warns of Actively Exploited JFrog Artifactory Flaw
CISA has added CVE-2026-42016 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects JFrog Artifactory and is an incorrect authorisation flaw that can enable privilege escalation when the product validates a token’s signature and…
- Actively Exploited ScreenConnect Flaw Enables Unauthorised File Execution
CISA has added CVE-2026-84869 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects ConnectWise ScreenConnect and is named the ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability. It may…
- AI Phishing Campaign Targets Finance Teams With 1 Million Emails
Cybercriminals have demonstrated a new capability in fraud campaigns by using AI to generate and deliver personalised mass phishing. In a campaign tracked by Microsoft researchers, an unattributed threat actor sent more than one million emails in just three…
Dark Reading - Two Lamesa School Employees Arrested After Security Breach Investigation
Two employees of Lamesa Independent School District were arrested in connection with a law enforcement investigation into a security breach. The Lamesa Police Department and the Texas Rangers arrested 54-year-old Auerilo Garza in Lamesa at about 17:00 hours,…
DataBreaches - US Authorities Urge Service Providers to Communicate Honestly During Outages
A Dark Reading summary of the piece reports that US authorities and international partners have issued a joint advisory urging service providers to improve crisis communications around outages and breaches. The guidance, titled Communicating Under Pressure:…
Dark Reading - AI Scams Exploit Human Trust as US Fraud Losses Reach $21B
Security researchers at Dark Reading report that artificial intelligence is exceptionally effective at manipulating people, with social engineering and scams rising alongside advances in frontier models. In an interview at Black Hat USA 2026, Fred Heiding of…
Dark Reading - 36,769 AI Endpoints Exposed Online, Researchers Warn of Abuse Risk
Researchers from Mysterium VPN warn that a substantial portion of self-hosted AI infrastructure is openly reachable on the internet. In a scan of model servers, agent-building platforms and vector stores, they found 36,769 exposed AI endpoints that could be…
Security AffairsCVE-2026-40933 - Phishing Study Finds Credential Leaks Persist Despite Fewer Clicks
Security Week reports on Pistachio’s phishing behaviour study, which analysed 2.47 million simulated phishing attempts sent to more than 123,000 employees across more than 1,200 organisations between 1 June 2025 and 31 May 2026. Delivered through Pistachio’s…
SecurityWeek - Russia-Aligned Hackers Probe AI Safety Guardrails with Malware
Hackers have demonstrated a new way to undermine AI-assisted security analysis by deliberately tripping the safety guardrails of large language models. In what ESET Labs calls GuardBreaker, the threat actor group UAC-0099, described as Russia-aligned,…
Dark ReadingUAC-0099 - Anthropic Exposes Chinese AI Labs Harvesting Claude Training Data
Anthropic has disclosed that it identified and disrupted industrial-scale illicit distillation attacks on Claude, originating from seven China-based labs including Alibaba, Moonshot, DeepSeek, Zhipu (Z[.]ai), and MiniMax. Knowledge distillation is a…
The Hacker News - Conti Ransomware Developer Sentenced to Four Years in Prison
Oleksii Oleksiyovych Lytvynenko, a Ukrainian national, has been sentenced to four years in prison for conspiracy to commit wire fraud in connection with a Conti ransomware operation. The Department of Justice press release notes that Lytvynenko, formerly…
DataBreachesConti - Japan’s Digital Agency Warns 246,000 Staff Records May Be Exposed
Japan’s Digital Agency has disclosed that approximately 246,000 sets of personal information, including the names and email addresses of government employees, may have been exposed through unauthorized access to one of the agency’s network systems. The…
DataBreaches - AI Swarm Breached 440 PaperCut Servers Before Reaching Domain Admins
In late August, GreyNoise reported that a likely Russian-speaking actor deployed hundreds of AI agents, trained in a lab, to locate Internet-connected Papercut print management servers, compromise the software and opportunistically move to Windows Active…
Dark Reading - Brevo Breach Fuels Phishing Attacks Targeting Crypto Subscribers
An attacker breached Brevo, a third‑party email marketing platform used by several cryptocurrency companies, and conducted a supply‑chain phishing campaign aimed at newsletter subscribers. Brevo later confirmed that 138 customer accounts were accessed in a…
Malwarebytes - AI Agent Exposes Self Expanding Pipeline for Reselling Stolen LLM Access
A SANS ISC diary describes a semi-autonomous, semi-cooperative attacker apparatus that harvests and re-sells LLM access by building a self-expanding inference supply chain. The attacker’s AI coding agent locates poorly secured LLM resale gateways, obtains…
SANS ISC - Anthropic Warns AI Agents Are Powering Global Cyberattacks
Anthropic has warned that Claude’s capabilities are being repurposed by a broad spectrum of threat actors, from cybercriminals to state-sponsored groups, to assist with cyber attacks, data exfiltration, propaganda and mass surveillance between December 2025…
The Hacker News - Critical WordPress Flaw Enables Webshell Uploads, Threatening Sites
SecurityWeek’s round-up this week touches a breadth of emerging techniques and enforcement actions shaping the cyber threat landscape. Notably, attackers are experimenting with invisible Unicode tag characters to evade phishing filters, a method linked to AI…
SecurityWeekCVE-2026-14894 - Apache Camel K Patches Critical Flaws Enabling Code Execution
The Apache Software Foundation released patches for three critical Apache Camel K vulnerabilities, identified as CVE-2026-80352, CVE-2026-80351 and CVE-2026-80354. The flaws enable remote code execution and an authorisation bypass in operator namespaces,…
SecurityOnlineCVE-2026-80352 - Russian Hackers Used AI to Rebuild Malware After Detection
Anthropic says a Russian state‑sponsored group, tracked as GTG-20006 (Generative Threat Group 20006), ran an AI‑driven workflow to quickly rebuild and redeploy its attack toolkit after detections. The operation, linked to the Midnight Blizzard cluster (also…
The Hacker NewsGTG-20006 - Amazon Patches Critical SSM Flaw Exposing AWS Instance Credentials
Amazon has disclosed a critical server-side request forgery (SSRF) flaw in the AWS Systems Manager (SSM) Agent, tracked as CVE-2026-89049, with a CVSS score of 9.9. The issue affects all SSM Agent versions before 3.3.4851.0 and centers on the Session Manager…
SecurityOnlineCVE-2026-89049 - SOCRadar Brings Threat Intelligence to AWS Marketplace for Faster Buying
SOCRadar is now available on AWS Marketplace as a Software as a Service (SaaS) offering, enabling organisations that buy through AWS to procure Extended Threat Intelligence more quickly and predictably. The piece argues that procurement friction—new supplier…
SOCRadar - Microsoft 365 Direct Send Abuse Fuels Nearly 30,000 Phishing Emails
A KnowBe4 Threat Lab study tracked a phishing campaign abusing Microsoft 365’s Direct Send feature, with 29,785 confirmed phishing emails observed across July and August 2026. The attackers exploited Direct Send—intended for devices like printers and…
Infosecurity
