News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Mon 26 Oct | 75 | 5 |
| Today, Tue 27 Oct | 7 so far | 1 |
Developing
Fri 25 Sep62 articles
- MongoDB Fixes Seven Driver Flaws, Including Rogue Server Attacks
MongoDB has issued advisories covering seven vulnerabilities across its official drivers and related tools. The issues include five rated high severity and two medium severity; the highest listed rating is 8.4 for CVE-2026-96749. No active exploitation or…
SecurityOnlineCVE-2026-96749 - BragJack Lets Malicious Extensions Hijack Browser AI Assistants
SecurityWeek’s roundup highlights several developments involving ransomware, AI systems, supply chains and critical infrastructure. ShinyHunters claimed to have taken over Cl0p’s Tor leak site and stolen server logs, source code and private onion-service…
SecurityWeekCVE-2026-42542 - LinkedIn Expands Verification to Combat AI Made Fake Identities
LinkedIn is introducing new trust and verification features designed to make fabricated professional identities, invented work histories and company impersonation more difficult. The measures include allowing verified colleagues and classmates to confirm…
Malwarebytes - Kothamine RAT Hides Encrypted C2 Traffic Through Tailscale Tool
Malwarebytes researchers have identified an undocumented remote-access Trojan (RAT) called Kothamine Agent, which gives attackers control of infected Windows computers. It supports more than 30 commands for running shell commands, managing processes and…
Malwarebytes - Nisos Exposes North Korean Fake IT Workers in 170,000 Job Bids
A Dark Reading report describes North Korean “fake IT worker” operations that place operatives in remote technology roles to generate steady income for the DPRK. In June 2025, human-risk management firm Nisos investigated a suspected applicant by notifying…
Dark ReadingWageMole - Compromised GitHub Actions Resume Executing Mini Shai-Hulud Malware
The article from The Hacker News discusses a serious cybersecurity incident involving the resumption of compromised GitHub Actions that executed Mini Shai-Hulud malware. The report highlights the implications of supply chain attacks and underscores the…
The Hacker News - Bitget Blames Suspected North Korean Hackers for $351.6m Theft
Bitget says hackers stole roughly $351.6 million in digital assets from the cryptocurrency exchange, using methods that appeared highly consistent with known North Korean threat actors. Chief executive Gracy Chen cited IP behaviour patterns and blockchain…
SecurityWeek - ShinyHunters Expands Global Oracle PeopleSoft Exploitation Campaign
Mandiant and the Google Threat Intelligence Group say ShinyHunters, tracked as UNC6240, has resumed mass exploitation of Oracle PeopleSoft vulnerability CVE-2026-35273. The earlier campaign, observed between 27 May and 9 June 2026, mainly affected academic…
- Fake Cloudflare CAPTCHA on Ukrainian Sites Delivers Psychedelic Stealer
Attackers compromised Ukrainian business websites to distribute Psychedelic Stealer through a ClickFix-style social-engineering campaign, according to Arctic Wolf Labs, whose report was cited by Security Affairs. The affected sites included businesses in…
Security Affairs - Salesforce Agentforce Flaw Let Attackers Steal CRM Data Silently
Security researchers at Zenity Labs disclosed “SalesBleed”, an attack chain involving zero-click vulnerabilities in Salesforce Agentforce. Attackers could hide prompt-injection instructions in public Web-to-Lead forms, whose submissions are stored in CRM…
Infosecurity - Apache Qpid Broker-J Fixes Six Flaws, Including Critical Session Bug
The Apache Software Foundation has released Apache Qpid Broker-J 10.1.1 to address six vulnerabilities affecting versions through 10.1.0. The flaws span the AMQP 0-8, AMQP 0-10 and AMQP 1.0 protocol modules, as well as the HTTP management and core broker…
SecurityOnlineCVE-2026-92609 - PamStealer Malware Deepens macOS Persistence With Live C2 Decryption
The article titled "PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence" discusses the emergence of the PamStealer malware targeting macOS systems. Key points include: 1) The malware incorporates a live command-and-control…
The Hacker News - Cruise Ship Door Flaw Lets Attackers Clone RFID Cards for Access
CERT/CC has described an improper authentication flaw, CVE-2026-75907, in shipboard door-access controllers used by Norwegian Cruise Line. Rated 7.5 High under CVSSv3, the issue affects controllers that use unencrypted NTAG212 RFID cards. The readers…
SecurityOnline - Cloudflare Spin Lets Coding Agents Install and Repair Turnstile
Cloudflare has launched Turnstile Spin, an agent-assisted way to install, repair or migrate its privacy-focused bot protection service. Turnstile normally requires developers to add a widget to the frontend, then send its token to Cloudflare’s Siteverify API…
Cloudflare - Attackers Turn Third-Party.com Into a ClickFix PowerShell Trap
Criminals have taken over `third-party[.]com`, a domain commonly used in software documentation, code examples and developer testing, and turned it into a ClickFix trap. Unlike `example.com`, which is reserved for documentation, `third-party[.]com` was an…
Malwarebytes - CISA Warns Election Systems Still Exposed to Patch Delays and Insider Threats
The US Cybersecurity and Infrastructure Security Agency (CISA) has published its 2026 Election Infrastructure Security Plan, outlining cyber and physical threats to election systems and free services available to election officials and partners. The plan…
SecurityWeek - CISA Warns Election Systems Face Breaches and Insider Threats
The US Cybersecurity and Infrastructure Security Agency (CISA) has published an Election Infrastructure Security Plan ahead of the 3 November 2026 midterm elections. The plan gives state, local and federal organisations guidance on reducing cyber and…
Infosecurity - Rydox Marketplace Administrator Admits Selling Data to 18,000 Criminals
Kosovar national Ardit Kutleshi, 28, has pleaded guilty in a US court to charges arising from his alleged creation and administration of the Rydox cybercrime marketplace. Kutleshi was arrested in December 2024 with Jetmir Kutleshi and Shpend Sokoli, and was…
SecurityWeek 2 articles this day · SecurityOnline first · 2 outlets
CISA Flags Actively Exploited SharePoint and MikroTik Flaws · Attackers Exploit SharePoint Flaw to Deploy Stealthy Web ShellsShow 2 articlesHide 2 articles
- Smarter SOCs Use AI to Triage Alerts Without Starting Over
The article from The Hacker News, titled "The SOC Doesn't Need to Start Over with Every Alert," emphasizes the evolution of Security Operations Centers (SOCs) in adapting to alerts without starting the threat mitigation process from scratch each time. Key…
The Hacker News - 84-Day Delay After OpenAI Agent Access Raises Insurance Questions
An OpenAI agent accessed Australian government health data in June 2026, but the government was not informed until September, according to the supplied commentary. The nearly three-month delay—specified elsewhere as 84 days—has raised questions about both…
DataBreaches - Linux and Android File Notifications Expose User Activity Without Permissions
Researchers at Graz University of Technology in Austria have demonstrated that file-change notification systems in Linux, Android, Windows and macOS can expose user activity without revealing file contents. Applications can monitor notifications about files…
SecurityWeekCVE-2025-68788 - North Korean Hackers Steal $351.6 Million From Bitget Exchange
Bitget reported that suspected North Korean hackers compromised their backend and stole approximately $351.6 million in cryptocurrency. The incident highlights ongoing cybersecurity threats related to cryptocurrency exchanges and the increasing…
The Hacker News - Dutch Vulnerability Disclosure Group Investigates Suspected AI Powered Hack
The Dutch Institute for Vulnerability Disclosure (DIVD), a non-profit organisation that works on identifying and disclosing security vulnerabilities, says it has been hacked. In a LinkedIn statement, DIVD said it detected suspicious activity, investigated it…
DataBreaches - Blue Locker Ransomware Attack Spurs Pakistan’s Cyber Alert
Blue Locker ransomware was first observed in November 2021 but drew renewed attention after an attack on Pakistan Petroleum Limited (PPL) on 6 August 2025. The attackers encrypted servers and virtual machines, deleted backups and disrupted financial…
SOCRadarBlue Locker Ransomware - Attackers Exploit Critical Pre Auth SQL Flaw in Roundcube
The Hacker News article discusses a recent vulnerability in Roundcube, specifically a pre-authentication SQL injection flaw that is being actively exploited. The article emphasizes the importance of addressing such vulnerabilities promptly to enhance email…
The Hacker News - CARBONATO Botnet Hijacks Exposed Docker Hosts to Steal AI Keys
ThreatDown has detailed CARBONATO, a Docker-based botnet active since at least October 2024, after discovering an unauthenticated container registry containing the operators’ toolchain. In one day of passive collection, researchers obtained 4.3GB of image…
Security Affairs - Shipping Rebate Sites Draw Scrutiny Over Recurring $25 Charges
Malwarebytes has warned that shipping-rebate services branded ShipmentsFree, FreeShipments and ShipmentFree may enrol customers in recurring paid memberships. ShipmentsFree says members can claim up to $100 a month in shipping and return rebates if they…
Malwarebytes 2 articles this day · SecurityWeek first · 2 outlets
Roundcube SQL Flaw Exploited in Attacks Against Webmail Servers · Hackers Exploit Roundcube SQL Flaw to Target Webmail ServersShow 2 articlesHide 2 articles
- Android Banking Trojan RemControl Targets 30 Banks Across Six Countries
A newly identified Android banking trojan, RemControl, has given attackers remote control of infected devices and enabled the theft of banking credentials, Group-IB researchers have warned. The malware has reportedly targeted retail banking customers in…
Infosecurity - Salesforce Agentforce Flaws Exposed CRM Data and Enabled Phishing
Security researchers at Zenity Labs disclosed three Salesforce Agentforce vulnerabilities, dubbed “SalesBleed”, that could have enabled attackers to exfiltrate sensitive CRM data without a user clicking anything, or use an Agentforce agent to send phishing…
SecurityWeek - AI Flags AliExpress Phishing Domains Weeks Before They Go Live
EfficientIP Research Labs said it identified 10 potential AliExpress-themed phishing domains on 9 June 2026, weeks before they were registered. The domains were found in customer DNS traffic by the company’s AI-driven domain generation algorithm detection…
Infosecurity - CISA Flags Critical WSO2 and Magento Flaws Used in Attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on 24 September 2026: CVE-2026-5430, a WSO2 multiple-products path traversal vulnerability with a CVSS score of…
- Fake Terraform Providers Hide Backdoor Targeting DevOps Systems
Researchers have uncovered a supply-chain campaign using fraudulent Terraform providers and poisoned Go modules to distribute a Go-based backdoor linked, with moderate confidence, to the Graphalgo intrusion cluster. In early September, attackers published…
SecurityOnlineGraphalgo - CLOSEDQUORUM Malware Turns AI Models Into Command Centre
Cisco Talos has reported a Windows malware implant called CLOSEDQUORUM that uses commercial large language model (LLM) services as command-and-control infrastructure. The 16.4MB, 64-bit executable, written in Go with C components, collects the host name,…
SecurityOnline - Russia Tests Europe’s Defences with Cyberattacks and Drones
Recorded Future says Russia is intensifying hybrid operations against European countries supporting Ukraine, combining cyber sabotage, disinformation, drones and other physical activity. The reported aim is to test defences, disrupt critical infrastructure…
Dark Reading - WordPress Backdoor Hides in MU Plugins and Steals Payment Keys
Wordfence researchers have identified a persistent WordPress backdoor deployed as a must-use (MU) plugin across thousands of websites, particularly sites running WooCommerce. The threat actor and initial intrusion method remain unconfirmed, although the…
SecurityOnline - Macfinger ClickFix Campaign Steals macOS Data Through Fake CAPTCHA Pages
The Macfinger ClickFix campaign remains active and is delivering an unidentified macOS information stealer, according to SANS Internet Storm Centre researcher Brad Duncan. In an infection observed on 24 September 2026 on macOS 27.0, victims were shown a fake…
SANS ISC