News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 64 so far |
Thu 1 Oct· 79 articles
-
Cloudflare Makes Basin Data Analytics Platform Generally Available
Cloudflare has generally availableed Basin, its serverless data analytics platform that sits within the Cloudflare Developer Platform. Basin combines three products—Basin Pipelines, Basin Catalog and Basin SQL—built on Apache Iceberg and Cloudflare R2 Object…
Cloudflare -
Attackers Exploited Zimbra Flaw Before Public Disclosure
SecurityWeek reports that attackers began exploiting a high-severity OS command injection in Zimbra Collaboration Suite (ZCS) shortly after patches were released, and before public disclosure. The flaw, CVE-2026-73570 (CVSS 8.9), affects ZCS pre-10.1.20,…
-
Cisco Catalyst SD-WAN Manager4 articles this day · SecurityWeek first
Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access · Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin
-
Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access
CVE-2026-76504 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Manager (formerly vManage) that lets an unauthenticated remote attacker reach the management API with administrator privileges. Cisco reports active exploitation in September…
-
Cisco SD-WAN Flaw Exploited to Bypass Authentication as Admin
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Cisco Catalyst SD-WAN Manager to its Known Exploited Vulnerabilities (KEV) catalog after reports of active exploitation. The flaw, tracked as CVE-2026-76504, carries a CVSS score of…
-
CISA Flags Actively Exploited Cisco SD-WAN Authentication Flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Cisco Catalyst SD-WAN Manager’s flaw to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is tracked as CVE-2026-76504 and carries a CVSS score of 9.8. It affects…
-
Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass
Cisco has released urgent patches for a critical authentication bypass in Catalyst SD-WAN Manager, which has been exploited in the wild. The flaw, tracked as CVE-2026-76504 with a CVSS score of 9.8, targets the API session-based authentication mechanism. It…
-
-
Apple iOS and iPadOS2 articles this day · The Hacker News first
Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks · Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation
-
Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks
Apple has patched a zero‑day in CoreGraphics tracked as CVE-2026-86950, after researchers reported that it could be triggered by processing specially crafted files to cause arbitrary code execution. The flaw is described as an out‑of‑bounds write in the font…
-
Apple PDF Flaw Gets PoC as CISA Warns of Targeted Exploitation
Security researchers have published the first public proof‑of‑concept for CVE-2026-86950, a CoreGraphics flaw in Apple’s 2D drawing, image rendering and PDF processing library. The PoC shows that a crafted PDF containing an embedded TrueType font can crash…
-
-
Citrix NetScaler ADC2 articles this day · The Hacker News first
Citrix NetScaler Zero Days Exploited Against 50,000 Devices · Attackers Exploit Critical NetScaler Flaw to Steal Configurations
-
Citrix NetScaler Zero Days Exploited Against 50,000 Devices
Two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway were exploited as zero-days for weeks, according to Datawater. The CVEs are CVE-2026-88771 and CVE-2026-88772, both rated with CVSS 9.5, and the exploits were…
-
Attackers Exploit Critical NetScaler Flaw to Steal Configurations
Threat actors have exploited a critical pre-authentication command injection flaw in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and harvest configuration data. LevelBlue’s THOR team found malicious authentication events that used…
-
-
Financial Firms Can Cut Risk by Securing the Software Supply Chain
On 1 October 2026, The Hacker News highlights a shift in how financial services organisations should approach security by focusing on the software supply chain rather than attempting wide-scale application upgrades. The piece notes that many banks, insurers…
The Hacker News -
AI Security Startup Armadin Raises $255 Million at $2.5 Billion Valuation
Armadin, the AI-native offensive security startup founded by Mandiant’s Kevin Mandia, has raised $255.5 million in a Series B round at a valuation exceeding $2.5 billion. The funding brings Armadin’s total raise to about $445 million, just seven months after…
SecurityWeek -
Malwarebytes Blocks 100% of Threats in Latest Independent Tests
Malwarebytes reports another clean sweep in independent testing, highlighting a string of recent accolades across three major evaluators. The company states it achieved a perfect 18 out of 18 in AV-TEST’s Windows Consumer Security Product Test for the…
Malwarebytes -
US sanctions alleged ATM jackpotting malware engineer ‘Prometheus’
The US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, known as ‘Prometheus’, described as the alleged engineer of the malware used in ATM jackpotting attacks tied to the Tren de Aragua (TdA) network. His network, based in Mexico and…
SecurityWeekTren de Aragua -
Pentagon Confirms Breach Exposed Data on 3 Million People
The Pentagon confirms a data breach at the Defence Manpower Data Centre (DMDC), a DoD organisation that manages personnel records, ID credentials and benefits entitlements for military and civilian staff, veterans and their families. The incident is said to…
Malwarebytes -
Zammad2 articles this day · Security Affairs first
AI Attackers Breached Dutch Security Institute Through Zammad Zero-Days · AI Agent Chained Zammad Zero Days to Gain Root Access in Seconds
-
AI Attackers Breached Dutch Security Institute Through Zammad Zero-Days
The Dutch Institute for Vulnerability Disclosure (DIVD) says it was hacked in an automated AI-powered attack that exploited two zero-day vulnerabilities in the open-source Zammad web-based ticketing system. The breach occurred on 21 September, prompting full…
-
AI Agent Chained Zammad Zero Days to Gain Root Access in Seconds
The Dutch Institute for Vulnerability Disclosure (DIVD) has disclosed a breach that exploited two previously unknown Zammad flaws, tracked as CVE-2026-102489 and CVE-2026-102490. DIVD’s investigation, conducted with Merlon Security, found that the two…
-
-
OpenAI Disrupts Moonshot AI Campaign Targeting Protected Reasoning
OpenAI says it identified and disrupted a coordinated campaign designed to illicitly extract protected reasoning from its AI models. The effort, described as adversarial distillation, did not breach encryption or access stored user conversations but…
The Hacker News -
Public PoC Exploits Critical Next.js Flaw for Remote Code Execution
A working PoC exploit has been publicly released for CVE-2026-94545, a critical remote code execution flaw in the Next[.]js next/og image API. The disclosure notes that one unauthenticated request can execute commands on the affected server. The advisory…
-
Over 500,000 GitHub Credentials Remain Active Despite Protections
Truffle Security has revealed that more than half a million active, unique credentials were exposed in public GitHub repositories. In August 2025, researchers scanned 224 million public GitHub repositories and identified 1,103,438 exposed credentials. By the…
SecurityWeek -
AI Attacks Expose Cybersecurity’s Biggest Preparedness Gap, PwC Finds
PwC’s 2027 Global Digital Trust Insights report, surveying 3,934 business and tech leaders across 71 countries, finds that threats targeting AI systems are the area cybersecurity leaders feel least prepared to address. Adversarial AI attacks are identified…
Infosecurity -
DraftKings AI Targeted Promotions at Gamblers Likely to Lose More
Two separate investigations have raised concerns about how DraftKings targets promotions to problem gamblers using AI. The New York Times reported on 19 September 2026 that the company’s machine‑learning model identified customers likely to respond to…
Malwarebytes -
Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords
Attackers have been exploiting a Citrix NetScaler zero-day to seize root access on NetScaler ADC and Gateway devices without requiring a password, beginning at least in early September 2026. The issue, tracked as CVE-2026-88772, resides in NetScaler’s packet…
-
Cloudflare Plans Free Certificate Authority to Rival Let’s Encrypt
Cloudflare has announced plans to operate a free, publicly trusted Certificate Authority (CA) and issue certificates for websites without charge, positioning itself as a major alternative to Let’s Encrypt. The company has begun submitting to the root…
SecurityOnline -
Google’s Gemini 4 Argon Finds Critical Hospital Software Flaw
Google has unveiled Gemini 4 Argon, its frontier AI model, with a pilot rollout to a restricted group of trusted cyber defenders via its Fairwind Programme, and is gradually expanding access as feedback grows. Argon is pitched as capable of handling complex…
SecurityWeek -
Google Gives Cyber Defenders Early Access to Gemini 4 Argon
Google has announced Gemini 4 Argon, its latest frontier AI model, is being rolled out to a select group of trusted cyber defenders through its Fairwind Programme. Google says Argon delivers frontier performance across complex workflows in software…
The Hacker News -
MI5 Warns 100 UK Academics Over Chinese Spy-Linked Research Funding
MI5 has issued a rare espionage alert stating that more than 100 UK-linked academics have contributed to projects funded by China’s General Technology Research Institute (CGTRI), also known as the China Academy of General Technology (CAGT). The agency…
Infosecurity -
Attackers Hide AdaptixC2 Implant Inside Fake Microsoft Copilot
Attackers chained two PaperCut MF flaws to gain initial access from an internet-facing server and deploy a trojanised Microsoft Copilot binary, concealing an AdaptixC2 implant inside the fake Copilot. The intrusion, attributed to an in-scope incident…
-
Microsoft Uncovers NeedyMantis Backdoor Hiding in Trusted Apps
Microsoft Threat Intelligence has detailed NeedyMantis, a modular post‑compromise backdoor seen in targeted intrusions since at least October 2025. The malware hides inside trusted software via DLL sideloading, pairing a legitimate program with a malicious…
SecurityOnline -
Phishers Abuse Trusted ScreenConnect Tool to Breach Victims
A phishing email delivered a link that purported to show an order invoice PDF, but led to a real executable: ScreenConnect.ClientSetup[.]exe. The attachment/link tricked basic security controls, and the attacker used a legitimate remote access tool to…
SANS ISC -
Bitget Heist Traced to Zero-Day in Third-Party Security Product
Bitget has confirmed that the $387.5 million crypto heist in late September was enabled by a zero-day in a third‑party security product. Ongoing investigations led by SlowMist indicate the attackers exploited the flaw to obtain high‑level internal…
The Hacker News -
MetaMask Exits Lido Validators Amid Ongoing Infrastructure Incident
MetaMask has disclosed an ongoing security incident affecting part of its infrastructure and says it is actively addressing the issue in collaboration with external partners and security advisers. The company reports no immediate threat to MetaMask wallets…
The Hacker News -
ASUS Routers and Motherboards Exposed to High-Risk Flaws
ASUS has disclosed three high-severity hardware and firmware flaws affecting a range of router models and popular motherboards. The vulnerabilities, tracked as CVE-2026-14157, CVE-2026-13313 and CVE-2026-93495, carry CVSSv4 scores up to 9.4 and have not been…
-
MediaWiki Extension Flaw Lets Attackers Deploy Web Shells
MediaWiki is actively being exploited for a critical unauthenticated remote code execution flaw in the External Data extension, tracked as CVE-2026-100382. The bug allows an attacker to run arbitrary commands on the web server via wikitext, without…
-
ModSecurity Patches Four Flaws That Enable WAF Evasion and Bypass
ModSecurity has four security flaws that were addressed in recent patches. The vulnerabilities affect the ModSecurity WAF engine and could enable bypassing inspection and other weaknesses in parsing and configuration. The maintainers urge admins to upgrade…
-
Axios Fixes Ten Flaws Affecting Millions of Node.js Applications
Axios has released patches addressing ten security vulnerabilities in its Node[.]js HTTP adapter, including prototype pollution and denial-of-service risks. The issues affect Axios up to version 1.19.x, spanning the 0.x and 1.x release lines, with the…
-
Dell Warns Terraform Users of TLS Flaw Enabling Management Traffic Interception
Dell has published an advisory detailing four vulnerabilities in the Dell Terraform Provider family, affecting plugins used to automate Dell server management via Terraform. The flaws span the Redfish provider and the OpenManage Enterprise (OME) provider,…
-
Kiteworks Fixes 78 Flaws Including Critical Admin Account Takeover
Kiteworks has released a broad security patch covering 78 vulnerabilities across its Core platform, Email Protection Gateway and Secure Data Forms. Nine of the flaws are graded critical, with the most severe being CVE-2026-102115, a 9.8-rated password reset…
-
Apache MINA SSHD Patches Authentication Bypasses Rated CVSS 9.1
SecurityOnline[.]info reports that eight vulnerabilities in Apache MINA SSHD were patched in a recent update. The flaws span authentication bypasses and resource-management issues, with the most severe defects rated at CVSS v3 scores of 9.1. The…
-
ISC Keeps Threat Level Green as October 2026 Stormcast Goes Live
The ISC (Internet Storm Center) features handler Xavier Mertens on duty, with the current threat level marked as green. The latest Stormcast podcast, dated October 1st, 2026, is available for listeners. Readers can find links to previous and next entries, as…
SANS ISC
