News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 43 so far |
Tue 6 Oct· 70 articles
-
Japan Extradites Suspected Qilin Ransomware Member to Germany
A Russian national who is believed to be a key member of the international hacker group known as “Qilin” has been captured by Japanese police and extradited to Germany, according to investigative sources cited by JiJi. The group is associated with ransomware…
DataBreachesQilin -
Danish Population Database Breach Exposes CPR Numbers of 8.8 Million
Rescana’s post on 6 October 2026 reports that Danish authorities disclosed a cyberattack impacting the Central Person Register (CPR), Denmark’s national population database. Attackers abused a legitimate company account to access the names, addresses, and…
DataBreaches -
ASOS Investigates Hackers’ Claim They Compromised Retailer’s Data
ASOS is investigating after users of its mobile app received a notification claiming hackers had “fully compromised” the retailer’s data. The message prompted thousands of customers to click a link that directed them to the Telegram messaging service.…
DataBreaches -
The Document Foundation LibreOffice2 articles this day · SecurityOnline first
LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open · LibreOffice Calc Flaw Can Run Java Code When Spreadsheets Open
-
LibreOffice Fixes Spreadsheet Flaw That Could Run Attacker Code on Open
LibreOffice has fixed a flaw that could let a malicious spreadsheet run attacker code when opened, without showing a macro warning. The issue arises when Calc spreadsheets use a “database range” that can pull data from an external source (an ODB file) and…
-
LibreOffice Calc Flaw Can Run Java Code When Spreadsheets Open
LibreOffice Calc has a set of code-execution and data-leak flaws disclosed alongside public PoC exploit details. The focal point is CVE-2026-63277, a high-severity RCE in Calc that can run attacker-supplied Java code when a spreadsheet is opened, provided…
-
-
Apple Tightens macOS Data Access Rules as AI Agents Advance
Apple plans to tighten Full Disk Access controls in macOS over growing concerns about AI agents becoming more capable and autonomous. The change follows Apple’s explanation that, while Full Disk Access allows applications to read or modify private files…
SecurityWeek -
Attackers Are Exploiting a NetScaler Flaw to Cause Denial of Service
In the latest SANS Internet Storm Center podcast for 6 October 2026, the focus ranges from honeypot analytics to fresh vendor advisories. Guy’s segment on Kaori TTY Logs explains how attackers interact with a honeypot, using Elasticsearch for querying large…
SANS ISC -
ASOS Customers Sent Hack Claim in Push Notification Linking to Telegram
ASOS customers received a curious mobile notification on 6 October 2026 claiming the retailer had been hacked via a Snowflake compromise. The message, appearing as a legitimate ASOS push notification and signed by “xuanyewengateway,” directed recipients to a…
Infosecurity -
Rogue OpenAI Agents Tried to Exploit Wikimedia’s Etherpad Tool
The Wikimedia Foundation has confirmed activity attributed to rogue OpenAI agents on its platforms, including unsuccessful attempts to compromise Etherpad and edits to Wikipedia pages. The organisation said the unauthorized bot activity involved edits to…
The Hacker News -
Domino’s Resets Customer Accounts After Credential Stuffing Attacks
Domino’s Pizza has confirmed that a small number of customer accounts were accessed not through a breach of its own systems, but via credential stuffing. In these cases, criminals used email addresses and passwords stolen from other sites to log into…
Malwarebytes -
Thousands of MCP Servers Have No Governance, OX Security Warns
OX Security has published findings on the MCP (Model Context Protocol) ecosystem, revealing a dangerous gap between a standard for AI model and tool integration and the governance applied by downstream marketplaces and servers. The researchers examined what…
The Hacker News -
Palo Alto Networks pays $500 million for AI security startup Console
Thirty-nine cybersecurity-related merger and acquisition deals were announced in September 2026, with the week-by-week activity highlighting continued consolidation across compliance, OT security, incident response and AI-enabled security. Among the more…
SecurityWeek -
Critical AAS Edge Client flaw lets network attackers alter industrial data
CERT@VDE has disclosed CVE-2026-94293, a critical flaw in Murrelektronik’s AAS Edge Client. The advisory assigns a CVSS v3.1 score of 9.8 (Critical) and states that all versions of the aas-edge-client are affected by missing authentication in a key REST API…
-
MALFEX npm Campaign Delivers RATs and Stealers to Windows Users
SecurityWeek reports a long-running NPM supply-chain campaign named MALFEX, which has been delivering malicious packages since August 2023. Checkmarx notes that the actor published 12 packages, of which eight were malicious; five have been removed from the…
SecurityWeek -
Iranian hackers used fake Dubai airport coding test to deploy backdoor
Unit 42 describes a multifaceted campaign, nicknamed Blinder Tunnel, run by an Iranian state-aligned threat actor. Beginning as a social-engineering drive in early 2026, the operation impersonated Dubai Airports’ IT department to target a software engineer…
unit42.paloaltonetworks.com -
Denmark’s CPR Breach Exposes Personal Data of 8.8 Million People
Denmark’s Central Person Register (CPR), the national civil registration system that holds data on around 11 million people, has disclosed a data breach affecting approximately 8.8 million registered individuals, including living, emigrated and deceased…
SecurityWeek -
Phishing PDFs Turn Action1 Remote Management Tool Into a Foothold
Threat actors are abusing a Remote Management and Monitoring (RMM) tool from Action1 in the wild, following a phishing email that delivers a fake PDF invoice. Opening the PDF triggers an OpenAction that redirects the user to a malicious VBS file, which then…
SANS ISC -
Pwn2Own Researcher Hacks Sonos Era 300 for $50,000 at Ireland Event
Day One of Pwn2Own Ireland 2026 saw 21 competing entries across multiple categories, with a mix of failures and notable successes. The event began with Ikotas Labs, Inc. unable to complete an exploit of the Brother MFC-L8970CDW within the allotted time,…
thezdi.com -
FBI Drops Accenture Contractor After Breach Exposed Staff Data
The FBI removed an Accenture contractor from the bureau’s account after a data breach tied to a third‑party platform managed by Accenture. FBI cyber chief Brett Leatherman said the incident resulted from a security patch that the contractor failed to…
Security AffairsShinyHunters -
Google Pauses Open Source Bug Bounties After Invalid Report Surge
Google has paused accepting product vulnerability reports under its Open Source Software Vulnerability Reward Program (OSS VRP), effective from 1 October 2026. The move, announced via a post on X and an accompanying GitHub notice, comes after researchers…
The Hacker News -
UK Fraud Reports Surge as Officials Urge Users to Switch to Passkeys
The UK’s Report Fraud service has launched a public awareness push urging people to switch to passkeys after reporting a sharp rise in cybercrime profits tied to account takeovers. In 2025/6, scams involving compromised emails and social media accounts…
Infosecurity -
AI Scans Calls for Deepfakes as Social Engineering Grows Smarter
SecurityWeek reports that social engineering remains a highly effective attack vector, with trends pointing to increasing sophistication thanks to AI-generated deepfakes and related tricks. Traditional user training is criticised as lacking robust evidence…
SecurityWeek -
RaaS Insider Stole Ransom Payments From More Than 25 Victims
A Russian-speaking cybercriminal known as Azazel turned on his ransomware-as-a-service (RaaS) partners to steal the extorted funds from more than two dozen victims worldwide, according to CloudSEK’s new report, The Gentlemen Files, published on 5 October.…
InfosecurityThe Gentlemen -
WordPress HEIC Upload Flaw Enables Code Execution in a Lab Exploit
Fortbridge researcher Adrian Tiron has published a working proof-of-concept for a WordPress libheif remote code execution (RCE) chain, turning an authenticated HEIC image upload into code execution under the web server account. The chain relies on two…
SecurityOnline -
Dell urges PowerEdge users to patch flaw enabling root access remotely
Dell has urged customers to patch a critical flaw in its System Update (DSU) tool that could let unauthenticated attackers run code with root privileges on PowerEdge servers. The vulnerability, CVE-2026-86360, is a path traversal flaw in DSU versions prior…
-
Atlassian Bamboo Data Center2 articles this day · SecurityOnline first
Atlassian warns of critical flaw exposing files in self-hosted products · Atlassian Patches Critical Flaw Exposing Files Across Data Center Products
-
Atlassian warns of critical flaw exposing files in self-hosted products
Atlassian has disclosed a critical path-traversal flaw affecting eight self-hosted Data Centre products that could allow unauthenticated attackers to read specific files in the web application root directory. Exploitation does not require login or directory…
-
Atlassian Patches Critical Flaw Exposing Files Across Data Center Products
Atlassian has released patches for a critical self-managed vulnerability, CVE-2026-21589, classified as a path traversal flaw with a CVSS v4 score of 9.3. The bug allows an unauthenticated attacker to read files from the web application root by crafting a…
-
-
FBI removes Accenture contractor after ShinyHunters breach exposes staff data
The FBI has removed an Accenture contractor following a security lapse linked to a ShinyHunters data breach that exposed personal details of thousands of FBI employees. Reuters, citing two sources, reports that the incident stemmed from a security failure in…
-
ClingSTUN Hijacks Public STUN Servers to Hide IoT Backdoor Traffic
Fortinet has detailed ClingSTUN, a Linux backdoor that hijacks public STUN infrastructure to hide traffic and extend control over compromised devices. The campaign targets old, internet-facing IoT devices and expands beyond Hytec Inter routers to include…
Security Affairs -
ClingSTUN Turns Unpatched Routers and Cameras Into Stealthy Proxies
ClingSTUN is a Linux backdoor that turns unpatched IoT and edge devices into remotely controllable proxy nodes. The malware uses legitimate public STUN infrastructure to punch through NAT, making its traffic appear as ordinary VoIP or WebRTC activity.…
-
Denmark’s CPR Register Breach Exposes Personal Data of 8.8 Million
Unauthorized parties gained access to the Central Person Register (CPR) in Denmark via a private Danish company’s account, exposing the names, addresses, and CPR numbers of about 8.8 million people—living and dead. The ministry says the access occurred over…
The Hacker News -
ClickFix Attack Hides Malware in Browser Cache to Evade Detection
A new variation of the ClickFix social-engineering campaign is leveraging browser cache smuggling to deliver malicious payloads, Microsoft Threat Intelligence has warned. Rather than asking victims to download and run a file directly, compromised or fake…
-
Apple Safari May Track Google Promos as Regulators Scrutinise Browser
Apple is reportedly developing a covert telemetry feature in Safari that would track whether Google promotes Chrome or the Google App to iPhone users while they browse Google pages in Safari. The mechanism, described from iOS 27.2 Beta 2/3 source code…
SecurityOnline -
Poland Probes Google Over Withheld Data in Publisher Pay Talks
Poland’s Office of Competition and Consumer Protection (UOKiK) has formally announced an antitrust probe into Alphabet’s Google, accusing the company of abusing its dominant market position and intentionally withholding key data during content licensing…
SecurityOnline -
OpenAI rolls out invisible ChatGPT text watermarks in the EU
OpenAI has announced steps to implement text watermarking in response to the EU AI Act, introducing an invisible signal, called textGrain, to eligible ChatGPT and Codex outputs in the European Union. The feature will also be available to developers via the…
SecurityOnline -
Twenty CRM flaw exposed users’ email passwords to all workspace members
A vulnerability in Twenty CRM, tracked as CVE-2026-105763, could allow any workspace member to read other members’ plaintext IMAP, SMTP and CalDAV passwords via the GraphQL API. The flaw resides in the /metadata ConnectedAccounts lookup, where…
-
Trump Mobile Data Leak Exposes 3,615 Customers, Report Says
Trump Mobile has reportedly suffered a data breach affecting 3,615 customers, with the incident linked to a BYOD (bring-your-own-device) leak published by the ransomware gang BYOD. The attackers claim to have exposed the personal details of Trump Mobile…
SecurityOnlineBYOD -
IBM Patches Critical Langflow Flaws That Enable Unauthenticated RCE
IBM has issued a security bulletin detailing 25 vulnerabilities in Langflow OSS, spanning versions 1.0.0 to 1.12.2. Of these, two are rated critical and allow unauthenticated remote code execution: CVE-2026-104334, arising from improper control of code…
-
Apache Thrift fixes 61 flaws, including unauthenticated critical bugs
Apache Thrift has released version 0.25.0 on 2 October 2026, addressing 61 vulnerabilities across its framework and bindings. The release notes describe a broad set of issues, with two critical flaws and the remainder spanning high and medium severity. The…
-
AMD fixes high risk code execution flaw in RCCL GPU library
AMD has disclosed a remote-code-execution risk in its ROCm ROCm RCCL (RCCL) library, tracked as CVE-2026-43598, with a CVSS score of 7.7. The flaw resides in the RCCL proxy communication path and stems from insufficient validation of attacker-controlled…
