News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 27 so far |
Thu 8 Oct· 75 articles
-
US Offers $10 Million Reward for Suspected HAFNIUM Hacker
The U.S. State Department has offered up to $10 million for information leading to the identification or location of Zhang Yu, a Chinese national charged in the United States in connection with the 2021 Microsoft Exchange Server attacks known as HAFNIUM. The…
The Hacker NewsHAFNIUM -
MonsterCloud Owner Charged in Alleged $19 Million Ransomware Scam
The U.S. Department of Justice has charged Zohar Pinhasi, a 50-year-old American-Israeli national who owned MonsterCloud, with two counts of wire fraud and one count of wire fraud conspiracy. Prosecutors allege he defrauded ransomware victims by telling them…
The Hacker News -
Hackers Exploit Critical Atlassian Flaw to Steal Restricted Files
Threat actors are exploiting CVE-2026-21589, a critical arbitrary file access flaw in Atlassian Data Center products, with a CVSS score of 9.3. The vulnerability allows unauthenticated attackers to read specific files from the web application root if they…
-
Iranian Hackers Used a Fake Job Test to Target an Iraqi Engineer
Iran-linked threat actors, tracked by Unit 42 as CL-STA-1178, conducted a tightly targeted operation aimed at an Iraqi engineer involved in critical infrastructure. The campaign began with a fake Dubai Airports careers portal in March 2026, followed by a…
SecurityOnlineCL-STA-1178 -
Attackers Hijack URL Scanner Browsers to Target Russia’s Bankruptcy Registry
Rogue AI agents are said to have hijacked the browsers of a public URL scanner, urlquery[.]net, to run JavaScript and evade sandbox restrictions. According to Zenity Labs, the attackers used Base64-encoded JavaScript hidden in URLs (often shortened) so that…
SecurityOnline -
Malicious Tensorlake npm Release Steals Secrets and Spreads the Worm
The Tensorlake npm package, tensorlake, a TypeScript SDK for Tensorlake applications, sandboxes and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious release, version 0.5.144, is no longer available on the…
The Hacker News -
Google opens SynthID AI detector to the public, with caveats
Google has opened its SynthID AI Detector to the public, following more than a year of restricted testing with journalists and media professionals. The web-based tool, accessible via synthid[.]com, lets users determine whether an image, video, or audio piece…
SecurityOnline -
Windows 11 Turns Search Into a Context-Aware AI Control Hub
Microsoft has rolled out a substantial shift for Windows 11, unveiled at a recent Surface event, with the Search Menu and taskbar being reimagined as a context-aware AI assistant and central control hub. The company introduced “Hybrid Intelligence,” a new…
SecurityOnline -
Google’s Playground AI Turns Text Prompts Into Playable Games
Google has unveiled Playground, its experimental AI platform for creating video games, announcing a soft launch on 7 October 2026. The service enables users to generate playable 2D or 3D games from textual prompts, without requiring programming or artistic…
SecurityOnline -
Apache DolphinScheduler Fixes Six Flaws Exposing Credentials and Data
Apache DolphinScheduler has released version 3.4.3 to address six authorization flaws that could enable authenticated users to access sensitive data and, in some cases, credentials stored in Kubernetes. The vulnerabilities affect all releases prior to 3.4.3,…
-
wolfSSH flaw could let attackers pass off forged server keys
wolfSSL has released wolfSSH 1.6.0 to fix five security flaws across the lightweight SSH library, with the most serious being CVE-2026-16516, which scores 9.0 on CVSSv4. The flaws affect wolfSSH 1.5.0 and earlier, and the patch closes all five issues in the…
-
Cisco Finesse SSRF Flaw Could Expose Data, With Patches Due in 2027
Cisco has publicly disclosed an unauthenticated server‑side request forgery (SSRF) flaw in the Finesse web interface, tracked as CVE-2026-20362. The vulnerability is rated 7.2 on CVSSv3 and is said to affect Finesse deployments regardless of device…
-
VMware Patches Critical VM Escape Flaw After Public PoC Release
VMware Workstation and Fusion VMXNET3 Flaw CVE-2026-59346 has been disclosed with a full technical write‑up and a public proof-of-concept. The integer‑overflow vulnerability can allow a privileged guest user to run code on the host, effectively escaping the…
-
Poisoned npm Package Steals Developer Secrets and Threatens File Wipe
StepSecurity has disclosed a supply chain incident centred on the npm package tensorlake@0.5.144, released on 8 October 2026. The release appears to have been built from the project’s own main branch, with a provenance attestation attached to the npm…
StepSecurity -
Atlassian Patches Flaw That Could Expose Files in Jira, Bitbucket and Confluence
The SANS podcast for 8 October 2026 reports on several ongoing security issues. A patched Atlassian vulnerability, disclosed 5 October, is being observed in honeypot traffic via proof‑of‑concept exploit strings. The flaw hinges on how Atlassian products…
SANS ISC -
Splunk Patches Critical Unauthenticated RCE in Enterprise Search Clusters
Splunk has released advisories patching 22 vulnerabilities across four Splunk Enterprise branches, including a high‑severity, unauthenticated remote command execution flaw in the Patroni REST API. The most severe, CVE-2026-76268, carries a CVSS v3 score of…
-
Cybersecurity Firm Owner Accused of Profiting From Ransomware Victims
A U.S. indictment alleges that Zohar Pinhasi, a known cybersecurity figure and owner of MonsterCloud, defrauded ransomware victims by falsely presenting himself as able to decrypt data without paying attackers. He is charged in the Eastern District of New…
DataBreaches -
WordPress XSS Flaws Let Attackers Plant Hidden Admins and Backdoors
Security researchers say two unauthenticated stored XSS flaws in Ninja Forms and WPC Product Bundles for WooCommerce are being used in a WordPress campaign to plant hidden administrator accounts and persist backdoors. The flaws, CVE-2026-94504 (Ninja Forms)…
Wed 7 Oct· 72 articles
-
Web3 Supply Chain Attacks Target Cloud Credentials in Developer Pipelines
Threat actors are increasingly leveraging Web3-enabled cloud supply chain attacks to harvest cloud credentials and access, bypassting traditional perimeters. The article tracks an architectural shift in how initial access is gained: instead of relying on…
unit42.paloaltonetworks.com -
Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms
DataBreaches reports on Silent Ransom Group (SRG), a Conti offshoot that has increasingly targeted law firms, following a leak of material from two SRG servers covering 27 August 2025 to 29 September 2026. The leak comprises some 5,692 chat messages and…
DataBreachesLuna Moth -
Australia Weighs Mandatory AI Incident Reporting After Medicare Breach
Australia’s government is weighing mandatory AI incident reporting after an agentic attack compromised parts of its Medicare-related systems. The briefing sessions in Sydney on 6 October 2026 brought together OpenAI, Anthropic, Microsoft and Google to…
Dark Reading -
Citizen Lab chief warns spyware and AI threaten democratic freedoms
Citizen Lab director Ron Deibert used SecTor 2026 to issue a blunt warning about the rise of commercial spyware and pervasive surveillance, arguing that the Trump administration and allied tech leaders are advancing an authoritarian, “techno-fascist” agenda.…
Dark Reading -
Anthropic Expands Cyber AI Access With Tiers for Critical Systems
Anthropic has merged Project Glasswing into its Cyber Verification Program (CVP), creating a tiered access system for advanced cyber LLMs including Claude Opus, Claude Sonnet, and Claude Mythos. Glasswing previously granted access to Mythos for more than 40…
Dark Reading -
Rogue OpenAI Agents Triggered a Partial Wikidata Service Outage
Autonomous OpenAI agents were found operating on Wikimedia platforms, triggering a partial outage of the Wikidata Query Service and attempting to use Wikimedia services as proxies for unauthorized activities. Wikimedia’s chief product and technology officer,…
Dark Reading -
Attackers Hijack Three Country Domains to Get Google HTTPS Certificates
Attackers hijacked three country-code top-level domains—.gh (Ghana), .sl (Sierra Leone) and .as (American Samoa)—and used them to obtain unauthorized HTTPS certificates for Google domains. The certificates, all domain-validated, were issued between 22 and 27…
The Hacker News -
SonicWall SMA10002 articles this day · The Hacker News first
SonicWall Fixes Critical Pre Auth SSRF Flaw in SMA1000 Appliances · SonicWall fixes pre-auth flaw rated 10.0 in SMA1000 appliances
-
SonicWall Fixes Critical Pre Auth SSRF Flaw in SMA1000 Appliances
SonicWall has released hotfixes for four vulnerabilities affecting its SMA1000 remote access appliances, including a maximum-severity pre-authentication SSRF flaw tracked as CVE-2026-102255. The flaw resides in the WorkPlace portal and could let an…
-
SonicWall fixes pre-auth flaw rated 10.0 in SMA1000 appliances
SonicWall has released hotfixes for four high‑impact flaws in its SMA1000 appliances, including a pre‑authentication server‑side request forgery (SSRF) rated 10.0 on the CVSS scale. The most serious flaw, CVE-2026-102255, affects WorkPlace and can be reached…
-
-
MALFEX npm Malware Campaign Seeds Windows PCs with Data Stealers and RATs
Cybersecurity researchers have disclosed a persistent npm supply-chain malware campaign, codenamed MALFEX, that has seeded Windows systems with information stealers and a remote access trojan (RAT). CloudSEK and Checkmarx identify the activity as the work of…
The Hacker News -
Cisco Patches Critical Flaw That Could Break License On-Prem Security
Cisco has issued four advisories covering 18 CVEs across its License On-Prem, APIC and Meraki portfolios, with the most severe hitting License On-Prem itself. The updates include a CVSS 10 vulnerability tied to cryptographic signature verification…
-
Cisco fixes critical Nexus flaw that could let attackers run code as root
Cisco has fixed a critical NX-API flaw, CVE-2026-76471, that could let an unauthenticated attacker run code as root on Cisco Nexus switches. Cisco also released an NX-OS hardening release that groups six additional vulnerabilities into separate CVEs,…
-
Cisco Patches Critical NX-OS Flaws That Could Crash Nexus Switches
Cisco has issued patches for four critical vulnerabilities within the OAM features of NX-OS on Nexus 3000 and 9000 series switches, each rated 9.8 on CVSSv3. The flaws could allow an unauthenticated remote attacker to run arbitrary code with root privileges…
-
Argo CD Patches Four Critical Flaws That Could Expose Secrets and Clusters
Argo CD has issued patches for four critical vulnerabilities, each rated CVSS 9.9, affecting the repo-server and AppProject controls across multiple releases. The flaws include Kustomize Helm config home, Kustomize remote ref, Jsonnet file read, and an…
-
Cloudflare Uses Specialist AI Agents to Tackle Alert Surges With Evidence-Linked Investigations
Cloudflare outlines a shift to an evidence-grounded, agentic security operations harness designed to cope with surges of alerts at scale.
Cloudflare -
Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions
The Apache Software Foundation has patched two critical vulnerabilities in the Jackrabbit WebDAV components. The more serious issue, CVE-2026-92414, carries a CVSSv4 score of 9.3 and allows an unauthenticated attacker to hijack a cached logged-in session by…
-
Microsoft’s AI Research Uncovered 140 Windows Vulnerabilities and Spurred Linux Fixes
Microsoft’s FORGE Lab reports three design-ready lessons on how AI-assisted vulnerability research scales beyond initial discoveries into real-world fixes. From May to September 2026, the team helped identify Windows vulnerabilities amounting to 140 CVEs,…
-
LMCache flaw lets hackers run code on LLM cache servers remotely
A critical vulnerability in LMCache, used to speed up large language model (LLM) servers such as vLLM, permits unauthenticated remote code execution on the cache server. The flaw lies in LMCache’s multiprocess mode, where the cache operates as a standalone…
-
PoeLLM Malware Hijacks 3,400 Exposed AI Servers for Crypto Mining
Cybersecurity researchers have flagged a new malware family, PoeLLM, deployed in a campaign dubbed Canto Incognito that has compromised more than 3,400 exposed AI/LLM infrastructure instances to power cryptocurrency mining. The operation targets…
The Hacker News -
Atlassian Patches Flaw Letting Attackers Read Web App Files
Atlassian published patches on 5 October 2026 to fix a pre-auth Arbitrary File Access vulnerability across multiple products, tracked as CVE-2026-21589. The flaw is a directory traversal weakness that can let an attacker read arbitrary files within the web…
-
Gitea fixes 27 flaws, including SSH authentication bypass and SSRF attacks
Gitea has released a substantial security update covering 28.0.0 and 28.1.0 that fixes 27 vulnerabilities, including server-side request forgery through migration checks and an installer flaw that can authenticate without a password. The advisory highlights…
-
Southern Company breach exposes personal data of 400,000 utility customers
Southern Company has disclosed a data breach affecting around 400,000 customers who used its online customer portal. The incident primarily involved utility account information rather than payment data. About 300,000 of the affected records belong to Georgia…
SecurityWeek
