News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 20 so far |
Articles per day
The last 14 days and today so far (UTC)Dashed line: average of the 14 complete days. Totals above each bar.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 12 Oct | 56 | 6 |
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Today, Mon 26 Oct | 20 so far | 1 |
Fri 9 Oct· 70 articles
-
Flax Typhoon2 articles this day · The Hacker News first
US Seizes Domains Used by Chinese Hackers to Scan and Spy on Networks · FBI Seizes Seven Domains Used by China Linked Flax Typhoon to Target US Infrastructure
2 outlets-
US Seizes Domains Used by Chinese Hackers to Scan and Spy on Networks
The United States says it has disrupted two tools built by Chinese firm Integrity Technology Group and used by state-sponsored hacking groups against critical infrastructure. MicroScan was used to scan networks for vulnerabilities; FishHub let users remotely…
SecurityWeek -
FBI Seizes Seven Domains Used by China Linked Flax Typhoon to Target US Infrastructure
The FBI and Department of Justice announced the disruption of a China-linked threat group activity known as Flax Typhoon, which used a set of compromised domains to scan and, in some cases, intrude into U.S. critical infrastructure. Seven domains were…
The Hacker News
-
-
Raspberry Pi OS update fixes desktop bugs and auto-mounts encrypted USB drives
Raspberry Pi OS has received a desktop-focused update, with the Raspberry Pi Foundation releasing the latest image. Although the core Linux kernel version remains the same (6.18.50 LTS), the release concentrates on a broad sweep of bug fixes and fine-tuning…
SecurityOnline -
Hackers Earn $562,500 for Three Remote Exploits on Pixel 10
Three teams demonstrated remote exploits against Google’s Pixel 10 at Pwn2Own Ireland on 8 October 2026, with the event confirming patches were required for targets. The Pixel 10 entries were remote exploits, meaning breaches were delivered via web content…
-
Anthropic launches AI flaw scanner and OT infrastructure defence programme
Anthropic has unveiled two cybersecurity initiatives stepping up how it handles AI-generated vulnerability findings. The OSS Scanner service uses Anthropic’s latest model capabilities to periodically scan open-source projects, with maintainers opting in to…
SecurityWeek -
Microsoft slashes Family plan storage from 6TB to a shared 2TB
Microsoft has begun rolling out a overhaul of storage for Microsoft 365 Family and Premium subscriptions, shifting away from per-user quotas to a shared pool. Previously, each member on a Family plan enjoyed an independent 1 TB of OneDrive storage, giving up…
SecurityOnline -
NetScaler ADC3 articles this day · SecurityOnline first
Citrix Patches Critical NetScaler Flaw That Could Enable Remote Code Execution · Citrix urges urgent patching of critical NetScaler flaw that risks remote code execution
-
Citrix Patches Critical NetScaler Flaw That Could Enable Remote Code Execution
Citrix has released patches for a critical vulnerability in NetScaler ADC and NetScaler Gateway that could allow remote code execution or denial-of-service under certain configurations. The flaw, tracked as CVE-2026-107406, is described by Citrix as a memory…
-
Citrix urges urgent patching of critical NetScaler flaw that risks remote code execution
Citrix is urging immediate patching of a critical NetScaler vulnerability tracked as CVE-2026-107406, a memory overflow that could allow remote code execution or cause a denial-of-service. The flaw affects NetScaler ADC and NetScaler Gateway appliances when…
-
Citrix Urges NetScaler Users to Patch Critical Flaw Enabling Remote Code Execution
Citrix has flagged a critical memory overflow flaw in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-107406, with a CVSS v4 score of 9.5. The vulnerability may lead to remote code execution or denial of service when NetScaler appliances are…
-
-
Ten AI giants pledge stronger UK data protections after ICO warning
Ten major AI firms, including Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI, have pledged or committed to strengthen data protection policies in the UK after the ICO urged clearer transparency around how…
Infosecurity -
AI-Driven Hacker Used ARTEX to Target South Korean Financial Firms
CrowdStrike says an unidentified attacker targeted South Korean financial organisations from late September to early October 2026, stealing data that was being prepared for sale. Industry reports described breaches at several firms, including a bank’s…
Security Affairs -
AI Agent Logs Expose Attacker Chats and Help Trace Cyber Intrusions
On 9 October 2026, the SANS Internet Storm Center’s Friday Stormcast notes continued concerns about how AI agents are used in cyberattacks and how defenders can trace those activities. The episode highlights two scripts by Jim Clausing that convert AI-agent…
SANS ISC -
CISA Flags Five Actively Exploited Flaws in Enterprise Tools
The article reports that on 8 October 2026 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five high-risk vulnerabilities to its active threat list. These flaws are actively exploited in the wild and affect popular enterprise tools,…
-
Hackers Win $1.2 Million at Pwn2Own, With Pixel 10 Bugs Leading the Payouts
Pwn2Own Ireland 2026 concluded with hackers earning more than $1.2 million from exploits across phones, printers, smart speakers, smart home hubs, wellness devices, AI infrastructure and coding tools, and cloud databases. The standout prize went to Google…
SecurityWeek -
Phishing campaign abuses Power BI pages to install rogue ScreenConnect clients
A phishing operation has been observed abusing Microsoft Power BI to install rogue ScreenConnect remote access clients. In this campaign, attackers hosted a fake document on a public Power BI page that appeared legitimate to email filters. Recipients who…
SecurityOnline -
IBM Patches Critical Verify Access Flaws Enabling Remote Code Execution
IBM has released security updates to fix 22 vulnerabilities across its Verify Access and related identity management products. The roundup lists a total of six CVEs, with five rated Critical and one High. The highest-severity issue is CVE-2026-78401, scored…
-
Researchers Predict When AI Companions May Start Giving Rogue Answers
Researchers from George Washington University have published a paper exploring whether the timing and cause of AI going rogue can be predicted, and whether such predictions can help prevent it. The work focuses on scenarios where personal AI companions…
SecurityWeek -
OpenAI Exposes Russian and Iranian Networks Planting Fake News
OpenAI disrupted two state-aligned influence campaigns by terminating multiple accounts linked to Russia and Iran that were running deceptive “false front” operations to plant propaganda in legitimate news outlets. The campaigns used artificial intelligence…
SecurityOnline -
Chinese Hackers Target Critical Infrastructure to Steal Data and Spy
Threat actors described as Chinese state hackers are alleged to be targeting critical infrastructure worldwide to steal data for long‑term intelligence collection. The piece pools together claims that these actors use automated tooling to identify…
SecurityOnline -
TP-Link Patches Tapo Cameras Flaws That Could Let Attackers Hijack Video Streams
TP-Link has disclosed three high‑severity vulnerabilities in its Tapo C325WB cameras, all affecting hardware version V2. The flaws could enable unauthenticated attackers on the adjacent network to manipulate live video streams or the camera’s settings. The…
-
Hackers Exploit AhsayCBS Flaws to Gain SYSTEM Access and Deploy Miners
Security researchers warn of active, wild exploitation of two AhsayCBS vulnerabilities that together enable remote code execution on affected hosts. The attackers chain an authentication weakness (CVE-2026-105133) in ApiStructsAction[.]java with a remote…
-
Telegram Desktop flaw lets attackers steal session keys with one click
SecurityResearchers publicly disclosed a high-severity vulnerability in Telegram Desktop, designated CVE-2026-107181, which enables an account takeover through a remote attacker stealing session keys with a single click. The flaw affects Telegram Desktop…
-
HPE Patches Critical Flaws That Could Expose Server Management Tools
HPE has released fixes for two critical flaws across its server and network management tools. The first, CVE-2026-79820, affects iLO 7 and could let a remote attacker obtain administrative access without login, when used with HPE Compute Ops Management…
Thu 8 Oct· 75 articles
-
Microsoft launches PQC TLS pilot to test post-quantum certificates
Post-quantum authentication is moving from theory to concrete testing, with Microsoft launching a PQC TLS Pilot Program to help certificate authorities evaluate interoperability and operational readiness in controlled environments. Key focus is on how…
Microsoft -
AWS AgentCore flaw let one chatbot prompt expose an entire account
A now-patched vulnerability in AWS Bedrock’s AgentCore could allow a single prompt to a public-facing AI chatbot to seize control of an entire AWS account’s AgentCore deployment. Researchers from Zenity Labs demonstrated that agents deployed via Bedrock…
Dark Reading -
Let’s Encrypt will cut certificate lifetimes to 64 days in 2027
Let’s Encrypt plans to reduce the lifetime of free SSL/TLS certificates from 90 days to 64 days, with the new 64‑day window taking effect from 10 February 2027. The move continues the organisation’s drive toward automated certificate management.…
Ars Technica -
Italy’s Foreign Ministry Fends Off Website Attack as DDoS Risk Looms
Italy’s Foreign Ministry says its website is currently under attack, with its protection systems mitigating the incident so far and no disruption reported. The ministry is monitoring the situation alongside the Polo Strategico Nazionale, the national cloud…
Security Affairs -
US arrests alleged ATM jackpotting architect over $5.1 million heist
US authorities have arrested and arraigned a 50-year-old Venezuelan member of the Tren de Aragua (TdA) cartel, Anibal Alexander Canelon Aguirre, on charges related to an ATM jackpotting scheme that used Ploutus-D malware to compromise cash machines and…
Dark ReadingTren de Aragua -
StepSecurity Maps AI Agent Skills to Expose Supply Chain Risks
StepSecurity has introduced two complementary inventories to map AI agent skills in your development environment: on developer machines through Dev Machine Guard, and in GitHub repositories via an Agent Skills page under GitHub. The Dev Machine Guard view…
StepSecurity -
CISA Flags Actively Exploited ProFTPD Flaw That Exposes Files
CISA added CVE-2015-3306, the ProFTPD Improper Access Control Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026. The vulnerability affects ProFTPD and could let remote attackers read and write arbitrary files using the…
-
CISA Flags Actively Exploited ONLYOFFICE Flaw That Could Enable Remote Code Execution
CISA added CVE-2021-3199 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026. The vulnerability affects ONLYOFFICE Docs and is a path traversal flaw in ONLYOFFICE Docs Server that could allow remote code execution. The flaw can occur…
-
CISA Confirms Exploitation of Strapi Flaw Exposing User Data
CISA added CVE-2023-22894 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026. The vulnerability affects Strapi and is named the Strapi Cleartext Storage of Sensitive Information Vulnerability; it could expose sensitive user details to…
-
CISA Flags Actively Exploited Apache Struts Flaw for Urgent Patching
CISA added CVE-2016-3081 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026. The vulnerability affects Apache Struts and could let a remote attacker execute arbitrary code when Dynamic Method Invocation is enabled. Apache describes…
-
CISA Flags Exploited BIND Flaw That Can Take DNS Servers Offline
CISA added CVE-2015-5477 to its Known Exploited Vulnerabilities (KEV) catalogue on 8 October 2026. The vulnerability affects ISC BIND and is a data processing error that could let remote attackers cause a denial of service by sending TKEY queries. The flaw…
-
China-Based Hackers Accused of Stealing Emails Across 7 Countries
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The company,…
-
Russia Aligned Hackers Refine MatchBoil Malware to Spy on Ukraine’s Key Sectors
A Russia-aligned cyber-espionage actor known as UAC-0099 is refining a malware dropper called MatchBoil to target Ukrainian organisations across the transportation, manufacturing and energy sectors. ESET's analysis identifies MatchBoil as the delivery…
Dark ReadingUAC-0099 -
ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools
A weekly ThreatsDay round-up notes a miscellany of mischief, from a rogue ransomware affiliate who kept profits for himself to an exposed server containing intrusion tools. The piece highlights that gang betrayals, careless operators, and sloppy design…
-
BraZetsu’s Persistent Server Patterns Exposed Its Infrastructure After IOCs Aged
Hunt[.]io traced BraZetsu’s infrastructure and found that hosting patterns and certificate data remained useful long after the original indicators of compromise (IOCs) had become outdated. Group-IB had previously described BraZetsu as a Python framework…
Security AffairsBraZetsu -
New Forensic Tools Reconstruct AI Agent Activity from Stored Data
Two new forensic review scripts have been added to FOR577’s material, aimed at reconstructing AI agent activity rather than replaying actions. The opencode-chat-replay[.]py script turns stored session data from opencode into readable transcripts or…
SANS ISC -
Attackers Hijack Three Country Domains to Impersonate Google and Others
Attackers have hijacked three country-code top-level domain namespaces—.gh (Ghana), .sl (Sierra Leone) and .as (American Samoa)—to impersonate Google and other services. By compromising the infrastructure behind these ccTLDs, they were able to pass domain…
Malwarebytes
