News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Tue 13 Oct· 85 articles
-
Adobe and Microsoft Patch Thousands of Flaws in Record Update
The October 2026 security update cycle sees Adobe patching across 11 bulletins addressing 174 CVEs spanning Dimension, Commerce, Substance 3D, Bridge and related tools, with several critical issues. Notably, Adobe ColdFusion (APSB26-144) contains 32 critical…
-
Microsoft Patches Windows Shell Flaw Exploited in Malicious File Attacks
Microsoft’s October 2026 Patch Tuesday patches across a wide attack surface, addressing 1,417 disclosed vulnerabilities, with 76 rated as critical. The update set includes fixes for a substantial number of Office and .NET/Framework components, plus notable…
SANS ISC -
Docker Hub2 articles this day · The Hacker News first
Docker fixes critical flaw that could hijack developers’ access tokens · Docker Hub patched critical GhostPat flaw that let attackers hijack image access
-
Docker fixes critical flaw that could hijack developers’ access tokens
Docker Hub has released a security advisory for CVE-2026-105445, describing a token flaw that could enable an attacker to secretly reassign a target user’s personal access token (PAT) during an account-to-organisation conversion. The flaw, rated CVSS 9.4…
-
Docker Hub patched critical GhostPat flaw that let attackers hijack image access
Docker has patched a critical vulnerability in Docker Hub that allowed one user to perform actions on another user’s images, effectively letting an attacker push, pull or delete images under a different identity. The flaw lived in the feature that converts a…
-
-
Ivanti Connect Secure7 articles this day · SecurityOnline first
Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials · CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution
-
Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials
SecurityWeek reports that Ivanti has disclosed a zero-day chain affecting its Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, which allowed unauthenticated remote code execution with elevated privileges. The issue was exploited in the wild,…
-
CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-104935, carries a CVSS of 8.6 and is described as an authentication bypass caused…
-
Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In
An attacker chained three Ivanti Connect Secure zero-days to gain root-level access without logging in, with the exploitation observed in the wild starting on 3 October and disclosure on 13 October 2026. The first two flaws form an authentication bypass and…
-
Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive
Ivanti Connect Secure has a high‑severity zero‑day, CVE-2026-104935, described by Ivanti as an unauthenticated authentication bypass (CWE-290) that allows remote command execution. The vulnerability, rated CVSSv3.0 8.6, affects Ivanti Connect Secure…
-
Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs
Ivanti Connect Secure (ICS) devices were found to be exploited in a chained zero‑day sequence, beginning in early October 2026. Security firm Volexity and Ivanti report that a threat actor, tracked as UTA0576, used an authentication bypass to reach a…
-
CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. The entry affects Ivanti Connect Secure and describes an authentication bypass by spoofing that lets a remote, unauthenticated attacker execute arbitrary…
-
Ivanti Connect Secure flaw bypasses authentication in active attacks
Ivanti Connect Secure has a newly disclosed vulnerability, CVE-2026-104935, which Ivanti confirms is being exploited in the wild. The flaw allows a remote, unauthenticated attacker to bypass authentication by spoofing and then execute arbitrary commands on…
-
-
Anthropic warns AI worms could turn smart TVs into self-spreading botnets
Anthropic has warned that small AI models could soon develop autonomous, self-propagating capabilities on internet‑connected devices such as IoT ovens and Android TV boxes. The concern is that these “AI worms” could replicate themselves across compromised…
The Hacker News -
Wazuh fixes 15 flaws that could let attackers take over deployments
Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now. Related Posts: Docker Hub Security Advisory: CVE-2026-105445 Token Flaw Fortinet Patches Critical…
-
Fortinet Patches Critical Flaws Enabling Unauthenticated Remote Attacks
Fortinet has released a set of patches addressing 13 vulnerabilities across eight product lines, issued on 13 October 2026. The most serious flaws are two unauthenticated, remote-exploitation risks: an authentication bypass in FortiSandbox (CVE-2026-107656)…
-
Critical SAP Python SDK flaw could expose OAuth credentials via SSRF
SAP has disclosed a critical SSRF flaw in its Cloud SDK for Python that can exfiltrate OAuth2 client credentials. The vulnerability, tracked as CVE-2026-89111, affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the Python…
-
Adobe Patches 140 Flaws Across Ten Products, Including Commerce
Adobe has published ten security advisories detailing around 140 vulnerabilities across ten products, including ColdFusion, Commerce, Photoshop, Substance 3D, Dimension, FrameMaker and Bridge. The disclosures show a broad patch effort with specific focus in…
SecurityWeek -
Google quadruples Chrome memory bug bounty rewards after backlash
Google has signalled a partial U-turn on its Chrome bug bounty reforms, moving to lift rewards for memory safety vulnerabilities while keeping a tighter overall structure. After cutting base payouts in April to prioritise actionable reports, the company has…
SecurityWeek -
Cloudflare redesigns D1 to handle millions of serverless databases at scale
Cloudflare’s D1 is a serverless SQLite-based database designed to scale to millions of databases.
Cloudflare -
GitHub Tightens npm Trust After SlugFest Exposed Package Hijacks
GitHub has tightened npm trusted publishing after researchers exposed a weakness that could let attackers hijack packages without credential theft. The changes, announced 48 hours after a trusted publishing configuration is created, mean unvalidated…
The Hacker News -
Zoom Patches Four High Severity Flaws in Workplace Clients
Four Zoom Workplace vulnerabilities, including privilege escalation and certificate flaws rated up to CVSS 8.1, are now fixed. Update to 7.2.0 or later. Related Posts: Docker Hub Security Advisory: CVE-2026-105445 Token Flaw Wazuh Fixes 15 Vulnerabilities,…
-
Stolen Employee Credentials Expose Meta Code, Affect 1,500 People
Meta has disclosed that roughly 1,500 individuals were affected by an intrusion linked to GitHub repositories containing the company’s software code. The incident, detected in the preceding weeks, involved an outside group gaining access using an employee’s…
SecurityWeek -
Cloudflare Cuts Data Traffic by 70 GB/s to Keep Its Backbone in Check
Cloudflare reports that more than 20% of the web sits behind its network, and the Data team runs the data pipeline powering Logs, SQL API, observability and more. Faced with traffic growing at exponential rates against linear hardware growth, the team…
Cloudflare -
Ivanti flaws expose Intune and Xtraction credentials, prompting secret rotation
Ivanti released two security advisories on 13 October 2026 detailing six vulnerabilities across Neurons Patch for Intune and Ivanti Xtraction, with two rated CVSS 9.9. The disclosures emphasise credential theft risk, noting that stolen secrets could grant…
-
Siemens Warns of Critical Flaws in SIMATIC S7-1500 Web Server
Siemens has disclosed eight unpatched flaws in the SIMATIC S7-1500 Web Server, disclosed on 13 October 2026. The vulnerabilities reside in the web server’s Trace page and are linked to improper handling of data in imported trace files, enabling cross-site…
SecurityOnline -
LiteLLM flaws let attackers seize admin access and run code remotely
Check Point Research’s assessment, published on 13 October 2026, scrutinised LiteLLM v1.77.7, a popular open‑source LLM gateway. They identify several high‑severity flaws that could enable attackers to bypass access controls, read arbitrary files, seize…
Check Point -
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Anthropic researchers have published findings showing that very small AI models could autonomously replicate across networks of IoT devices, raising concerns about AI-powered botnets. In their experiments, a 26‑billion‑parameter model, Gemma4-26B-A4B, was…
Security Affairs -
Cyber incidents disrupt European retailers as attacks hit key brands
Several European retailers have confirmed cyber incidents disrupting operations. Netherlands-based Ahold Delhaize said on 12 October 2026 that it was experiencing “a security issue” within its networks and had to take certain systems offline, affecting three…
Infosecurity -
GitLab2 articles this day · Rapid7 first
GitLab patches critical flaw letting attackers run code without logging in · GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes
-
GitLab patches critical flaw letting attackers run code without logging in
GitLab has patched a critical vulnerability tracked as CVE-2026-97229 with a CVSS v3 score of 10.0, which could allow unauthenticated attackers to run arbitrary code on GitLab servers. The flaw stems from weak validation of regular expressions in CI/CD…
-
GitLab fixes critical flaw that lets attackers execute code via CI/CD regexes
CVE-2026-97229 is a critical, unauthenticated remote code execution flaw in GitLab’s CI/CD regular expression compiler, tracked as CWE-190 (integer overflow). GitLab reports a CVSSv3.1 score of 10.0, with exploitation possible when a malicious regular…
-
-
n0n Extortion Group Targets 38 Maritime Operators in Data Theft Campaign
The SOCRadar cyber threat tracker reports that the n0n extortion group expanded its activity on 12 October 2026 by adding 38 global ports, shipping lines, port IT providers and related operators to its Dark Web leak site. The batch spans Brazil, Spain,…
SOCRadarn0n -
Only 25% of Security Teams Use Agentic AI in Active Defence
Defenders are still reluctant to deploy agentic AI as a core cybersecurity tool, even as organisations pour resources into AI for defence. The Enterprise Threat Intelligence Report: 2026 from Flashpoint finds only a quarter (25%) of security teams are…
Infosecurity -
Microsoft-Owned Xandr Fined €8.6 Million Over Grindr Data Sharing
The Norwegian Data Protection Authority has fined Xandr, the advertising arm once owned by AT&T and now under Microsoft, €8.6 million (about $9.62 million) for unlawfully relaying Grindr users’ sensitive data to advertisers. The breaches occurred between…
The Hacker News -
Misconfigured Server Exposed Medical Data on 109,700 People
A data exposure affecting Liberating Research, a UK-based medical survey company, was disclosed after UpGuard researchers identified an Elasticsearch server misconfigured to allow public access to the data. The server stored a mix of personally identifiable…
DataBreaches -
Norway fines ad tech firm Xandr $9.6 million over Grindr data sharing
Norway’s data protection regulator, Datatilsynet, has fined the advertising technology firm Xandr 92 million Norwegian kroner (about $9.6 million) for unlawfully processing and sharing sensitive information about Grindr users. The enforcement concerns Grindr…
Malwarebytes -
AI SPERA to Demonstrate Threat Intelligence and Exposure Tools in Tokyo
Criminal IP, the cyber threat intelligence and attack surface management offering operated by AI SPERA, will be demonstrated at Security Days Fall 2026 Tokyo, running from 21 to 23 October at the TAKANAWA GATEWAY Convention Center. At booth B20, the team…
SecurityOnline -
Experts and Ransomware Groups Weigh In on ShinyHunters’ Future
The article is a brief pointer to an analysis by Marco A. De Felice of SuspectFile, rather than a report of its findings. It says he asked cybersecurity experts and ransomware groups for their views on ShinyHunters, including the group’s future, but does not…
DataBreachesShinyHunters -
Attackers Set French Supermarket Freezers to Defrost, Causing Fires
Overnight from 11 to 12 October 2026, hundreds of French supermarkets were hit when attackers remotely forced refrigeration controllers to switch into defrost mode, heating fridges and freezers to as high as 50°C. The resulting spoilage and at least two…
-
Swann camera flaws let local attackers view live feeds without authentication
Swann Communications SWIFI-SE2KIC cameras with firmware version 2.0.22 or earlier are implicated in three related vulnerabilities that could allow an attacker on the local network to access live video information without authentication. The issues are listed…
-
Anthropic warns small AI models could soon self-replicate across IoT devices
Anthropic’s Frontier Red Team warns that small AI models could soon self-replicate across IoT devices, running inference directly on compromised equipment rather than from a data centre. In experiments, researchers used 15 off-brand Android TV boxes at about…
SecurityWeek -
AI Powered Attacks Spur a New Push for Runtime Identity Controls
The Hacker News reports on an upcoming expert-led webinar titled “How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls,” published on 13 October 2026. The piece argues that the real risk of identity theft goes beyond initial sign-in:…
The Hacker News
