News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Thu 15 Oct· 78 articles
-
Cyberattacks Turn Refrigeration Units Into Heaters Across 400 French Stores
Hundreds of French grocers were hit by cyberattacks that manipulated refrigerated display and storage equipment, turning cooling units into heating systems and spoiling vast quantities of perishable stock. Overnight on Monday, attackers breached commercial…
-
Palo Alto Networks Cloud NGFW2 articles this day · The Hacker News first
Palo Alto patches exploited PAN-OS zero-day allowing root access to firewalls · Palo Alto Patches PAN-OS Flaw Exploited to Run Code as Root
-
Palo Alto patches exploited PAN-OS zero-day allowing root access to firewalls
Palo Alto Networks has released patches for a PAN-OS zero-day vulnerability tracked as CVE-2026-0322, which has been exploited in limited attacks against the management interface of PAN-OS. The flaw allows remote code execution and can be exploited by an…
-
Palo Alto Patches PAN-OS Flaw Exploited to Run Code as Root
Palo Alto Networks has released security updates for PAN-OS after a high‑severity remote code execution flaw, tracked as CVE-2026-0322 (CVSS 8.6), was observed being exploited in the wild. The vulnerability affects PAN-OS running on PA‑Series and VM‑Series…
-
-
Ahsay Backup fixes exploited flaws after patches failed to stop attackers
Singapore-based Ahsay Backup has issued updated security patches for AhsayCBS to address two flaws that have been observed in the wild being exploited to deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and…
-
Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access
Cisco has disclosed that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519 with a CVSS of 9.8/10. The flaw affects the AMP (Advanced Malware Protection) component and arises when…
-
CodeAudit VS Code Extension Sends Pasted Code Over Unencrypted HTTP
Akamai researchers have uncovered that the CodeAudit AI extension for Visual Studio Code operates a background activity listener that monitors developer workspace edits from startup and remains active for the entire VS Code session. The extension, published…
SecurityOnline -
Android Trojan Replaces Banking Apps to Bypass Security Checks
ThreatFabric researchers have detailed a new Android banking trojan named Hirudo that goes beyond overlaying fake screens by replacing targeted banking apps with modified copies. Instead of presenting a counterfeit login, Hirudo uninstalls the legitimate app…
Security Affairs -
Vercel patches critical Next.js flaws that let attackers run code remotely
Vercel released out-of-band security updates for Next[.]js on 14 October 2026, delivering versions 16.4.1 and 15.5.28 to address two critical unauthenticated remote code execution flaws and a high-severity denial-of-service issue. The fixes cover…
-
Citrix Patches XenServer Flaws That Could Let Guests Crash Hosts
A Citrix security update fixes seven XenServer and UniconOS flaws, including guest-to-host and privilege escalation bugs. Patch hosts and thin clients. Related Posts: SiteGuard Server Edition Flaw CVE-2026-106931 Exploited in the Wild for Root Access Juniper…
-
Windows 11 KB5127648 aims to fix long-running mouse lag in games
Microsoft has released Windows 11 KB5127648, addressing a long-running issue that caused mouse input lag during gaming sessions. The update is officially documented as the first time Microsoft has described this particular remediation in its release notes,…
SecurityOnline -
Attackers Exploit SiteGuard Flaw to Seize Server Control as Root
A SiteGuard Server Edition vulnerability, CVE-2026-106931, is exploited in the wild and grants root or SYSTEM access. Update to Ver8.00 Update 5 now. Related Posts: Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws Juniper…
-
Google quadruples Chrome memory bug bounties, offering up to $20,000
Google restructures its Chrome VRP rewards, raising baseline payouts for memory corruption bugs to $2,000 and offering up to $20,000 for critical exploits. Related Posts: npm Trusted Publishing Now Expires After 48 Hours Google Play AI Apps Revolutionize…
SecurityOnline -
Epic’s rebuilt Launcher brings Linux support but sparks Vibe Coding backlash
Epic Games’ newly rebuilt Epic Games Launcher has sparked a significant backlash centred on the company’s marketing framing, even as the release itself delivers notable technical improvements. The update is described as lightweight and highly responsive,…
SecurityOnline -
Windows 11 will block removable ReFS drives by default from 2027
Microsoft is tightening how ReFS (Resilient File System) volumes on removable or external storage are supported in Windows 11 and Windows Server. Starting with the October 13, 2026 monthly security update, Windows will audit removable ReFS volumes by…
SecurityOnline -
GitHub Closes npm Publishing Flaw Exploiting Reused Repository Names
GitHub has tightened its npm trusted publishing rules after researchers exposed a flaw tied to repository name reuse. A new requirement means that a trusted publishing configuration must complete its first successful publish within 48 hours of creation; if…
SecurityOnline -
Google brings Gemini AI scam protection to more Android phones
Google has announced a broad upgrade to Android scam protections, leveraging Gemini AI to tackle increasingly personalised telecom fraud and social engineering. The update brings real-time scam warnings into the notification shade for a wide range of Android…
SecurityOnline -
Juniper Fixes Critical Flaws That Could Let Attackers Take Over Network Devices
Juniper Networks released October 2026 security bulletins addressing a broad set of critical vulnerabilities in Junos OS and Junos OS Evolved across MX, SRX, PTX, EX, and QFX platforms. The combined advisories cover more than 60 routing and management bugs…
-
Hackers Used FortiManager Flaws to Compromise 500 Firewalls
In September 2024, threat cluster CL-STA-0954, tracked by Mandiant as UNC5820 and attributed to Unit 42, breached a telecommunications managed service provider by exploiting Fortinet’s FortiJump vulnerability, CVE-2024-47575. The attackers gained access via…
-
Dell Patches Critical XSS Flaw in Wyse Management Suite
Dell Technologies has released security advisory DSA-2026-405 addressing four cross-site scripting (XSS) vulnerabilities in Wyse Management Suite (WMS). The most severe flaw, CVE-2026-82158, carries a CVSS base score of 9.0 and enables script injection via…
-
Ledger Wallet Hardware Implants Could Steal Cryptocurrency Seed Phrases
In the 15 October 2026 edition of the SANS Internet Storm Center’s Stormcast, the host reports on several distinct security concerns discussed in previous updates. First, Visual Basic for Applications (VBA) scripts embedded in AutoCAD files are again in…
SANS ISC -
NSD DNS Server Flaws Let Attackers Run Code Through Malicious Zone Files
NLnet Labs has patched four high-severity NSD stack overwrite vulnerabilities with the release of NSD version 4.15.3 on 14 October 2026. The flaws enable an attacker to trigger remote code execution by supplying specially crafted zone files, affecting…
-
SonicWall fixes two flaws enabling attacks on on-prem NSM systems
SonicWall has released security updates for two high‑severity flaws in NSM On‑Prem deployments. The issues, tracked as CVE-2026-96540 (CWE-863, CVSS 8.8) and CVE-2026-100232 (CWE-78, CVSS 7.2), could allow a remote, authenticated attacker to escalate…
-
Panchan Cryptomining Worm Targets Exposed Systems Through SSH Attacks
A guest diary from Zachary Norwood describes the Panchan worm, a long-running crypto mining botnet that propagates via multiple methods and remains active despite the passage of time. The entry notes that the worm was obtained from the DShield honeypot after…
SANS ISC -
Microsoft and partners dismantle CoGUI phishing network behind one billion messages
Microsoft, Health-ISAC, Proofpoint and international partners on 14 October 2026 announced a coordinated takedown targeting the CoGUI phishing kit, along with its connected marketplaces YAM Store and Iron Man. Citing a U.S. District Court for the Southern…
SecurityOnline -
Bisheng flaws expose AI platform to admin takeover and credential theft
CERT/CC and security researchers have disclosed three high-risk DataElement Bisheng vulnerabilities affecting the open-source Bisheng platform used for building and managing LLM applications. The flaws, tracked as CVE-2026-96679, CVE-2026-96681, and…
Wed 14 Oct· 86 articles
-
Cisco Secure Email3 articles this day · The Hacker News first
Cisco Email Gateways Face Active Attacks That Could Expose Cluster SSH Keys · CISA Flags Exploited Cisco Email Gateway Flaw With Critical Score
-
Cisco Email Gateways Face Active Attacks That Could Expose Cluster SSH Keys
Cisco’s Secure Email Gateway is being exploited in the wild for CVE-2026-76519, a critical arbitrary file write vulnerability rated CVSS 3.1 v3.1 9.8. The flaw lies in the AMP File Reputation feature, specifically in how the file reputation service handles…
-
CISA Flags Exploited Cisco Email Gateway Flaw With Critical Score
CISA added CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The Cisco Secure Email Gateway Relative Path Traversal Vulnerability affects Cisco Secure Email Gateway and could let an unauthenticated remote attacker…
-
Cisco Email Gateway Flaw Exploited to Run Commands as Root
Cisco has warned that active attacks are exploiting a critical vulnerability in its Secure Email Gateway. The flaw, tracked as CVE-2026-76519 (CVSS 9.8), can allow a sender with no login to write files to the appliance’s operating system and, if successful,…
-
-
Hackers Stole Configurations for 500 FortiGate Firewalls in FortiManager Breach
Unit 42 reports a multi-stage intrusion against a telecommunications provider, which began in September 2024 with the exploitation of CVE-2024-47575 against a FortiManager appliance. The attackers registered a rogue Virtual FortiGate named localhost on the…
-
Hackers Push Supermarket Fridges to 50°C, Spoiling Food Across Europe
A mass cyberattack compromised Internet-connected refrigeration controllers in around 700 supermarkets across Europe, triggering spoilage of large quantities of perishable merchandise and, in some cases, fires. French authorities said the remotely operable…
Ars Technica -
Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched
Ivanti reported that two zero-day flaws in its Ivanti Connect Secure (ICS) hardware and software were exploited in the wild, centring on a high-severity authentication bypass combined with unauthenticated remote code execution (RCE) in SSL-VPN and…
-
CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft Windows Shell flaw, tracked as CVE-2026-96951, to its Known Exploited Vulnerabilities (KEV) catalog. The advisory notes that the vulnerability is a Windows Shell command…
-
Storm-29902 articles this day · The Hacker News first
Microsoft disrupts Chinese phishing network behind 1 billion messages · Microsoft Disrupts Chinese Phishing Kits Behind One Billion Messages
2 outlets-
Microsoft disrupts Chinese phishing network behind 1 billion messages
Microsoft Threat Intelligence and the Microsoft Digital Crimes Unit have exposed Yam Store, a Chinese-language phishing ecosystem that has powered more than a billion phishing emails and SMS messages to tens of thousands of organisations in the past nine…
Dark Reading -
Microsoft Disrupts Chinese Phishing Kits Behind One Billion Messages
Microsoft and Health-ISAC, with the JC3 and a coalition including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, have disrupted three Chinese-language phishing kits: CoGUI (also known as NX or FA), Haozi (Phoenix) and Iron Man System. In a…
The Hacker News
-
-
Yandex Strikes Shifted Bot Traffic to Other Hosting Providers
Following reported strikes on Yandex data centres, Cloudflare’s Radar and Bot Management data show that the initial expectation of a broad collapse of Russian bot activity was misleading. Across two distinct Yandex autonomous systems—AS13238 (Yandex Search)…
Cloudflare -
Claude Code Preview Flaw Let Attackers Steal Developer Credentials Silently
A critical, silent zero-click flaw in Anthropic’s Claude Code Desktop preview pane could quietly exfiltrate credentials from developers’ machines. The vulnerability arose from three architectural gaps in the preview pane that rendered HTML documents…
Dark Reading -
CISA Flags Actively Exploited PAN-OS Flaw That Grants Root Access
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The vulnerability affects Palo Alto Networks PAN-OS and could let an authenticated attacker with network access execute arbitrary code as root on a firewall.…
-
CISA Warns of Attacks Exploiting AhsayCBS Authentication Flaw
CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The Ahsay AhsayCBS Improper Authentication Vulnerability affects AhsayCBS and could let a remote attacker bypass authentication by manipulating a parameter…
-
CISA Warns of Active Attacks on Critical AhsayCBS Flaw
CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026. The flaw affects Ahsay AhsayCBS and is a command injection vulnerability that could let a remote attacker execute operating system commands. The…
-
Hackers Exploited Nextcloud Flaw to Plant PHP Web Shells
Hackers compromised a Nextcloud deployment by exploiting a flaw in Collabora Online’s Built-in CODE Server app (Richdocumentscode). Attackers sent unauthenticated requests to proxy[.]php while the local CODE server was not running (for example during…
