News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Thu 15 Oct· 78 articles
-
Caramel Tsunami2 articles this day · Security Affairs first
Candiru spyware reached real devices through targeted online ads, Citizen Lab finds · Spyware Firm Used Adverts to Target Users With Zero Clicks
2 outlets-
Candiru spyware reached real devices through targeted online ads, Citizen Lab finds
A report by the Citizen Lab confirms a zero-click spyware operation linked to Candiru targeted Al Jazeera and other organisations through online advertising. The researchers found that the attack ran as soon as an advertisement loaded, with some callbacks…
The Hacker News -
Spyware Firm Used Adverts to Target Users With Zero Clicks
The investigation by Citizen Lab, as reported by Security Affairs, reveals that spyware operators used online advertising infrastructure to profile targets and deliver exploits without requiring users to click anything. The focus is Discover-Tech, linked to…
Security Affairs
-
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
Silent Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE…
-
Security Teams Must Prioritise Exploited Flaws, Not CVSS Scores
Organisations are drowning in vulnerability data, facing millions of vulnerabilities across countless assets. The piece argues that vulnerability management must move away from vendor-generated scores and toward real exploit data that reflects each…
Dark Reading -
UK Legal Aid Agency Breach Exposed Records Dating Back to 1978
The UK’s Legal Aid Agency (LAA) has disclosed that a 2025 data breach exposed records dating back to 1978, with forensic review expanding the known scope. While initial disclosures in May 2025 described unauthorised access and data exfiltration affecting…
SecurityWeek -
Google Patches Seven Critical Chrome Flaws That Could Enable Remote Code Execution
Google has issued Chrome updates across desktop and Android to address a batch of security flaws, including seven rated as Critical. The desktop release, rolling out to Chrome 155.0.8059.79/.80 for Windows and macOS and 155.0.8059.79 for Linux, accompanies a…
-
Help TDS hijacks websites to funnel visitors into tech support scams
The Hacker News reports that a long-running Traffic Distribution System (TDS) known as Help TDS is again being tied to the Hotejka ecosystem, believed to be a rebrand of ROI777. The operation has been active since at least 2017 and works by injecting PHP…
The Hacker NewsHelp TDS -
Cloudflare Unveils Void to Build and Deploy Full Stack Vite Apps
Cloudflare has announced three new open‑source products that integrate server routing, typed data access, and Cloudflare deployment into a unified Vite workflow, under the banner of Void. The Void Platform provides a shared deployment environment for teams…
Cloudflare -
China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day
Google Threat Intelligence Group (GTIG) and Mandiant say the suspected China-linked espionage group ARMORY CASTLE, formerly tracked as UNC5221, exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 as a zero-day in late August 2026. BeyondTrust…
-
cURL Fixes High Severity HTTP/2 Flaw That Could Crash Upload Clients
The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems. Related Posts: Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update Citrix Patches…
SecurityOnline -
Windows 11 Update Breaks Enterprise Wi-Fi Authentication
Microsoft has flagged that the Windows 11 cumulative update KB5127648, released on 15 October 2026, can disrupt enterprise Wi-Fi authentication. Reports from network administrators indicate that WPA2-Enterprise, 802.1X, and PEAP authentication fail during…
SecurityOnline -
Danfoss StoreView Exposure Plunges After French Supermarket Cyberattack
Internet-exposed Danfoss StoreView controllers in France have been disappearing from public view at a rapid pace in the wake of a cyber incident affecting hundreds of French supermarkets’ food supplies. Censys researchers reported a 71% drop in…
-
Cloudflare Helps ChatGPT Discover Hundreds of Millions More Web Pages
Cloudflare and OpenAI describe a research pilot launched in July to improve AI-driven discovery of web content. The aim is to help ChatGPT find and surface more useful pages by using signals from Cloudflare’s network to augment OpenAI’s crawlers. Early…
Cloudflare -
Aoki Infostealer Targets AI Coding Credentials to Hijack Developer Accounts
New versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, according to a Symantec report. The latest development marks a shift from earlier Aoki variants, which focused on browser data,…
Infosecurity -
NGINX fixes five flaws, including a bug dating back to 2005
NGINX has released version 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, one of which has existed in every release since May 2005. The advisory from F5 (the maker of the NGINX ecosystem) describes three memory-related flaws that could…
The Hacker News -
Malwarebytes Launches Free Tool to Check Suspicious Links Before Clicking
Malwarebytes has published a public-facing explainer for its Scam Link Check tool, a free service designed to help users determine whether a suspicious link is likely safe before clicking. The article introduces Scam Link Check as a quick, on-demand…
Malwarebytes -
Cyberattack on French Supermarkets Spreads to More Cooling Controllers
France’s national cybersecurity agency ANSSI and CERT-FR say a cyberattack disrupting supermarket refrigeration has widened to affect Copeland XWEB and Dixell XWEB controllers, in addition to earlier Danfoss AK-SM and AK-SC units. In total, around 700 of…
SecurityWeek -
Next.js Patches Critical Flaws That Could Let Attackers Run Code
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the…
-
Ransomware Gangs Threaten Workers’ Families to Force Payments
Ransomware gangs are expanding their extortion beyond encrypting files to targeting employees and their families. The piece cites the Semperis 2026 Ransomware Risk Report, which found that 37% of successful attacks included threats against workers’ friends…
DataBreaches -
UK Legal Aid Agency Breach Exposed Data Dating Back Before 2007
An update on the UK Legal Aid Agency (LAA) cyberattack reveals that data compromised in the 2025 breach extends much farther back than previously understood. The agency has completed analysis to identify the date range and types of information affected,…
DataBreachesShinyHunters -
Drupal Patches Critical Field UI Flaw That Could Enable Unauthenticated RCE
Drupal has patched a critical unauthenticated RCE flaw in its Field UI core module (CVE-2026-108097) that could be exploited via contributed modules and custom code. The Drupal Security Team says an attacker cannot reach the flaw through core alone;…
-
FTC Accuses Sextortion Firm of Defrauding Victims of $60 Million
The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated firms of defrauding people targeted by sextortion. The agency says victims paid at least $60 million for so-called “Phase…
Malwarebytes -
Fake AI Campaigns Target US Firms With Malware Hidden in Downloads
Attackers are fanning out fake AI campaigns across US companies by impersonating well-known AI services such as Claude, ChatGPT, GitHub Copilot and Gemini. The campaigns push malware through suspicious download pages, fraudulent authentication pages and…
The Hacker News -
LiteLLM flaws could hand attackers admin access and expose AI keys
Two high‑risk vulnerabilities have been disclosed in LiteLLM, a widely adopted open‑source LLM gateway tool used to connect AI applications to providers including OpenAI, Google and Anthropic. The flaws, tracked as CVE-2026-35029 and CVE-2026-59823, affect…
-
CikaBika Bot Uses Discord to Control Infected Windows PCs
Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
SecurityWeek -
AI tool Raven can identify locations from a single interior photo
Graylark has developed Raven, an AI-based location-matching tool that can identify an indoor location from a photo without relying on GPS data. The system compares interior images against a large catalogue of property photos and uses visual features—such as…
Malwarebytes -
SANS Frameworks Put Human Oversight at the Heart of AI Investigations
Two new frameworks from SANS aim to tighten governance around AI-assisted digital forensics and incident response, mapping AI-assisted workflows to established standards. The Digital Forensics & AI Investigations Framework aligns with SWGDE’s trusted…
The Hacker News -
Cisco Secure Email2 articles this day · Security Affairs first
Cisco and Palo Alto Patch Exploited Flaws Enabling Root Access · Cisco Fixes Actively Exploited Secure Email Gateway Flaw Allowing Root Access
-
Cisco and Palo Alto Patch Exploited Flaws Enabling Root Access
Cisco and Palo Alto Networks have issued patches for two actively exploited zero-day vulnerabilities that can enable root-level code execution on security appliances. The flaws, CVE-2026-76519 and CVE-2026-0322, have been added to the US CISA Known Exploited…
-
Cisco Fixes Actively Exploited Secure Email Gateway Flaw Allowing Root Access
Cisco has disclosed a critical flaw in its Secure Email Gateway that threat actors have been actively exploiting, tracked as CVE-2026-76519 with a CVSS of 9.8. The vulnerability resides in the Advanced Malware Protection (AMP) feature and stems from improper…
-
-
India to Display Callers’ Registered Names to Curb Spam from 2026
The Indian government has ordered telecom service providers to display the caller’s registered name alongside the number for incoming calls on 4G and newer networks, with the change taking effect from 1 November 2026. The move, outlined in a circular from…
The Hacker News -
SOCRadar brings tenant separated incident and vulnerability alerts to Splunk
SOCRadar has released two new Splunk apps aimed at MSSPs and multi-tenant environments: SOCRadar Incidents MSSP and SOCRadar Vulnerability. The release targets the friction of managing risk findings across many managed companies, providing a single input and…
SOCRadar -
Hirudo Android Trojan Replaces Banking Apps to Evade Security Checks
Security researchers have detailed a novel Android banking trojan-and-RAT hybrid termed Hirudo, which stealthily replaces legitimate banking apps with Trojanized copies to undermine security checks from within the target app. Delivered via a dropper embedded…
SecurityWeek -
Microsoft Dismantles Phishing Marketplace Behind 1 Billion Messages
Microsoft and law enforcement partners say they have dismantled a large-scale phishing ecosystem built around Yam Store, an underground marketplace tracked by Microsoft as Storm-3119. The operation unraveled after Microsoft and Japanese police investigated a…
InfosecurityStorm-3119 -
CenterPoint Energy breach exposes personal data of 1 million Texans
CenterPoint Energy has told Texan authorities that personal information for more than 1 million people was compromised in a data breach. In a Texas Attorney General filing, the utility said 1,062,060 state residents were affected, and that it has not yet…
SecurityWeek -
GhostAction Hackers Hijack 1,900 GitHub Accounts to Steal Secrets
The GhostAction campaign has intensified, with attackers compromising around 1,900 GitHub accounts to target more than 30,000 repositories across some 3,000 users and organisations. The spike occurred on 8–9 October 2026, according to security researchers…
The Hacker NewsGhostAction -
UK Police Reprimanded for Uploading 179 People’s Data to Unvetted Platform
The Information Commissioner’s Office (ICO) has issued a reprimand and enforcement notice to the Metropolitan Police Service (MPS) over governance failings linked to its use of the Auror third‑party platform for crime intelligence and shoplifting operations.…
Infosecurity -
Netskope CISO Says Curiosity Matters More Than Credentials in Security
James Robinson’s path to the CISO role at Netskope is a portrait of mobility and ongoing learning. Starting in a vocational route with Cisco Networking Academy, he moved from a State Farm network engineer with a CCIE to multiple security-focused roles across…
SecurityWeek -
Torvalds Tests AI-Written Linux Patch That Triples Read Throughput
Linus Torvalds has experimented with Claude Code, an AI-assisted coding tool, to craft patches for a key Linux memory management subsystem. The eight patches, produced with Claude Code, aim to speed up small-block reads from the page cache by changing how…
SecurityOnline -
Fake WatchGuard VPN site steals credentials before serving genuine installer
A WatchGuard VPN phishing operation was uncovered in October 2026 that steals credentials directly in the browser rather than dropping malware onto endpoints. The campaign uses lookalike WatchGuard domains and an SEO-poisoned search result to lure IT…
SecurityOnline -
Langflow RCE flaw lets any authenticated user run malicious commands
Langflow has a critical authenticated remote code execution flaw, tracked as CVE-2026-105740 (CVSS 9.9), affecting versions prior to 1.9.0. Security researchers at Previdian report that any authenticated Langflow user can trigger RCE by adding an MCP server…
