News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 19 Oct· 60 articles
-
Hackers Steal California Student Records Through Compromised ETS Login
Intruders used compromised credentials to access an ETS (Educational Testing Service) SFTP server, copying files containing California student information. The California Department of Education (CDE) says unauthorized activity was detected on 25 September,…
SecurityWeek -
UK Electoral Commission Trials AI Alerts to Flag Election Deepfakes Fast
The UK Electoral Commission is building an AI system to alert candidates to damaging deepfakes within three hours. The UK’s Electoral Commission is building an AI-powered system to tell candidates about significant deepfakes within three hours of posting.…
Security Affairs -
Salesforce Agentforce Risks Data Exposure Through Public Case Forms
Researchers describe how combining Salesforce Agentforce with Email-to-Case and Web-to-Case can create an exposure path: public internet input can flow into case records, then into agent prompts, triggering actions that generate case comments and outbound…
The Hacker News -
Fortinet Flaw Exploits Led to Stealthy FortiGate Implant in Telecom Breach
Security researchers have linked a sequence of exploited Fortinet vulnerabilities to a stealthy FortiGate implant used in a telecom intrusion. The activity began with the exploitation of a critical remote code execution flaw in FortiManager, tracked as…
-
California Student Data Breach Exposes Records of Millions of Pupils
Millions of California public school students have had their personal information exposed after an unauthorized party accessed an Educational Testing Service (ETS) operated file transfer site used under a contract with the California Department of Education…
Malwarebytes -
OpenBSD Flaws Chain 37-Year-Old Bug to Give Attackers Root Access
OpenBSD has disclosed a pair of local privilege escalation flaws that together form a chain capable of bypassing kernel protections and attaining root access. The two issues were demonstrated by Calif researchers against OpenBSD 7.9, showing that an attacker…
Security Affairs -
ConnectWise Takes Cloud Services Offline After Microsoft 365 Breach
ConnectWise has suspended access to several cloud services after detecting unauthorized access to Microsoft 365 tenants. The investigation began on 15 October, with the company confirming on 19 October that the attackers accessed application identities…
Infosecurity -
Fake Web3 Accelerator Plants Data Stealers in Malicious npm Packages
A fake Web3 accelerator, allegedly called Apex Accelerator and tracked as REF8801, has been observed distributing information-stealing malware and backdoors through malicious npm packages. The two packages, @apexacc/cli and @apexacc/audit, were marketed as…
The Hacker NewsREF8801 -
US Cybersecurity Job Postings Fall 26%, CISO Roles Plunge 39%
US cybersecurity job postings fell by 26.4 per cent year on year from January to September 2026, according to CyberSN’s analysis. A total of 235,786 cybersecurity roles were posted in 2026 on JobSpikr, the lowest figure in the four years CyberSN has tracked…
Infosecurity -
Roundcube Patches 20 Flaws, Including IMAP Injection and XSS Attacks
Roundcube has released security updates for versions 1.6.20 and 1.7.5 on 19 October 2026, addressing a total of 20 vulnerabilities spanning IMAP command handling, header processing, and several webmail-specific flaws. The advisory notes that these fixes…
SecurityOnline -
MITRE ATT&CK v20 Adds AI Attacks and Water Utility Campaigns
MITRE has released ATT&CK v20, expanding coverage across Enterprise and ICS with 15 new detection strategies and 38 analytics. In the Enterprise domain, the update adds several techniques and sub-techniques, including two variants of prompt injection—one for…
SecurityWeek -
ConnectWise Cloud Backup Breach Exposed Microsoft 365 Data and Access
ConnectWise disclosed that attackers gained unauthorized access by abusing stolen credentials tied to ConnectWise Cloud Backup (formerly SkyKick) application identities. The incident came to light after internal monitoring on 14 October 2026, with seven…
Security Affairs -
Anthropic Buys Opaque Systems to Secure Sensitive AI Data
Anthropic has announced the acquisition of Opaque Systems, a startup specialising in confidential and verifiable AI. Opaque has developed technology intended to allow AI systems to access sensitive data while keeping it protected by the underlying hardware.…
SecurityWeek -
Attackers Exploit SiteGuard WAF Flaw to Gain Root Access
Attackers are actively exploiting CVE-2026-106931 in SiteGuard Server Edition, a vulnerabilities disclosed by EG Secure Solutions and referenced by JVN. The flaw is an OS command injection that, once successfully exploited, lets an attacker run commands with…
-
Eiliko Robot Flaws Expose Private Conversations and Let Hackers Alter Its Speech
Malwarebytes Labs’ weekly round-up covers stories published between 12 and 18 October 2026. It highlights security and privacy issues involving consumer devices, online services and organisations, alongside scams and emerging risks linked to artificial…
Malwarebytes -
Broadcom Router Flaw Lets Nearby Attackers Run Code as Root Over Wi-Fi
A security researcher has disclosed a flaw in Broadcom’s Wi‑Fi setup software that could let an attacker in radio range execute code as root on Broadcom-based routers without needing a network password or any pairing step. The bug affects Broadcom’s…
The Hacker News -
Attackers Hijack AOMEI Updates to Deploy Backdoors on Enterprises
Between April and July 2026, UNC7017 attackers tampered with AOMEI’s official update infrastructure for brief windows of five to ten minutes, delivering the CROSSROAD downloader and SHINYROAD backdoor to enterprise systems during those moments. They modified…
SecurityOnlineUNC7017 -
OpenCode Breach May Expose AI Provider Keys, Prompting Revocations
OpenCode has disclosed that an intruder gained access to a legacy system on the night of 16 October, potentially exposing third‑party API keys that users had saved in OpenCode Console. Console is OpenCode’s optional hosted workspace that stores provider keys…
The Hacker News -
Microsoft links Exchange server failures to a new Windows memory cap
Microsoft warns that Exchange Server instability observed after October 2026 Patch Tuesday is linked to Windows updates, not an Exchange patch. Since 13 October 2026, some on‑premises Exchange servers under heavy load have begun experiencing failures, with…
SecurityOnline -
Critical Linux Flaw Could Let Virtual Machines Write to Host Memory
PWNAI Research has disclosed PwnEscape, a critical Linux kernel VM escape flaw tracked as CVE-2026-99999, which was demonstrated in lab tests to leak host memory from a guest VM and could potentially allow root activity on the host. The vulnerability…
-
CISA warns of critical flaws in medical archives and EseeCloud cameras
CISA has issued two advisories detailing nine vulnerabilities in the dcm4chee-arc-light medical archive and in Guangzhou Juan IoT Technology’s EseeCloud IP cameras, with three critical flaws in EseeCloud and six in the dcm4chee archive. For…
-
Six Linux Kernel Flaws Have Public PoCs for Root Access and Escape
Researchers have publicised six Linux kernel vulnerabilities, collectively dubbed “Infinity Core,” with full PoCs that can lead to local privilege escalation and container escape. Hyunwoo Kim’s write-up includes public PoCs for five flaws that reportedly…
-
Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin
Between 12 and 18 October 2026, CVE Watchtower logged 5,499 new vulnerabilities, with this weekly review tracking 12 exploited flaws. Six of those were flagged by Daily Cybersecurity’s intelligence sources, and three of the exploited flaws are not yet…
-
Broadcom Wi-Fi flaw enables unauthenticated router attacks from 2010 code
A Broadcom Wi‑Fi vulnerability dating back to 2010 allows an attacker within Wi‑Fi range to execute code on vulnerable routers without any authentication or knowledge of the network password. The flaw resides in Broadcom’s proprietary 802.11 implementation…
Security Affairs -
Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade
Apache has disclosed a set of vulnerabilities across its Kylin, Airflow and related components, with the most severe being a critical SQL injection in Apache Kylin. The overall advisory covers 12 Kylin flaws and three Airflow provider issues, plus notes on…
-
Attackers Exploit Plex Flaws to Run Cryptominers and Proxy Tools
Attackers have begun exploiting Plex Media Server vulnerabilities in the wild, following a full write-up and PoC by researcher Zach Main on 17 October 2026. The exploit chain, dubbed Plex2Shell, combines four CVEs to achieve unauthenticated remote code…
Sun 18 Oct· 10 articles
-
OpenCode Reveals Ongoing Attack Affecting Linked AI Provider Users
OpenCode has disclosed a security incident described as a large-scale distillation attack that affected a subset of its Console users—specifically 1.4 per cent of those with linked AI providers. The vendor said the incident is ongoing and that affected users…
StepSecurity -
AI Agents Are Expanding Cyber Risks, From Data Exposure to OT Threats
Security Affairs’ fourth AI-cybersecurity newsletter, published on 18 October 2026, brings together selected reporting and research on how artificial intelligence is changing security. The introduction says AI agents can automate tasks, analyse large volumes…
Security Affairs -
YARA Rule Flags Orphaned VBA Projects Hidden in DWG Files
The SANS ISC diary entry discusses a YARA rule used to detect a specific pattern described as “Orphaned VBA Projects Inside DWG Files.” The rule searches for the string “AC10” at the start, a 32-bit binary sequence at offset 0x24, a D0 CF 11 E0 A1 B1 1A E1…
SANS ISC -
US Cybersecurity Job Postings Hit Four Year Low as AI Roles Surge
US cybersecurity job postings fell to a four-year low in the first nine months of 2026, even as demand for AI-focused security roles surged. Data from CyberSN’s jobs report, compiled from JobSpikr with duplicates removed and mapped to CyberSN’s 45-role…
DataBreaches -
CikaBika Bot Uses Discord to Spy on Victims and Steal Data
Darktrace has documented a campaign around a Rust-written remote access trojan named CikaBika Bot, which uses Discord as its command-and-control (C2) channel. The infection chain begins with a disk image that masquerades as a business proposal, paired with a…
Security Affairs -
15 NHS Staff Sacked for Accessing Nottingham Stabbing Victims’ Records
More NHS staff have been dismissed for inappropriately accessing the medical records of victims from the Nottingham stabbing tragedy, bringing the total number of staff sacked in the NUH probe to 15. The Nottingham University Hospitals NHS Trust confirmed…
DataBreaches -
US Cybersecurity Job Postings Hit Four Year Low as AI Roles Surge
CyberSN’s Cybersecurity Jobs Report, analysed by CyberSN’s taxonomy of 45 cybersecurity roles, shows a mixed picture for the US job market in 2026. Between January and September 2026 there were 235,786 postings, down 26.4% from 320,210 in the same period of…
SecurityWeek -
Malware Roundup Tracks XWorm’s Shift to Surveillance and New Threats
Security Affairs’ Malware Newsletter Round 119, published on 18 October 2026, is a collection of links to malware research and reporting rather than a detailed account of a single incident. Its topics include IronChain ransomware and the threat of permanent…
Security Affairs -
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
Security Affairs’ Round 600 INTERNATIONAL EDITION, dated 18 October 2026, presents a curated weekly selection of security stories chosen by Pierluigi Paganini. The issue mirrors the publication’s standard format, opening with a summary of international press…
Security Affairs -
ConnectWise Disables Apps After Attackers Breach Microsoft 365 Tenants
ConnectWise disclosed that it disabled seven application identities after attackers gained unauthorized access to ConnectWise application identities and breached customers’ Microsoft 365 tenants. The affected identities include ConnectWise Cloud Backup and…
The Hacker News
Sat 17 Oct· 10 articles
-
Health Providers Pay $2.7 Million After 2024 Breach Exposes Data
New York and Connecticut prosecutors have secured a combined 2.7 million dollars from Boston Children’s Health Physicians (BCHP) and its IT provider XTIUM over a 2024 data breach. The settlement follows an investigation that found BCHP failed to enforce…
DataBreaches -
FBI Seizes 187 Laptops in Crackdown on North Korean IT Worker Scheme
The FBI conducted a coordinated enforcement action in Texas as part of an ongoing effort against North Korea’s remote IT-worker schemes. In Operation Lonestar Roundup, 40 homes were searched and about 187 laptops and KVM switch devices were seized. The…
Security AffairsNorth Korean IT workers -
Millions of California Students Exposed in ETS Data Breach
An investigation reported by DataBreaches[.]net reveals that personal information belonging to millions of California students was exposed in a breach affecting the non-profit organisation that contracts with the state’s Department of Education. The…
DataBreaches -
Malicious npm Package Hides Windows Loader That Deploys a Go Stealer
MalFEX researchers uncovered a malicious npm package named imgdecode, part of a broader supply chain campaign tracked as MALFEX. The package, uploaded on 30 September 2026 by user malfexteste8 and currently at version 1.0.3, hides a loader in a compiled…
The Hacker NewsMALFEX
