News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 20 Oct· 86 articles
-
Drupal Fixes Critical Field UI Flaw After Researchers Publish PoC
Security researchers have published a full technical analysis and proof-of-concept (PoC) exploit for a critical Drupal remote‑code‑execution flaw in the Field UI module, tracked as CVE-2026-108097. Drupal addressed the vulnerability in advisory…
-
OpenBSD ‘Big Fish’ exploit chains flaws to gain root access
In a public disclosure on 16 October 2026, researcher Calif released full technical detail and working proof-of-concept (PoC) code for a local privilege escalation chain dubbed “Big Fish” affecting the OpenBSD kernel. The chain enables a local user to gain…
SecurityOnline -
Attackers Exploit Redis Flaw to Run Code on Vulnerable Servers
Defused’s honeypots have observed active exploitation of Redis RESTORE flaw CVE-2026-25243 in mid-October 2026. The memory-corruption vulnerability, rated CVSS 7.7, enables remote code execution for Redis servers that permit the RESTORE command. The…
-
Plex Flaw Chain Enables Unauthenticated Remote Code Execution
The latest SANS ISC Stormcast covers a cluster of recent security concerns with practical implications for operators of AI systems, network devices and consumer services. It begins by stressing how to contain AI agents, emphasising restricted permissions,…
SANS ISC -
UpdraftPlus Breach Let Attackers Install Backdoors on WordPress Sites
UpdraftPlus experienced a data breach over the weekend of 17-18 October 2026, with TeamUpdraft stating that its customer database was accessed. The exposed data include names, email addresses, billing addresses and order history, as well as hashed passwords…
SecurityOnline -
Hackers Exploit Siemens Software Center Flaw to Hide Malware
Siemens confirms that CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center, is being exploited in the wild. The vulnerability allows attackers to load malicious DLLs through an uncontrolled search path, disguising malware as a legitimate,…
Mon 19 Oct· 60 articles
-
Russian Ad Network Funnels Victims Into Fake Microsoft Support Scam
Researchers examining a long-running Microsoft-themed tech support scam have exposed how a traffic distribution system (TDS) run by a Russian-language advertising network is used to funnel victims to fake Microsoft support operations. The operation, dubbed…
Dark ReadingHotejka -
Spyware Firm Used Online Ads to Launch Zero Click Infections
AdFection is a newly described technique in which spyware operators weaponise the online advertising ecosystem to deliver covert malware without any user interaction. Researchers from the University of Toronto’s Citizen Lab describe how an Israeli ad-tech…
Dark ReadingCaramel Tsunami -
Hackers Exploit Plex Flaws to Install Cryptominers and Proxy Malware
Recently fixed vulnerabilities in Plex Media Server are being actively exploited to install malware, researchers report. Plex fixed four vulnerabilities at the start of last month, and three weeks later CVE designations were published for five flaws, one of…
Ars Technica -
ConnectWise disables cloud services after Microsoft 365 access incident
A threat actor is said to have used credentials linked to ConnectWise Cloud Backup (formerly SkyKick) to authenticate into Microsoft 365 tenants. ConnectWise began investigating on 14 October and, in response, disabled Cloud Backup for partners and clients…
Dark Reading -
Cloudflare Slashes AI Code Review Costs by 68% and Cuts Wait Times
Cloudflare’s AI code reviewer has been transformed from a cost-heavy system to a leaner, faster workflow. After a period of rising costs, the team focused on where tokens were being spent and implemented aggressive optimisations across the review process.…
Cloudflare -
Laravel Fixes Critical TokenGuard Flaw That Could Enable Account Takeovers
Laravel has disclosed two security advisories on 19 October 2026, including a high-severity authentication bypass in TokenGuard that could enable account takeover without any login or valid token. The flaw, rated CVSS 9.2, allows an unauthenticated attacker…
SecurityOnline -
Plex Media Server3 articles this day · SecurityWeek first
Attackers exploit Plex2Shell flaws to hijack servers for mining and proxying · Hackers exploit Plex flaws to install crypto miners and Linux backdoors
-
Attackers exploit Plex2Shell flaws to hijack servers for mining and proxying
Attackers are leveraging a vulnerability chain dubbed Plex2Shell that targets exposed Plex Media Server instances to deploy crypto mining and proxy software. On 16 October 2026, security researcher Zach Main published technical details and PoC code for the…
-
Hackers exploit Plex flaws to install crypto miners and Linux backdoors
Threat actors are actively exploiting a chain of Plex Media Server flaws, collectively dubbed Plex2Shell, to install crypto miners and a Linux proxy backdoor. In-the-wild activity follows a public PoC and chains four vulnerabilities to achieve…
-
Attackers Exploit Plex2Shell Flaws to Install Miners and Proxy Software
Threat actors have been observed delivering cryptocurrency miners and proxy software.
-
-
Attackers Exploited Siemens Software Center Flaw in Malware Campaign
Siemens has disclosed that threat actors exploited a vulnerability in its Software Center—tracked as CVE-2026-110936—as part of a malware campaign. The flaw arises because Software Center does not adequately restrict the folders it searches for DLL files,…
-
Cloudflare unveils Clairic, an AI model that extracts typed data faster and cheaper
Cloudflare has announced a new System One extraction model, Clairic, described as the first in this class. Available in preview on Workers AI as @cf/cloudflare/clairic, Clairic is designed to output typed values directly from unstructured inputs, rather than…
Cloudflare -
Malware in Rank Math PRO Updates Left Activated WordPress Sites Compromised
Copies of Rank Math PRO, the paid WordPress SEO plugin, were found to have been delivered with malware in updates between 20:02 UTC on 15 October 2026 and 07:12 UTC on 16 October 2026, according to Rank Math. The firm said sites that installed and activated…
-
Drupal Patches Two Critical Flaws With Unauthenticated RCE Paths
Drupal has released patches for five vulnerabilities, including two critical-severity flaws that could enable remote code execution (RCE). The first is in the Entity List module, which allows users to create lists of entities without Views and is tracked as…
-
Known exploited flaws take 87 days to patch as AI threats grow
A Moody’s report has found that known exploited vulnerabilities take a median 87 days to be patched, meaning half of such flaws remain unremediated for at least three months after disclosure. For vulnerabilities with no known exploitation evidence, the…
Infosecurity -
Compromised Rank Math PRO Update Could Give Attackers Persistent Access
Rank Math PRO for WordPress was compromised in a supply chain incident, with malicious code embedded in version 3.0.123 packages distributed between 15 October and 16 October 2026. Security Week notes that users who downloaded or updated to 3.0.123 during…
SecurityWeek -
Citrix NetScaler ADC2 articles this day · Cloudflare first
Attackers chained two Citrix NetScaler flaws to gain root access and steal keys · Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
-
Attackers chained two Citrix NetScaler flaws to gain root access and steal keys
In October 2026, Rapid7 disclosed a compromise of a Citrix NetScaler ADC appliance running a 14.1 build, where attackers exploited a chaining sequence involving CVE-2026-88771 and CVE-2026-88779. The intrusion achieved root code execution starting from…
-
Citrix NetScaler Flaw Sparks Attacks, Prompting Urgent Patching
Cloudflare reviews the crisis following a major vulnerability in Citrix NetScaler that enabled unauthenticated remote command execution via the login surface, with patches issued by Citrix and an emergency WAF rule from Cloudflare. The exploit disclosures…
-
-
BeyondTrust Remote Support2 articles this day · The Hacker News first
BeyondTrust Remote Support flaw exploited before disclosure enabled file access · Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored
-
BeyondTrust Remote Support flaw exploited before disclosure enabled file access
CVE-2026-102764 is a critical authentication bypass in BeyondTrust Remote Support (RS) that was exploited in the wild before a full disclosure. The flaw allows unauthenticated remote attackers to perform file operations on an affected RS appliance without…
-
Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored
The Hacker News’s weekly recap highlights a week thick with high-stakes cyber incidents and disclosures across software, hardware and AI-enabled systems. Notably, BeyondTrust Remote Support was exploited as a zero-day in late August 2026 (CVE-2026-102764),…
-
-
Drupal Patches Two Critical Flaws That Could Enable Unauthenticated Code Execution
Drupal has patched two critical remote code execution vulnerabilities—CVE-2026-108097 in the core Field UI module and CVE-2026-108099 in the contributed Entity List module. The advisories make clear that neither flaw is directly exploitable through the…
-
Copyright takedowns expose hacked university and government sites used for search spam
UpGuard researchers, via a Deep Dive into copyright takedown activity surrounding OnlyFans and other adult content creators, have uncovered a broader trend: attackers are abusing vulnerable university and government websites to manipulate search results. The…
Dark Reading -
AOMEI Backupper Updates Were Hijacked to Install a Persistent Backdoor
Attackers compromised AOMEI Technology’s update and notification infrastructure between April and July 2026, according to Google Threat Intelligence Group reports cited by Malwarebytes. The intruders briefly altered the update system used by AOMEI Backupper…
Malwarebytes -
Conduent to Pay $80 Million Over Breach Affecting 62 Million People
Conduent has agreed to pay $80 million to settle a class action linked to a 2024 cyber incident that exposed personal and health data for about 62 million people. The filing to the US District Court for the District of New Jersey on 16 October 2026 outlines…
Infosecurity -
Why Cyber Resilience Matters More Than Rising Vulnerability Counts
The article argues that the industry’s obsession with vulnerabilities has crowded out focus on resilience. It notes that, after a flurry of high-profile disclosures and a wave of commentary in 2026, the narrative shifted from “vulnerability volume” to a…
Dark Reading -
ConnectWise suspends cloud services after Microsoft 365 identity breach
ConnectWise reports unauthorized access to Cloud Backup identities (formerly SkyKick) tied to its Microsoft 365 integration. A vendor-controlled application credential was compromised and used to obtain Microsoft Graph tokens in multiple customer tenants,…
SOCRadar -
AI Fuzzer Uncovers High-Severity Flaws in 45% of Projects Tested
Bright Security has launched STAR Fuzzer, an agentic fuzzing mode that automatically identifies security-critical functions, generates per-function harnesses, and issues byte-exact payloads to reproduce every confirmed finding. In its initial open-source…
-
US Investigators Probe Ransom Negotiators’ Ties to ShinyHunters
U.S. federal investigators are pursuing the ShinyHunters gang, after identifying executives at two ransomware negotiation firms who allegedly maintained unusually close ties with the group. One US-based executive is accused of helping ShinyHunters run a…
Krebs on SecurityShinyHunters -
Meta Terms Could Let AI Scrape Business Websites Without Opt Out
Meta plans to change its commercial terms to allow scraping content from websites connected to business customers for AI training and product improvement. The change, effective 30 October 2026, would let Meta and contractors access sites associated with…
Security Affairs -
OpenCode Breach May Have Exposed AI Provider Keys to Attackers
OpenCode, the open-source AI agent framework provider, confirmed a security breach that impacted its Console service—the component that stores and authenticates access to API credentials for teams using OpenAI, Anthropic and Google AI models. The incident…
Infosecurity -
ConnectWise Suspends More Cloud Services After Microsoft 365 Breach
ConnectWise suspended its Cloud Backup (formerly SkyKick) on 17 October 2026 and, after continuing investigations, extended the temporary shutdown to SaaS Security and Cloud Management. The actions come as the company addresses unauthorized access to…
SecurityWeek -
GhostAction Hides Credential Stealer in a Font Across 94 GitHub Repos
GhostAction has expanded its supply‑chain campaign by disguising a credential stealer as a font file and deploying it via 94 compromised GitHub repositories. OpenSourceMalware reports that attackers now phish open‑source developers using a fake font hosted…
The Hacker NewsGhostAction -
Microsoft outlines controls to secure AI agents as adoption accelerates
Agents are rapidly becoming part of how work gets done, and security must keep pace with their machine-speed capabilities. Microsoft describes Guardian Agents and Project Perception as a way to defend the agentic insider, with signals and a unified registry…
Microsoft -
Hackers Claim Millions of ZoomInfo and TryCircle Records Leaked
SOCRadar’s Dark Web team flagged a string of alleged data incidents advertised across underground forums, including a purported 185 million-record ZoomInfo database sale, a claimed TryCircle customer data leak, and a supposed Vicente López municipal database…
SOCRadar -
Instagram Sextortion Scheme Linked to Murder of Michigan Teen
This week on the Lock and Code podcast… At just 17 years old, Jordan DeMay was murdered by strangers online. That’s how Jordan’s father, John DeMay, described what happened to his son four years ago. At home in Michigan, Jordan was readying for a weekend…
Malwarebytes
