News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Thu 8 Jan· 60 articles
-
Who Benefited from the Aisuru and Kimwolf Botnets?
According to XLab, Kimwolf infected more than two million Android TV streaming boxes and shared code with an earlier Aisuru botnet, with both strains being distributed by the same Internet address on 8 December 2025. Public records point to Lehi, Utah-based…
Krebs on Security -
Maximum Severity HPE OneView Flaw Exploited in the Wild
According to the Cybersecurity and Infrastructure Security Agency, a maximum-severity vulnerability in HPE’s OneView platform, CVE-2025-37164, has been added to KEV and carries a 10 CVSS score, reflecting the potential for remote code execution. The flaw was…
Dark Reading -
Michigan man learns the hard way that “catch a cheater” spyware apps aren’t legal
Bryan Fleming helped create pcTattletale in 2002, a spyware tool that could monitor phone and computer usage and upload videos to a server for subscribers to view. The product’s marketing materials at times claimed it could be used to catch a “cheating…
Ars Technica -
Madusa Ransomware 2025: RMM Abuse in Ransomware Campaigns
According to the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), Medusa ransomware emerged in 2025 as one of the top 10 most active ransomware threat actors, prompting a joint advisory and, by January…
darktrace.com -
Fake AI Chrome Extensions Steal 900K Users' Data
Fake AI Chrome extensions have been found to steal data from hundreds of thousands of users by mimicking legitimate extensions from a company called AItopia. According to Ox Security, two malicious extensions copied the functionality of a legitimate app and…
Dark Reading -
ChatGPT's Memory Feature Supercharges Prompt Injection
Radware researchers have identified a new exploit chain called “ZombieAgent” that leverages ChatGPT’s memory feature and connectors to intensify prompt injection attacks. The attack chain shows how long-term memory can be abused to make IPI attacks…
Dark Reading -
Astaroth banking Trojan spreads in Brazil via WhatsApp worm
Astaroth, a long-running Brazilian banking malware, has evolved in a campaign dubbed Boto Cor-de-Rosa that uses WhatsApp Web for propagation. According to Acronis, the malware harvests the victim’s WhatsApp contacts and automatically sends each of them a new…
Security Affairs -
EEOC experienced security incident involving an Opexus employee’s ‘unauthorized’ access, email says
According to NextGov/FCW, the Equal Employment Opportunity Commission experienced an internal data security incident that involved a contractor’s employees with privileged access, who handled data in an unauthorized and prohibited manner in early 2025. The…
DataBreaches -
WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging
Cybersecurity researchers have revealed a WhatsApp-based worm campaign that distributes the Windows banking trojan Astaroth across Brazil, under the codename Boto Cor-de-Rosa. The campaign uses WhatsApp to retrieve a victim’s contacts and automatically…
The Hacker News -
UK Government Unveils New Cyber Action Plan
According to UK Government Cyber Action Plan, the government officially released a new Cyber Action Plan on 6 January 2026, emphasising that it is a core deliverable within the Roadmap for Modern Digital Government and not aimed at business or national…
SecurityWeek -
10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making
Harden-Runner has reached a significant milestone, now protecting over 10,000 open-source repositories as the community tier continues to be free for public projects. The journey began when the service launched in March 2022, with the aim of bringing…
StepSecurity -
CrowdStrike to Buy Identity Security Firm SGNL for $740 Million in Cash
CrowdStrike is to buy identity security startup SGNL in a deal valued at $740 million, paid predominantly in cash, according to SecurityWeek. Founded in 2021 and based in Palo Alto, SGNL has built an “identity-first” security solution that eliminates static…
SecurityWeek -
Blackbird.AI Raises $28 Million for Narrative Intelligence Platform
Blackbird[.]AI has announced a funding round of $28 million, bringing its total raised to $58 million and backing the company’s AI-based narrative intelligence platform. Founded in 2017 and based in New York, Blackbird[.]AI has built a Constellation platform…
SecurityWeek -
Public PoC prompts Cisco patch for ISE, ISE-PIC vulnerability
Cisco has patched a medium-severity vulnerability in ISE and ISE-PIC after a public PoC exploit was disclosed. The flaw, tracked as CVE-2026-20029 (CVSS 4.9), resides in the licensing feature due to improper XML parsing in the web management interface,…
Security Affairs -
Cyera Raises $400 Million at $9 Billion Valuation
Cyera has raised $400 million in a Series F round, tripling its valuation to $9 billion in just one year, according to SecurityWeek. The New York-based data security company said the latest funding brings its total raised to more than $1.7 billion, with the…
SecurityWeek -
Here's What Cloud Security's Future Holds for the Year Ahead
Cloud service providers are increasingly aiming to be the platform of choice for AI workloads, with recent research suggesting 99% of organisations currently use or plan to use cloud services for AI, and 74% of organisations expecting to use CSP security…
Dark Reading -
China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes
A China-nexus threat actor known as UAT-7290 has been attributed to espionage-focused intrusions against entities in South Asia and Southeastern Europe, with activity since at least 2022. The group’s operations include extensive reconnaissance of target…
The Hacker NewsDAGGER PANDA -
CISA warns of active attacks on HPE OneView and legacy PowerPoint
CISA warns of active exploitation of two vulnerabilities now listed in the Known Exploited Vulnerabilities (KEV) catalog, with a due patch date of 28 January 2026. The first flaw, CVE-2025-37164, affects HPE OneView and has a CVSS score of 10 out of 10,…
Malwarebytes -
End of The Year 2025 Cyber Analysis
The End of The Year 2025 Cyber Analysis reports a steep rise in credential theft across 2025, with a total of 388 million credentials stolen from the ten most affected platforms and specific totals for several services: Facebook 93 million, Google 67…
SOCRadar -
ChatGPT falls to new data pilfering attack as a vicious cycle in AI continues
There’s a familiar pattern in AI chatbot security: researchers uncover a vulnerability, a guardrail is added, and a small tweak revives the attack. In this case, a vulnerability in ChatGPT allowed Radware researchers to exfiltrate a user’s private…
Ars Technica -
Rethinking Security for Agentic AI
Rethinking Security for Agentic AI argues that as software can act autonomously or semi-autonomously, security must move from static policy enforcement to real-time behavioural governance. Agentic AI introduces new threats beyond prompt misuse, including…
SecurityWeek -
Lego’s Smart Bricks explained: what they do, and what they don’t
Lego has unveiled Smart Bricks, described by the company as its most important product release since 1978, effectively making a computer housed inside a 2×4 brick. The Smart Brick is part of the Smart Play system and includes a custom ASIC chip,…
Malwarebytes -
Critical Vulnerability Patched in jsPDF
A critical vulnerability has been patched in the jsPDF library, which Endor Labs warns could allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials. The flaw, tracked as CVE-2025-68428 with a CVSS of 9.2,…
SecurityWeek -
Methodist Homes of Alabama and Northwest Florida is notifying residents and employees of its second data breach in seven months.
According to DataBreaches[.]Net, Methodist Homes of Alabama and Northwest Florida is notifying residents and employees of its second data breach in seven months. On 6 January, the organisation reported that a compromised employee email account had been…
DataBreaches -
Critical Vulnerability Exposes n8n Instances to Takeover Attacks
SecurityWeek reports a critical vulnerability in the n8n workflow automation platform, tracked as CVE-2026-21858 with a CVSS score of 10, enabling remote code execution without authentication. The flaw affects the platform’s webhook and file-handling logic…
SecurityWeek -
ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories
ThreatsDay Bulletin highlights a critical RustFS flaw, disclosed by the RustFS project, that stems from a hard-coded, publicly exposed gRPC authentication token used on both client and server sides. The advisory assigns a CVSS score of 9.8 and states the…
The Hacker News -
Researchers Expose WHILL Wheelchair Safety Risks via Remote Hacking
Security researchers have demonstrated a critical vulnerability in WHILL electric wheelchairs that allows for unauthorized remote control, highlighting safety risks for connected mobility devices, according to CISA’s advisory. The flaw affects WHILL Model C2…
SecurityWeek -
The State of Trusted Open Source
Chainguard, described as the trusted source for open source, reveals that their catalog spans over 1800 container image projects, 148,000 versions, 290,000 images and 100,000 language libraries, with almost half a billion builds observed across a growing…
The Hacker News -
Critical HPE OneView Vulnerability Exploited in Attacks
The US cybersecurity agency CISA has warned that a maximum-severity code injection flaw in Hewlett Packard Enterprise’s OneView product has been exploited in attacks. Tracked as CVE-2025-37164 (CVSS 10/10), the vulnerability was disclosed on 17 December 2025…
SecurityWeek -
Securing Vibe Coding Tools: Scaling Productivity Without Scaling Risk
Securing Vibe Coding Tools outlines how AI-assisted development, or “vibe coding,” can boost productivity but also introduces new security risks. According to Unit 42, these tools can generate code in seconds while failing to enforce critical controls,…
unit42.paloaltonetworks.com -
Top 10 Agentic SOC Platforms To Watch In 2026
The article, published in January 2026, highlights ten agentic SOC platforms to watch in 2026, describing how AI agents can ingest, triage, investigate and potentially respond to alerts while humans focus on high‑risk decisions. It crowns Exaforce as an…
SOCRadar -
Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release
Cisco has issued updates to fix a medium-severity vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) after a public PoC exploit was released. The flaw, CVE-2026-20029 (CVSS 4.9), sits in the licensing feature and…
The Hacker News -
U.S. CISA adds HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added HPE OneView and Microsoft Office PowerPoint flaws to its Known Exploited Vulnerabilities (KEV) catalog, listing CVE-2009-0556 for Microsoft Office PowerPoint Code Injection Vulnerability…
Security Affairs -
Fake WinRAR downloads hide malware behind a real installer
According to Malwarebytes, a fake WinRAR installer linked from various Chinese websites was analysed by Pieter Arntz on January 8, 2026, revealing a multi-layered dropper that hides behind a real installer. The original file named winrar-x64-713scp[.]zip…
Malwarebytes -
Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages
Cybersecurity researchers have uncovered three malicious npm packages designed to deliver a previously undocumented malware named NodeCordRAT. The packages bitcoin-main-lib (2,300 downloads), bitcoin-lib-js (193 downloads), and bip40 (970 downloads) were…
The Hacker News -
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances
Cybersecurity researchers have disclosed 11 critical flaws in Coolify, a self-hosted, open‑source platform, that could lead to authentication bypass and remote code execution, potentially allowing full server compromise on affected instances. The…
The Hacker News -
Ni8mare Flaw in n8n: What Defenders Need to Know About CVE-2026-21858
Security researchers disclosed Ni8mare, a maximum-severity vulnerability tracked as CVE-2026-21858 in n8n, which allows an unauthenticated attacker to fully compromise vulnerable deployments. CVE-2026-21858 carries a CVSS score of 10.0 and can enable…
SOCRadar -
The Gemini Surge: Google Eclipses 20% Market Share as ChatGPT’s Grip Slips
From January 2025 through January 2026, the preeminent force within the artificial intelligence landscape has indisputably been Google’s Gemini AI suite, with the debut of “Nano Banana” acting as a primary catalyst. Recent analytics indicate that Gemini AI’s…
SecurityOnline -
The Great AI Rethink: Dell Ditches “AI-First” Hype as Consumers Stay Indifferent
On 8 January 2026, the Daily CyberSecurity report argues Dell has ditched the “AI-first” hype as consumers stay indifferent. It notes that Microsoft continues to push the Copilot+PC initiative and work with OEMs to add locally computed artificial…
SecurityOnline -
China-linked groups intensify attacks on Taiwan’s critical infrastructure, NSB warns
Taiwan says China-linked cyberattacks on its energy sector rose tenfold in 2025, hitting critical infrastructure across nine sectors and pushing total incidents up 6% year on year. National Security Bureau (NSB) reports that China launched an average of 2.63…
Security Affairs
