News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 0 so far |
Fri 16 Jan· 43 articles
-
Mandiant releases rainbow table that cracks weak admin password in 12 hours
Mandiant has released a rainbow table for NTLMv1 that can recover passwords in under 12 hours using consumer hardware costing less than $600, according to Google Cloud. The table targets Net-NTLMv1 passwords used in network authentication for resources such…
Ars Technica -
More Problems for Fortinet: Critical FortiSIEM Flaw Exploited
Fortinet customers faced a fresh and highly serious vulnerability early in 2026, with FortiSIEM flagged as CVE-2025-64155, a command injection flaw that carries a 9.4 CVSS score and enables unauthenticated remote code execution through crafted TCP requests.…
Dark Reading -
Jordanian Man Admits Selling Unauthorized Access to Computer Networks of 50 Companies
According to U.S. Attorney’s Office, District of New Jersey, a Jordanian man living in the Republic of Georgia admitted his role as an “access broker” who sold unauthorized access to the computer networks of at least 50 victim companies. Feras Khalil Ahmad…
DataBreaches -
GootLoader Malware Uses 500–1,000 Concatenated ZIP Archives to Evade Detection
The Hacker News reports that the GootLoader JavaScript loader is now observed using a malformed ZIP archive that concatenates between 500 and 1,000 archives to evade detection. According to Expel, the attacker creates this anti-analysis archive so many…
The Hacker News -
In Other News: FortiSIEM Flaw Exploited, Sean Plankey Renominated, Russia’s Polish Grid Attack
Fortinet’s FortiSIEM flaw, tracked as CVE-2025-64155, is being actively exploited in the wild, with Defused Cyber reporting exploitation attempts began on 15 January; Horizon3 has released technical details and a PoC exploit, and Fortinet has been notified.…
SecurityWeek -
CISOs Rise to Prominence: Security Leaders Join the Executive Suite
CISOs are rising to the executive suite as organisations increasingly treat cybersecurity leadership as a top strategic priority, a trend highlighted in a January 2026 feature by Arielle Waldman. The piece notes that for the first time executive-level CISO…
Dark Reading -
Data breach at Canada’s Investment Watchdog Canadian Investment Regulatory Organization impacts 750,000 people
A data breach at Canada’s investment watchdog, the Canadian Investment Regulatory Organization (CIRO), affected about 750,000 people after threat actors stole personal data in an August 2025 phishing attack, according to CIRO. The incident forced some…
Security Affairs -
Monnai Raises $12 Million for Identity and Risk Data Infrastructure
Monnai has raised $12 million in an equity funding round, bringing its total funding to $23 million, in a deal led by Motive Partners with additional support from Commerce Ventures and 500 Global. Founded in 2021 and based in California, Monnai builds an…
SecurityWeek -
Act Now: Survey on Threats Researchers and Journalists Experience Ends January 18
DataBreaches[.]net and Zack Whittaker at this.weekinsecurity[.]com are running a survey on the threats experienced by security researchers and journalists, including legal threats or legal processes and threats of violence by cybercriminals, with…
DataBreaches -
Project Eleven Raises $20 Million for Post-Quantum Security
According to SecurityWeek, post-quantum security startup Project Eleven has announced a $20 million Series A, bringing its total raises to $26 million. The round was led by Castle Island Ventures, with additional support from Coinbase Ventures, Fin Capital,…
SecurityWeek -
Five Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts
Cybersecurity researchers have uncovered five new malicious Chrome extensions that pose as HR and ERP tools such as Workday, NetSuite, and SuccessFactors to hijack user accounts. The extensions—DataByCloud Access (ID: oldhjammhkghhahhhdcifmmlefibciph,…
The Hacker News -
AI System Reduces Attack Reconstruction Time From Weeks to Hours
An AI-based system called ALOHA, developed by a team at the Pacific Northwest National Laboratory, can quickly reconstruct attacks and generate variants to test defenses, according to the researchers. Since its deployment, the time needed to secure systems…
Dark Reading -
Astro is joining Cloudflare
Astro, the creators of the Astro web framework, is joining Cloudflare, according to The Cloudflare Blog, with Astro remaining open source under MIT licence and open to contributions as part of Cloudflare. Astro 6 is on the horizon, bringing a redesigned…
Cloudflare -
Former Conti member “Tramp,” now known as “Devman,” added to Interpol’s wanted list
Former Conti figure known online as “Devman” has been added to Interpol’s wanted list, with authorities identifying Oleg Evgenievich NEFEDOV as the ringleader behind the Black Basta ransomware and the group’s founder. According to The Public Prosecutor…
DataBreaches -
WhisperPair exposes Bluetooth earbuds and headphones to tracking and eavesdropping
WhisperPair is a set of attacks that lets an attacker hijack many popular Bluetooth audio accessories that use Google Fast Pair and, in some cases, even track their location via Google’s Find Hub network—all without requiring any user interaction.…
Malwarebytes -
750,000 Impacted by Data Breach at Canadian Investment Watchdog
The Canadian Investment Regulatory Organization (CIRO) disclosed that hackers compromised the personal information of 750,000 individuals in an August 2025 cyberattack, with the incident traced to a sophisticated phishing campaign that also caused some…
SecurityWeek -
Cyber Insights 2026: Social Engineering
Cyber Insights 2026: Social Engineering argues that AI wings are driving a new era of deception, with the most successful breaches likely to exploit trust rather than vulnerabilities as AI-enhanced techniques scale up. The piece, published on 16 January…
SecurityWeek -
WhisperPair Attack Leaves Millions of Bluetooth Accessories Open to Hijacking
SecurityWeek reports a vulnerability in the Google Fast Pair implementation of Bluetooth audio accessories that can force connections to attacker‑controlled devices without user consent, tracked as CVE-2025-36911. The flaw, caused by a logic error in the…
SecurityWeek -
Cybersecurity Firms React to China’s Reported Software Ban
China has more than 5,000 cybersecurity companies, according to Natto Thoughts, with a recent Reuters report naming more than a dozen firms targeted by a directive to stop using US and Israeli software. According to Reuters, the list included CrowdStrike,…
SecurityWeek -
Dark Web Profile: Orion Ransomware
Orion Ransomware is a newly observed operation identified after the emergence of a previously unknown ransomware Data Leak Site, with the group publicly listing 13 alleged victims at the time of discovery. According to SOCRadar, analysis indicates there is…
SOCRadar -
Your Digital Footprint Can Lead Right to Your Front Door
Your digital footprint extends far beyond what you post, with personal details such as your name, home address, phone number, past jobs and family members often sitting on public websites, data broker platforms, and sketchy directories. The article warns…
The Hacker News -
LOTUSLITE Backdoor Targets U.S. Policy Entities Using Venezuela-Themed Spear Phishing
Security researchers have disclosed a campaign that targeted U.S. government and policy entities with a backdoor named LOTUSLITE delivered via Venezuela-themed spear phishing. The attackers used a ZIP archive titled “US now deciding what's next for…
The Hacker News -
China-linked APT UAT-9686 abused now patched maximum severity AsyncOS bug
Cisco has fixed a maximum severity AsyncOS flaw in Secure Email products, tracked as CVE-2025-20393 (CVSS 10.0), after it was previously exploited as a zero-day by a China-linked APT group UAT-9686. The vulnerability, arising from insufficient validation of…
Security AffairsUAT-9686 -
Dutch police sell fake tickets to show how easily scams work
The Dutch police ran an unusual sting by setting up a fake ticket website, TicketBewust[.]nl, that sold tickets for events like football matches and concerns, which were never real. The site was designed to show how easily ticket fraud can work, and anyone…
Malwarebytes -
How to Build a Threat-Informed Defense: Why You Need to Understand Adversaries
Security teams need to move from reactive patching to threat-informed defence by understanding who is targeting them, how they operate, and what they want, the article argues. It explains that many teams suffer a blind spot between alerts and real…
SOCRadar -
Cisco Patches Vulnerability Exploited by Chinese Hackers
According to Cisco, a vulnerability in Secure Email Gateway and Secure Email and Web Manager was patched after being exploited in the wild, tracked as CVE-2025-20393 with a CVSS score of 10/10. The attack campaign, which Cisco attributes to UAT-9686, a…
SecurityWeek -
Actively exploited critical flaw in Modular DS WordPress plugin enables admin takeover
A critical vulnerability in the Modular DS WordPress plugin, tracked as CVE-2026-23550, is actively being exploited, with a CVSS score of 10, potentially allowing unauthenticated privilege escalation. The flaw affects plugin versions 2.5.1 and earlier,…
Security Affairs -
Former CISA Director Jen Easterly Appointed CEO of RSAC
Former CISA director Jen Easterly has been named the chief executive officer of the RSA Conference (RSAC). As CEO, Easterly will oversee the flagship conference and the company’s Innovation Sandbox, professional membership platform, education initiatives and…
SecurityWeek -
China-Linked APT Exploits Sitecore Zero-Day in Attacks on American Critical Infrastructure
According to Cisco Talos, which is tracking the activity under the name UAT-8837, a China-nexus advanced persistent threat has been observed targeting critical infrastructure sectors in North America since at least last year. The group is described as…
The Hacker News -
Cisco Patches Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways
Cisco has issued security updates for Cisco AsyncOS Software and Cisco Secure Email and Web Manager after confirming that a zero‑day remote code execution flaw was exploited by a China‑nexus APT actor codenamed UAT‑9686. The vulnerability, tracked as…
The Hacker News -
Beyond Words: OpenAI Launches “ChatGPT Translate” to Rewrite the World
OpenAI has launched ChatGPT Translate, revealed on its web interface and described as a new asset in the ongoing generative AI competition, in a move that targets the ubiquitous translation domain. The feature is presently confined to desktop environments…
SecurityOnline -
Defeating the Epochalypse: GRUB 2.14 Arrives to Save Linux from Year 2038
Defeating the Epochalypse: GRUB 2.14 Arrives to Save Linux from Year 2038 reports that GRUB 2.14 is the definitive release after more than two years since 2.12, bringing a substantial set of improvements to Linux bootloading. The update adds support for the…
SecurityOnline -
Canon Critical Alert: 7 New Flaws Expose Printers to Remote Hackers
Canon has issued a security advisory for its imageCLASS, i-SENSYS and Satera printer lines warning of seven critical vulnerabilities that could allow remote attackers to take complete control of devices. All flaws carry a near-maximum CVSS score of 9.8 and…
SecurityOnline -
Zero-Day Threat: UAT-8837 Targets North American Infrastructure
A Cisco Talos-identified campaign, named UAT-8837, is reportedly targeting critical infrastructure in North America with an arsenal of open-source tools and potential zero-day exploits, according to Cisco Talos. The group is assessed with “medium confidence”…
SecurityOnlineUAT-8837 -
40,000 Hits in 4 Hours: RondoDox Botnet Storms HPE OneView
On 16 January 2026, according to Check Point Research, a massive automated assault on HPE OneView was observed, with a botnet launching over 40,000 exploitation attempts in four hours targeting a critical CVE-2025-37164 flaw. The campaign is attributed to…
SecurityOnline -
DeadLock Ransomware: New Strain Hides C2 in Polygon Smart Contracts
A new ransomware family, DeadLock, was discovered in July 2025 and is notable not for volume but for its innovative use of Polygon smart contracts to manage its command-and-control infrastructure. According to Group-IB specialists, the malware stores and…
SecurityOnline -
One Click to Compromise: Microsoft Copilot’s “Reprompt” Flaw Exposed
A new report from Varonis Threat Labs has revealed a flaw in Microsoft Copilot Personal, dubbed “Reprompt,” that could allow attackers to exfiltrate data with a single mouse click before the patch. According to Varonis Threat Labs, a click on a legitimate…
SecurityOnline -
OpenStack Admin Forgery: CVE-2026-22797 Lets Users ‘Ask’ for Root
OpenStack has fixed a privilege escalation flaw, CVE-2026-22797, that could let a standard authenticated user trick the system into granting administrative powers or impersonating other users by forging identity headers. The issue lies in keystonemiddleware,…
SecurityOnline -
-
Sicarii Ransomware Masquerades as Israeli Hacktivists
Security researchers at Check Point have released an analysis of Sicarii, a Ransomware-as-a-Service group that emerged in late 2025, noting that the group aggressively brands itself as a patriotic Israeli and Jewish organisation, a persona that is likely a…
SecurityOnline
