News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 21 Jan· 60 articles
-
Cisco fixed actively exploited Unified Communications zero day
Cisco patched a critical zero-day remote code execution flaw, tracked as CVE-2026-20045 (CVSS 8.2), in Unified Communications and Webex Calling that is actively exploited in the wild. An unauthenticated, remote attacker can exploit the flaw to execute…
Security Affairs -
Millions of people imperiled through sign-in links sent by SMS
According to Dan Goodin, millions of people are put at risk by sign-in links and codes sent via SMS, with research showing many services still use unencrypted, easily exploitable authentication methods. The study found more than 700 endpoints delivering such…
Ars Technica -
'Contagious Interview' Attack Now Delivers Backdoor Via VS Code
The Contagious Interview campaign is now delivering a backdoor via a maliciously crafted Visual Studio Code workflow, enabling remote code execution on developer systems once trust is granted to the repository’s author. Jamf Threat Labs disclosed the latest…
Dark Reading -
Phishing Campaign Zeroes in on LastPass Customers
An ongoing phishing campaign is targeting customers of password management vendor LastPass. LastPass itself disclosed the campaign via a Jan. 20 blog post, and according to the vendor's Threat Intelligence, Mitigation, and Escalation (TIME) team, attackers…
Dark Reading -
EPIC Releases New Report on Protecting Health Privacy in the Digital Age
According to Electronic Privacy Information Center (EPIC), the organisation’s new report, Beyond HIPAA: Reimagining How Privacy Laws Apply to Health Data to Maximise Equity in the Digital Age, examines the health data privacy crisis created by unregulated…
DataBreaches -
Hong Kong issues Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance
Hong Kong issued a Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653), with the Office of the Commissioner of Critical Infrastructure (Computer-system Security) issuing the CoP on 1 January 2026, the…
DataBreaches -
Zoom fixed critical Node Multimedia Routers flaw
Zoom fixed a critical security vulnerability tracked as CVE-2026-22844 (CVSS 9.9) in Zoom Node Multimedia Routers (MMRs) that could result in remote code execution, according to Zoom. The flaw affects Node Meeting Connector MMR module versions prior to…
Security Affairs -
North Korean PurpleBravo Campaign Targeted 3,136 IP Addresses via Fake Job Interviews
According to Recorded Future, Insikt Group, PurpleBravo—a North Korean threat activity cluster—targeted 3,136 individual IP addresses, primarily concentrated around South Asia and North America, and is suspected of hitting 20 victim organisations across AI,…
The Hacker News -
Can you use too many LOLBins to drop some RATs?
Malwarebytes reports a campaign that uses LOLBins to deploy two remote access tools: Remcos and NetSupport Manager, with attackers relying on Windows built-in utilities to hide their activity. The infection chain starts with forfiles[.]exe launching mshta, a…
Malwarebytes -
CyberNut Closes $5M Growth Capital for K-12 Security Awareness Training
According to SecurityWeek, Miami-based CyberNut on Wednesday announced a minority strategic growth equity round to scale its cybersecurity awareness training platform for the K-12 sector, with the investment totalling $5 million from Growth Street Partners.…
SecurityWeek -
DOGE Employees Shared Social Security Data, Court Filing Shows
DOGE employees detailed to the Social Security Administration shared sensitive data through a nonsecure third party server, in violation of agency security policies, according to a court filing disclosed by the Justice Department. The Social Security…
DataBreaches -
Cloudflare whacks WAF bypass bug that opened side door for attackers
Cloudflare has fixed a flaw in its web application firewall (WAF) that allowed attackers to bypass security rules and directly access origin servers, potentially enabling data theft or full server takeover, according to DataBreaches[.]Net. FearsOff security…
DataBreaches -
Zoom and GitLab Release Security Updates Fixing RCE, DoS, and 2FA Bypass Flaws
Zoom and GitLab have issued security updates to fix flaws that could lead to denial-of-service and remote code execution. The most severe flaw is a critical vulnerability in Zoom Node Multimedia Routers (MMRs) that could let a meeting participant perform…
The Hacker News -
Asymmetric Security Emerges From Stealth With $4.2 Million in Funding
Asymmetric Security today emerged from stealth with $4.2 million in an oversubscribed pre-seed funding round, according to SecurityWeek. The round was led by Susa Ventures, with additional support from Halcyon Ventures, Overlook Ventures, and angel…
SecurityWeek -
ACME flaw in Cloudflare allowed attackers to reach origin servers
Cloudflare fixed a flaw in its ACME HTTP-01 validation logic that could let attackers bypass security checks and reach origin servers, according to the article. The issue stemmed from how Cloudflare’s edge handled requests to the /.well-known/acme-challenge/…
Security Affairs -
Complex VoidLink Linux Malware Created by AI
VoidLink is an advanced cloud-first malware framework targeting Linux systems that researchers say was created almost entirely by artificial intelligence. It comprises custom loaders, implants, rootkits, and modular plug-ins designed to maintain long-term…
Dark Reading -
A new era of agents, a new era of posture
The Microsoft Security Blog explains that the rise of AI agents marks a major shift, with agents not just passive components but capable of reasoning, deciding, and interacting across systems on users’ behalf. This autonomy creates powerful opportunities but…
Microsoft -
aiFWall Emerges from Stealth with an AI Firewall
aiFWall emerged from stealth on 21 January 2026, with a free basic product planned ahead of the full company launch. The offering markets itself as a firewall for AI deployments that uses AI to improve its own performance, describing a two-way system that…
SecurityWeek -
'Damn Vulnerable' Training Apps Leave Vendors' Clouds Exposed
Security researchers say insecure training apps left on the public Internet are a backdoor into organisations’ cloud environments, with attackers already abusing over-permissioned programs to reach major vendors. In a newly published report, Pentera…
Dark Reading -
LastPass Users Targeted With Backup-Themed Phishing Emails
LastPass users are being targeted by a backup-themed phishing campaign that began circulating around 19 January, with subject lines referencing maintenance and instructions to back up their vaults. The body of the emails directs recipients to create a vault…
SecurityWeek -
New Research Exposes Critical Gap: 64% of Third-Party Applications Access Sensitive Data Without Authorization
According to Reflectiz, its 2026 State of Web Exposure Research analysing 4,700 leading websites found that 64% of third‑party applications now access sensitive data without legitimate business justification, up from 51% last year. The report highlights a…
SecurityOnline -
North Korean Hackers Target macOS Developers via Malicious VS Code Projects
North Korean threat actors are abusing Visual Studio Code task configuration files for malware delivery in a campaign aimed at macOS software developers, according to Jamf. Rather than the ClickFix technique, the attackers lure victims into accessing or…
SecurityWeek -
Alerted to a breach in November, Advanced Family Surgery Center remains publicly silent
Advanced Family Surgery Center (AFSC) in Oak Ridge, Tennessee, part of Covenant Health, says little about a breach first disclosed by threat actors Genesis, who contacted AFSC on 26 November 2025 to claim they had been compromised. On 11 January Genesis…
DataBreaches -
Malicious Google Calendar invites could expose private data
Malicious Google Calendar invites could expose private data, according to Miggo, after researchers uncovered a vulnerability that lets a dormant payload hidden in a standard calendar invitation bypass Google Calendar’s privacy controls. An attacker creates a…
Malwarebytes -
Why Identity Security Must Move Beyond MFA
Multi-factor authentication is a cornerstone of modern cyber defence, but the piece argues it cannot be relied on alone. It notes that around 70 per cent of users in enterprise environments were using MFA as of early 2025, based on Okta’s Secure Sign-In…
SecurityWeek -
MITRE Launches New Security Framework for Embedded Systems
MITRE has launched the Embedded Systems Threat Matrix (ESTM), a cybersecurity framework designed to help organisations protect critical embedded systems, according to MITRE on its website. Built to mirror the ATT&CK approach, ESTM categorises attack tactics…
SecurityWeek -
Anthropic Git MCP Server Vulnerabilities Involving Path Traversal and Argument Injection
Security researchers disclosed three vulnerabilities in mcp-server-git, the official Git server implementation for the Model Context Protocol (MCP) used by Anthropic. The flaws, now fixed, are CVE-2025-68143 (CVSS 6.5) path traversal in git_init,…
SOCRadar -
Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore
According to SecurityWeek, Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore argues that API cybersecurity will be battered between AI-assisted attackers and defenders, with API traffic and risk expanding as enterprises deploy…
SecurityWeek -
Webinar: How Smart MSSPs Using AI to Boost Margins with Half the Staff
The Hacker News reports on a forthcoming webinar titled “Webinar: How Smart MSSPs Using AI to Boost Margins with Half the Staff,” which argues that AI is reshaping how managed security services are delivered, not just what they report. The piece notes that…
The Hacker News -
Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure
Anthropic MCP Server Flaws Lead to Code Execution, Data Exposure reports that flaws in Anthropic’s MCP server connections to local data can be exploited to achieve remote code execution and unauthorized file access. All three vulnerabilities were identified…
SecurityWeek -
Crooks impersonate LastPass in campaign to harvest master passwords
LastPass has warned of an active phishing campaign impersonating the service to steal users’ master passwords, with attacks beginning around 19 January 2026. The messages claim urgent maintenance and urge recipients to back up their password vaults within 24…
Security Affairs -
Oracle’s First 2026 CPU Delivers 337 New Security Patches
Oracle’s January 2026 CPU delivers 337 new security patches for over 30 products, with roughly 230 unique CVEs resolved in the update, according to Oracle’s January 2026 CPU advisory. The fixes include more than two dozen patches that address…
SecurityWeek -
Exposure Assessment Platforms Signal a Shift in Focus
Gartner says that Exposure Assessment Platforms (EAP) mark a formal shift away from traditional vulnerability management, moving toward continuous threat exposure management (CTEM) across cloud, on‑prem, and identity layers. In the inaugural Magic Quadrant…
The Hacker News -
Analysis of 6 Billion Passwords Shows Stagnant User Behavior
An analysis of 6 billion credentials leaked in 2025 confirms that poor password hygiene persists, with simple numeric sequences and common words still dominating user choices, according to Specops Software. The five most common compromised passwords were…
SecurityWeek -
Chainlit AI Framework Flaws Enable Data Theft via File Read and SSRF Bugs
Chainlit, a popular open-source AI framework, has two high-severity flaws—collectively dubbed ChainLeak—that could enable data theft and internal network access, according to Zafran Security. The vulnerabilities include CVE-2026-22218, an arbitrary file read…
The Hacker News -
VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code
According to Check Point Research, the VoidLink Linux malware framework was likely created by a single developer with AI assistance and reached more than 88,000 lines of code by early December 2025. Described as a feature‑rich framework written in Zig,…
The Hacker News -
VoidLink shows how one developer used AI to build a powerful Linux malware
VoidLink is described by Check Point researchers as a cloud-focused Linux malware framework likely built by a single developer with help from an AI model, offering loaders, implants, rootkit evasion and dozens of plugins to extend its capabilities. According…
Security Affairs -
GitLab Alert: High-Severity 2FA Bypass & DoS Flaws Patched in Urgent Update
GitLab has issued an urgent security update for its Community and Enterprise editions to patch five high‑severity vulnerabilities that could allow Denial of Service attacks and authentication bypasses. The release covers versions 18.8.2, 18.7.2, and 18.6.4,…
SecurityOnline -
NVIDIA Patches High-Severity Flaws in Graphics and AI Tools
NVIDIA has issued a dual high-severity patch for two of its software suites, Nsight Graphics and the Merlin Transformers4Rec framework, with a CVSS score of 7.8 for both flaws. The first vulnerability, tracked as CVE-2025-33206, affects Nsight Graphics for…
SecurityOnline -
LastPass Warns of Fake Maintenance Messages Targeting Users’ Master Passwords
LastPass is alerting users to a new active phishing campaign impersonating the password manager, aiming to trick people into surrendering their master passwords. The campaign began on or around 19 January 2026 and uses phishing emails that claim upcoming…
The Hacker News
