News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 27 Jan· 63 articles
-
There's a rash of scam spam coming from a real Microsoft address
There are reports that a legitimate Microsoft email address—which Microsoft explicitly says customers should add to their allow list—is delivering scam spam. The emails originate from no-reply-powerbi@microsoft[.]com, an address tied to Power BI, with Power…
Ars Technica -
AI & the Death of Accuracy: What It Means for Zero-Trust
AI “model collapse” could degrade large language models as they train on increasingly AI-generated data, potentially introducing inaccuracies and eroding PII protections, according to the article. Gartner on 21 January predicted that by 2028, 50% of…
Dark Reading -
Vibe-Coded 'Sicarii' Ransomware Can't Be Decrypted
Vibe-Coded 'Sicarii' ransomware, which entered the scene last year, is described as having poorly designed code and a possible false flag identity centred on Hebrew branding. According to Halcyon, Sicarii appeared as a ransomware-as-a-service offering last…
Dark Reading -
CVE-2026-22709: Critical Sandbox Escape Vulnerability in vm2
CVE-2026-22709 is described as a critical sandbox escape vulnerability in vm2, a JavaScript sandbox library used to run untrusted code. According to StepSecurity, the flaw allows attackers to bypass sandbox protections and execute arbitrary code on the host…
-
GNU InetUtils2 articles this day · SecurityWeek first
Critical Telnet Server Flaw Exposes Forgotten Attack Surface · Organizations Warned of Exploited Linux Vulnerabilities
-
Critical Telnet Server Flaw Exposes Forgotten Attack Surface
Threat actors are exploiting a critical authentication bypass flaw in GNU InetUtils telnetd, CVE-2026-24061, which has lingered in the open-source project for more than a decade and could give attackers complete control of a device if exploited. The…
-
Organizations Warned of Exploited Linux Vulnerabilities
According to CISA, the US cybersecurity agency, five flaws were added to the Known Exploited Vulnerabilities (KEV) catalog, including two Linux bugs. The first is CVE-2026-24061 in GNU Inetutils, a critical authentication bypass in the telnetd service that…
-
-
WhatsApp rolls out Strict Account settings to strengthen protection for high-risk users
WhatsApp has begun rolling out Strict Account Settings to bolster protection for high-risk users, Meta announced in January 2026. The lockdown-style feature applies the most restrictive privacy settings, limits how the app functions, and blocks attachments…
Security Affairs -
Microsoft Office2 articles this day · SecurityWeek first
Microsoft Rushes Emergency Patch for Office Zero-Day · Microsoft Patches Office Zero-Day Likely Exploited in Targeted Attacks
-
Microsoft Rushes Emergency Patch for Office Zero-Day
Microsoft has rushed out an emergency patch for a zero-day vulnerability in Microsoft Office and Microsoft 365 that attackers are actively exploiting. The bug, CVE-2026-21509, carries a CVSS of 7.8 and can bypass protections against unsafe COM/OLE behaviour…
-
Microsoft Patches Office Zero-Day Likely Exploited in Targeted Attacks
Microsoft has released patches for CVE-2026-21509, a newly disclosed Office zero-day that can bypass security features, with exploitation reportedly proceeding via social engineering to persuade a targeted user to open a malicious Office file. According to…
-
-
'Stanley' Toolkit Turns Chrome Into Undetectable Phishing Vector
A new malware-as-a-service toolkit, nicknamed Stanley by researchers at Varonis, is hawked on a Russian cybercrime forum for between $2,000 and $6,000, illustrating how the browser has become a critical enterprise security frontier. The toolkit lets…
Dark Reading -
Watch out for AT&T rewards phishing text that wants your personal details
According to Malwarebytes, a phishing text impersonating AT&T pretends that a recipient’s rewards points are about to expire and uses urgency to lure victims. The message claims the recipient has 11,430 AT&T reward points that expire on 26 January 2026 and…
Malwarebytes -
Microsoft announces the 2026 Security Excellence Awards winners
According to Microsoft Security Blog, security isn’t a solo act but a team sport, a spirit reflected in the 2026 Security Excellence Awards winners announced after a January 26, 2026 gathering in Redmond, Washington that brought together the Microsoft…
Microsoft -
WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware
WhatsApp is rolling out a lockdown-style security mode, termed Strict Account Settings, to protect targeted users from advanced spyware, according to Meta. The feature locks certain account settings to the most restrictive options and blocks attachments and…
The Hacker News -
Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities
Indian government entities have been targeted in two campaigns attributed to a Pakistan‑based threat actor, identified by Zscaler ThreatLabz as Gopher Strike and Sheet Attack, first noted in September 2025. According to Zscaler ThreatLabz, Sheet Attack uses…
The Hacker News -
WorldLeaks Extortion Group Claims It Stole 1.4TB of Nike Data
Nike is investigating a potential data breach after WorldLeaks claimed it exfiltrated more than 1.4TB of Nike data and published it on its leak site. In a post on X, threat intelligence organisation JustaBreach reported the leak of 188,347 files allegedly…
Dark Reading -
Memcyco Raises $37 Million for Anti-Impersonation Technology
Memcyco today announced raising $37 million in an oversubscribed Series A, bringing the total raised by the company to $47 million, according to SecurityWeek. The investment round was led by E. León Jimenes, NAventures, and Pags Group, with additional…
SecurityWeek -
Shadowserver finds 6,000+ likely vulnerable SmarterMail servers exposed online
Shadowserver researchers reported that over 6,000 SmarterMail servers are exposed on the internet and are likely vulnerable to a critical authentication bypass flaw tracked as CVE-2026-23760. The vulnerability allows an unauthenticated attacker to reset the…
-
Over 100 Organizations Targeted in ShinyHunters Phishing Campaign
Over 100 organizations have been targeted in a ShinyHunters phishing campaign, with domain infrastructure indicating attacks against companies including Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo and WeWork, according to SecurityWeek. Silent…
SecurityWeek -
U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws have been added to the Known Exploited Vulnerabilities catalog. The newly listed flaws include…
-
Stolen Credentials Aren’t the Real Problem – Turn Identity Alerts Into Real Defense
Stolen credentials are presented in the article as a signal rather than the root cause of many identity-based incidents, with a focus on how access context can determine the appropriate response. It explains that security teams often stop at identity…
SOCRadar -
ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services
Cybersecurity researchers have detailed a new campaign that blends ClickFix-style fake CAPTCHAs with a signed Microsoft App-V script to deliver an information stealer called Amatera. The attackers proxy PowerShell execution through a trusted Microsoft…
The Hacker News -
Google: WinRAR CVE-2025-8088 abused by state actors to persist
The Google Threat Intelligence Group (GTIG) reported widespread exploitation of a critical WinRAR vulnerability (CVE-2025-8088), discovered in July 2025, by various threat actors, including state-sponsored groups and financially motivated hackers. The…
-
Building a serverless, post-quantum Matrix homeserver
Cloudflare has detailed how it ported a Matrix homeserver to Cloudflare Workers to create a serverless, post-quantum proof system. Starting from Synapse, the team swapped PostgreSQL for D1, Redis for KV, the filesystem for R2, and used Durable Objects for…
Cloudflare -
Treasury cancels $21 million in Booz Allen contracts, blaming a breach that happened years ago
According to CNN, the Treasury Department cut ties with Booz Allen Hamilton and announced it was canceling $21 million in federal contracts after one of the firm’s ex-employees leaked President Trump’s tax returns. The statement from Treasury Secretary Scott…
DataBreaches -
‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks
SecurityWeek reports that six vulnerabilities across NPM, PNPM, VLT and Bun could bypass protections designed to stop automatic code execution during package installation, opening JavaScript supply chains to remote code execution. Following high-profile…
-
Beauty in Destruction: Exploring Malware's Impact Through Art
Art meets cybersecurity in Beauty in Destruction, a Dark Reading feature about Finland’s WithSecure Museum of Malware Art. A standout piece is a giant, pink heart hanging in the lobby, crafted from 728 computer mice sourced from around the world, created by…
Dark Reading -
Hand CVE Over to the Private Sector
Brian Martin argues that MITRE has mismanaged the CVE program for decades and that the costs dwarf the benefits, citing funding figures rising from almost $5 million between 2004 and 2005 to a staggering $29 million in 2024/2025, with MITRE allegedly…
Dark Reading -
Savannah Best Buy employee says ‘hacker group’ blackmailed him into theft ring scheme
A 20-year-old Best Buy employee in Savannah has been jailed after police said he helped a group of suspected shoplifters walk out of the store with more than $40,000 in merchandise, claiming he was pressured by online blackmail threats. Dorian Allen is…
DataBreaches -
Top Impersonation Tactics Used in Social Engineering and Phishing
Impersonation attacks succeed by borrowing trust, with attackers posing as a familiar brand, a trusted vendor, a help desk agent, or an executive whose request feels urgent. In practice, campaigns blend lookalike domains, cloned login pages, SMS follow-ups,…
SOCRadar -
Cyber Insights 2026: Quantum Computing and the Potential Synergy With Advanced AI
SecurityWeek’s Cyber Insights 2026 examines the evolving interplay between quantum computing and advanced AI, emphasising two broad threads: the threat to current encryption and the potential for AI to accelerate quantum development, with the outlook…
SecurityWeek -
Chrome, Edge Extensions Caught Stealing ChatGPT Sessions
A SecurityWeek report dated 27 January 2026 reveals that 16 browser extensions have been created to steal ChatGPT sessions and have been published on the official Chrome Web Store and Microsoft Edge Add-ons marketplace. Marketed as ChatGPT enhancement and…
SecurityWeek -
A WhatsApp bug lets malicious media files spread through group chats
A WhatsApp bug lets malicious media files spread through group chats, disclosed by Google’s Project Zero. The vulnerability affects WhatsApp on Android and involves zero-click media downloads in group chats, meaning you can be attacked simply by being added…
Malwarebytes -
CTEM in Practice: Prioritization, Validation, and Outcomes That Matter
CTEM, as defined by Gartner, emphasises a continuous cycle of identifying, prioritising, and remediating exploitable exposures across your attack surface, with the aim of improving security posture as an outcome. According to Gartner, it’s not a one-off scan…
The Hacker News -
TikTok narrowly avoids a US ban by spinning up a new American joint venture
TikTok has announced the creation of a US joint venture, TikTok USDS Joint Venture LLC, backed largely by US investors, a move described as enabling the company to continue operating in the United States. The deal is valued at about $14 billion, and three…
Malwarebytes -
Critical Grist-Core Vulnerability Allows RCE Attacks via Spreadsheet Formulas
A critical vulnerability in Grist-Core, tracked as CVE-2026-24002 with a CVSS of 9.1, could allow remote code execution via malicious spreadsheet formulas, Grist’s open‑source, self‑hosted relational spreadsheet‑database. The flaw, codenamed Cellbreak by…
-
Amnesia RAT deployed in multi-stage phishing attacks against Russian users
FortiGuard Labs researchers uncovered a multi-stage malware campaign primarily targeting users in Russia, using fake business documents as social engineering lures to distract victims while the malware operates in the background. The attack chain begins when…
Security Affairs -
Alleged Axtria & Salesfloor Data Leaks Surface on Dark Web
SOCRadar’s Dark Web Team identified several new underground posts this week, including alleged data leaks involving Axtria and Salesfloor, a Republic database for sale, and a 1,000 credit card dataset offered at auction. According to the claim, Axtria’s…
SOCRadar -
China-Linked Hackers Have Used the PeckBirdy JavaScript C2 Framework Since 2023
Cybersecurity researchers have identified PeckBirdy, a JavaScript-based command-and-control framework that has been used by China-aligned APT actors since 2023 to target diverse environments, including Chinese gambling sites and Asian government entities and…
-
Lock the Front Door: The “Localhost” Loophole Leaving Thousands of Clawdbot Agents Exposed
The article, dated 27 January 2026, warns that the Clawdbot AI assistant has a localhost loophole that leaves thousands of agents exposed. It explains that Clawdbot can run in Mac mini setups, containers, or VPS environments, where default configurations…
SecurityOnline -
HoneyMyte updates CoolClient and deploys multiple stealers in recent campaigns
Kaspersky’s GReAT researchers on 27 January 2026 detailed how HoneyMyte (aka Mustang Panda or Bronze President) has updated its CoolClient backdoor and expanded its toolset in recent campaigns across Asia and Europe, with the group targeting government…
securelist.com
