News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 9 Feb· 58 articles
-
SmarterTools SmarterMail2 articles this day · SecurityWeek first
Warlock Gang Breaches SmarterTools Via SmarterMail Bugs · SmarterTools Hit by Ransomware via Vulnerability in Its Own Product
-
Warlock Gang Breaches SmarterTools Via SmarterMail Bugs
The Warlock Group breached SmarterTools by exploiting vulnerabilities in SmarterMail, with the attack visible on 29 January 2026. The flaws CVE-2026-24423 and CVE-2026-23760 were addressed in SmarterMail release 9511 on 15 January 2026, and both carry…
-
SmarterTools Hit by Ransomware via Vulnerability in Its Own Product
According to SecurityWeek, SmarterTools was hit by ransomware via an unpatched instance of its SmarterMail email server, with the incident occurring on 29 January 2026 and impacting a data centre hosting quality control testing systems, the company’s portal,…
-
-
Hackers Use Signal QR Codes to Spy on Military and Political Leaders
Security experts in Germany are on high alert following a wave of digital attacks aimed at high-ranking officials and public figures, according to Dissent’s report dated 9 February 2026. They have been warned by the Federal Office for Information Security…
DataBreaches -
TeamPCP Turns Cloud Infrastructure into Crime Bots
TeamPCP turns cloud infrastructure into crime bots, with a threat actor systematically targeting misconfigured and exposed cloud management services and control interfaces to hijack infrastructure, expand its operations, and monetise compromised systems. The…
-
[Dark Reading Virtual Event] Shields Up: Key Technologies Reshaping Cybersecurity Defenses
Shields Up: Key Technologies Reshaping Cybersecurity Defenses is a free, one-day online conference produced by the editors of Dark Reading. The event takes an in-depth look at the latest cybersecurity technologies, tools and services for thwarting today’s…
Dark Reading -
Fortinet FortiClient EMS2 articles this day · SecurityOnline first
Critical Fortinet FortiClientEMS flaw allows remote code execution · Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE
-
Critical Fortinet FortiClientEMS flaw allows remote code execution
Fortinet warns of a critical FortiClientEMS vulnerability that lets remote attackers run malicious code without logging in, tracked as CVE-2026-21643 with a CVSS score of 9.1. According to Fortinet, the flaw involves improper neutralization of special…
-
Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE
Fortinet has issued a high-priority advisory for FortiClient Enterprise Management Server (EMS) warning of a critical SQL injection vulnerability that could allow attackers to execute arbitrary code without logging in. Tracked as CVE-2026-21643, the flaw…
-
-
Black Basta Bundles BYOVD With Ransomware Payload
Black Basta has reemerged with a new BYOVD approach, embedding a vulnerable driver directly into its ransomware payload. Researchers from the Symantec and Carbon Black Threat Hunter Team identified the bundled driver as NSecSoft NSecKrnl, which last month…
-
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)2 articles this day · The Hacker News first
BeyondTrust fixes critical pre-auth bug allowing remote code execution · BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA
-
BeyondTrust fixes critical pre-auth bug allowing remote code execution
BeyondTrust has released security updates to fix a critical pre-authentication remote code execution flaw, tracked as CVE-2026-1731 (CVSS 9.9) in its Remote Support and Privileged Remote Access products. According to BeyondTrust advisory, the vulnerability…
-
BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA
BeyondTrust has released updates to address a critical pre-authentication remote code execution vulnerability affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw, CVE-2026-1731, could allow an unauthenticated attacker to…
-
-
Is your phone listening to you? (re-air) (Lock and Code S07E03)
Is your phone listening to you? (re-air) is a Malwarebytes Labs post about the Lock and Code S07E03 podcast, which revisits a discussion on mobile tracking and surveillance. It notes that in January Google settled a lawsuit and paid $68 million to a broad…
Malwarebytes -
Lema AI Emerges From Stealth With $24 Million to Tackle Third-Party Risk
Lema AI, a cybersecurity startup focused on agentic AI-powered third-party risk management, has emerged from stealth with $24 million raised across Series A and seed funding rounds, according to SecurityWeek. Founded in 2023 by Eddie Dovzhik (CEO), Omer…
SecurityWeek -
A one-prompt attack that breaks LLM safety alignment
Large language models and diffusion models are shown to be vulnerable to a one-prompt attack that can break safety alignment, a finding from Microsoft Security. The researchers describe GRP-Obliteration, a process that uses Group Relative Policy Optimisation…
Microsoft -
China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage Campaign
According to The Cyber Security Agency (CSA) of Singapore, the China-nexus cyber espionage group UNC3886 targeted Singapore’s telecommunications sector in a deliberate, targeted campaign. The agency said all four of Singapore’s major telecom operators—M1,…
The Hacker News -
AI chat app leak exposes 300 million messages tied to 25 million users
An independent security researcher uncovered a data breach affecting Chat & Ask AI, a popular AI chat app available on Google Play and the Apple App Store, reportedly used by more than 50 million people. The researcher claims to have accessed 300 million…
Malwarebytes -
SolarWinds Web Help Desk2 articles this day · SecurityWeek first
SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers · Recent SolarWinds Flaws Potentially Exploited as Zero-Days
-
SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers
Microsoft disclosed a multi-stage intrusion in which Internet-exposed SolarWinds Web Help Desk instances were exploited to gain initial access and move laterally to high-value assets, potentially across organisations. The activity involved unauthenticated…
-
Recent SolarWinds Flaws Potentially Exploited as Zero-Days
Vulnerable SolarWinds Web Help Desk (WHD) instances were exploited in December 2025 for initial access, with Microsoft noting that attackers compromised the WHD deployments to spawn PowerShell and download and execute additional payloads. According to…
-
-
Ransomware Groups May Pivot Back to Encryption as Data Theft Tactics Falter
Ransomware groups are reportedly pivoting back to encryption as data-theft tactics falter, with Coveware noting that data exfiltration alone no longer delivers ROI and encryption can restore leverage. The report points to past campaigns against MOVEit, Cleo,…
SecurityWeek -
Criminal IP Integrates with IBM QRadar to Deliver Real-Time Threat Intelligence Across SIEM and SOAR
Criminal IP has announced its integration with IBM QRadar SIEM and QRadar SOAR, bringing external, IP-based threat intelligence directly into IBM’s detection, investigation and response workflows. The partnership enables real-time threat visibility by…
SecurityOnline -
European Commission probes cyberattack on mobile device management system
The European Commission is investigating a cyberattack on its mobile device management platform after detecting intrusion traces, with signs that staff names and mobile numbers may have been accessed. On 30 January, the central infrastructure managing mobile…
Security Affairs -
UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering
Written by: Ross Inman, Adrian Hernandez Introduction North Korean threat actors continue to evolve their tradecraft to target the cryptocurrency and decentralized finance (DeFi) verticals. Mandiant recently investigated an intrusion targeting a FinTech…
Google CloudOriginal report -
Outtake Raises $40 Million to Bolster Digital Trust Against AI-Driven Threats
According to SecurityWeek, Outtake has raised $40 million in a Series B round to develop a unified platform for maintaining digital trust amid AI advancements, bringing the startup’s total funding to $60 million. The funding round was led by ICONIQ with…
SecurityWeek -
Cybersecurity M&A Roundup: 34 Deals Announced in January 2026
SecurityWeek reports that 34 cybersecurity-related merger and acquisition deals were announced in January 2026, with a flurry of high-profile moves from players including CrowdStrike, Infoblox, JumpCloud, LevelBlue, OneSpan, and Radware. Notable deals…
SecurityWeek -
⚡ Weekly Recap: AI Skill Malware, 31Tbps DDoS, Notepad++ Hack, LLM Backdoors and More
The weekly recap highlights a blend of threats extending beyond traditional malware, with AISURU/Kimwolf’s 31.4 Tbps DDoS attack peak in November 2025 lasting 35 seconds, a record attributed to Cloudflare. It also notes Notepad++ update infrastructure was…
The Hacker News -
Attackers abuse SolarWinds Web Help Desk to install Zoho agents and Velociraptor
According to Huntress, on February 7, 2026, attackers exploited unpatched SolarWinds Web Help Desk flaws to run code remotely and quickly installed Zoho ManageEngine tools for persistent remote access, with Velociraptor used for control. The intrusion…
-
How Third-Party Risk Management Turns Vendor Exposure Into Actionable Defense
The article argues that modern third-party risk management must move beyond static vendor lists and annual questionnaires, which it says fail to answer which suppliers matter now or what risks are actively affecting an organisation. It highlights SOCRadar’s…
SOCRadar -
StepSecurity Detects Early Supply Chain Risk Signals in kilocode npm
StepSecurity detected early supply chain risk signals in a legitimate kilocode npm release, highlighting how small behavioural changes can quietly erode trust before an attack. On 29 January 2026, their monitoring flagged the new release of @kilocode/cli…
StepSecurity -
How Top CISOs Solve Burnout and Speed up MTTR without Extra Hiring
Top CISOs are turning to sandbox-first investigation to remove delays from security operations, arguing that static verdicts and fragmented workflows drive burnout and slow containment. They emphasise using an interactive sandbox like ANY[.]RUN to detonate…
The Hacker News -
Italy and Germany Under DDoS Assault: Weekly DDoS Threat Intelligence Analysis
Between 2 and 8 February 2026, SOCRadar identified a coordinated DDoS campaign led by the pro-Russian threat actor NoName057(16) using the DDoSia tool, with 8,101 recorded attack entries across 160 unique domains and 186 unique IP addresses, concentrated on…
SOCRadar -
Bloody Wolf Targets Uzbekistan, Russia Using NetSupport RAT in Spear-Phishing Campaign
The Hacker News reports that the threat actor Bloody Wolf has been linked to a spear-phishing campaign targeting Uzbekistan and Russia to deploy NetSupport RAT, with Kaspersky tracking the activity under the moniker Stan Ghouls. The campaign, active since at…
The Hacker News -
Fake 7-Zip downloads are turning home PCs into proxy nodes
According to Malwarebytes, fake downloads of the 7‑Zip archiver have been hosting a trojanised installer on a lookalike domain that silently turns victims’ machines into residential proxy nodes. The malware is delivered via a trojanised 7‑Zip File Manager,…
Malwarebytes -
New Paper and Tool Help Security Teams Move Beyond Blind Reliance on CISA’s KEV Catalog
On 9 February 2026, SecurityWeek reports that Tod Beardsley, currently VP of Security Research at runZero, has written a paper titled KEVology to help security teams understand KEV and how best to use it. The piece notes that CISA’s KEV Catalog, known as the…
SecurityWeek -
Siri’s New Soul: Why iOS 27 is the “Snow Leopard” Moment Your iPhone Desperately Needs
Apple’s iOS 27, slated for unveiling during WWDC 2026, is expected to prioritise performance optimisation, vulnerability remediation and a refinement of existing design elements, with reports suggesting a fairly muted affair where artificial intelligence…
SecurityOnline -
Romania’s national oil pipeline firm Conpet reports cyberattack
Conpet, Romania’s state-controlled national oil pipeline operator, said a cyberattack disrupted its business IT infrastructure but did not affect operational technologies such as the SCADA and Telecommunication systems, with the National Oil Transport System…
Security Affairs -
TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure
Cybersecurity researchers have flagged a “massive campaign” that targeted cloud native environments to build a criminal infrastructure for follow-on exploitation, observed around 25 December 2025. The operation leveraged exposed Docker APIs, Kubernetes…
-
Don’t Trash Your Printer: Microsoft Clarifies “End of Support” for V3 and V4 Drivers in Windows 11
February 9, 2026 sees Microsoft clarifying that, from January 2026, Windows will no longer support V3 and V4 printer drivers, a move framed as a deprecation of legacy architectures rather than a blanket killing of printers. According to Microsoft, V3 and V4…
SecurityOnline -
European Commission Investigating Cyberattack
The European Commission’s cybersecurity arm CERT-EU announced it discovered signs of a cyberattack within the Commission’s IT infrastructure, identified on January 30 and affecting systems used for the management of mobile devices. According to CERT-EU, the…
SecurityWeek -
A week in security (February 2 – February 8)
According to Malwarebytes Labs, the week of 2–8 February 2026 featured a slate of notable cybersecurity stories, including Apple Pay phish uses fake support calls to steal payment details published on 6 February 2026. Also highlighted was Open the wrong…
Malwarebytes -
Verified or Vanished: Google Voice Now Requires Government ID to Stop “Gray Market” Scammers
Google Voice has tightened access, with all new registrants now required to undergo a comprehensive identity verification process before any bidirectional messaging or calling can occur, and the number remains inert until verification is successful. The…
SecurityOnline -
Speed of Truth: X Trials “Collaborative Notes” to Supercharge Fact-Checking with Grok AI
Speed of Truth reports that since Elon Musk’s takeover, Community Notes has become X’s frontline defence against misinformation, and the platform is trialling a new Collaborative Notes feature to speed up fact‑checking with Grok AI. The pilot, confirmed by…
SecurityOnline
