News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 13 Feb· 40 articles
-
Phishing on the Edge of the Web and Mobile Using QR Codes
The article from Palo Alto Networks discusses the growing misuse of QR codes as a vector for phishing attacks, referred to as "quishing." It highlights three main issues: 1) QR codes employing URL shorteners to mask malicious links, 2) in-app deep links that…
unit42.paloaltonetworks.com -
New threat actor UAT-9921 deploys VoidLink against enterprise sectors
Cisco Talos reports a previously unknown threat actor, UAT-9921, is using a new modular framework called VoidLink to target technology and financial services organisations. According to Cisco Talos, VoidLink is Linux-focused but implants exist for Windows,…
Security Affairs -
Zscaler-SquareX Deal Boosts Zero Trust, Secure Browsing Capabilities
Zscaler has completed the acquisition of SquareX, a move that extends its Zero Trust Exchange with in-browser enforcement capabilities. SquareX’s browser extension provides real-time threat detection and response inside Chromium-based browsers and is…
Dark Reading -
Attorney General Ken Paxton Demands Information from Blue Cross Blue Shield of Texas and Conduent as Part of Investigation into Largest Data Breach in U.S. History
According to Texas Attorney General Ken Paxton, Civil Investigative Demands were issued to Blue Cross Blue Shield of Texas and Conduent Business Services LLC, demanding documents and information pertinent to the investigation of the Conduent data breach. The…
DataBreaches -
South Korea blames Coupang data breach on management failure, not sophisticated attack
South Korea’s Science Ministry has blamed Coupang’s massive data leak on management failure rather than a sophisticated cyberattack, calling for fixes to vulnerabilities in its security systems. The first findings of the government-led probe said a former…
DataBreaches -
Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs
According to Google Threat Intelligence Group (GTIG), a previously undocumented threat actor has been linked to attacks on Ukrainian organisations using the CANFAIL malware. GTIG describes the group as possibly affiliated with Russian intelligence services…
The Hacker News -
Microsoft Under Pressure to Bolster Defenses for BYOVD Attacks
Threat actors have increasingly weaponised the BYOVD technique to disable security products by exploiting Windows drivers, sometimes dropping a kernel-level payload to terminate security processes before deploying ransomware, infostealers or backdoors,…
Dark Reading -
Nation-State Hackers Put Defense Industrial Base Under Siege
Nation-State Hackers Put Defense Industrial Base Under Siege documents how espionage groups from China, Russia and other nations burned at least two dozen zero-days in edge devices to infiltrate defense contractors’ networks, underscoring the DIB as a…
Dark Reading -
AI Agents 'Swarm,' Security Complexity Follows Suit
As AI deployments scale to packs of agents working in concert, organisations face a naturally amplified attack surface, and the resulting swarm orchestration introduces additional security concerns that must be addressed to protect an organisation’s data. AI…
Dark Reading -
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)4 articles this day · The Hacker News first
2/13/26, 4:35 PM · Attackers exploit BeyondTrust CVE-2026-1731 within hours of PoC release
-
2/13/26, 4:35 PM
A new exploitation wave targeting BeyondTrust products emerged after the vulnerability CVE-2026-1731 was disclosed, with patches for BeyondTrust Remote Support and older Privileged Remote Access versions released on 6 February 2026. A Proof of Concept…
-
Attackers exploit BeyondTrust CVE-2026-1731 within hours of PoC release
Attackers began exploiting BeyondTrust CVE-2026-1731 within hours of a PoC being released, exposing an unauthenticated remote code execution flaw in BeyondTrust Remote Support and older Privileged Remote Access products. BeyondTrust released security updates…
-
BeyondTrust Vulnerability Targeted by Hackers Within 24 Hours of PoC Release
Threat actors began targeting BeyondTrust Remote Support and Privileged Remote Access within 24 hours of the PoC release for CVE-2026-1731, a critical unauthenticated remote code execution flaw. BeyondTrust patched CVE-2026-1731 on 6 February, the same day…
-
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
According to watchTowr, threat actors are already exploiting a recently disclosed critical flaw in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) with CVE-2026-1731 (CVSS 9.9), enabling unauthenticated remote code execution. They observed…
-
-
Google Links China, Iran, Russia, North Korea to Coordinated Defense Sector Cyber Operations
According to Google Threat Intelligence Group, the defense industrial base (DIB) has been the focus of sustained, multi‑vector activity by state‑sponsored actors, hacktivist entities, and criminal groups from China, Iran, North Korea and Russia. The…
The Hacker News -
UAT-9921 Deploys VoidLink Malware to Target Technology and Financial Sectors
A previously unknown threat actor tracked as UAT-9921 has been observed using a new modular framework called VoidLink in campaigns that target the technology and financial services sectors, according to Cisco Talos. The researchers say UAT-9921 uses…
The Hacker News -
In Other News: Google Looks at AI Abuse, Trump Pauses China Bans, Disney’s $2.7M Fine
SecurityWeek’s weekly roundup highlights how AI is shifting threat actor tradecraft, with Google Threat Intelligence Group noting in Q4 2025 that adversaries are increasingly integrating AI across attack stages, including model extraction attempts and…
SecurityWeek -
Korea’s Personal Information Protection Commissioner fines 3 LVMH luxury brands after Salesforce data breaches
Korea’s Personal Information Protection Commissioner fined three LVMH luxury brands after Salesforce data breaches, with fines totaling 36.033 billion won (USD 24,925,824.15) and penalties of 10.8 million won (USD 7,472.78). The brands affected were Louis…
DataBreaches -
How to find and remove credential-stealing Chrome extensions
Researchers have identified a new family of credential-stealing Chrome extensions in the Chrome Web Store, with 30 different extensions found stealing credentials from more than 260,000 users. The malicious extensions render a full-screen iframe pointing to…
Malwarebytes -
Check Point Announces Trio of Acquisitions Amid Solid 2025 Earnings Beat
Check Point Software Technologies has announced three acquisitions—Cyata, Cyclops, and Rotate—to accelerate its push into AI-driven security and exposure management. According to Calcalist, the total paid for the trio is approximately $150 million, including…
SecurityWeek -
IRS Improperly Shares Immigrants’ Data with ICE: Explained
According to DataBreaches[.]Net, the IRS improperly shared thousands of immigrants’ personal information with ICE under a data-sharing deal with DHS that began in April 2025 to assist with criminal investigations, though it was subject to privacy law…
DataBreaches -
Dutch Carrier Odido Discloses Data Breach Impacting 6 Million
Odido, the Dutch mobile phone carrier, disclosed a data breach impacting the personal information of over 6 million customers. The incident occurred on 7–8 February and involved unauthorized access to a customer contact system, affecting customers of Odido…
SecurityWeek -
Malicious Chrome Extensions Caught Stealing Business Data, Emails, and Browsing History
Cybersecurity researchers have uncovered a wave of malicious Chrome extensions designed to siphon data from users, including Meta Business Suite and Facebook Business Manager details. One extension, CL Suite by @CLMasters (ID:…
The Hacker News -
Top Nation-State Cyber Threats Targeting the United States
Top Nation-State Cyber Threats Targeting the United States summarises how, in 2025 and 2026, state-linked groups focused on gaining long-term visibility through identities, inboxes and trusted processes rather than smashing front doors. According to…
SOCRadar -
Google: state-backed hackers exploit Gemini AI for cyber recon and attacks
According to Google, Google DeepMind and GTIG report a rise in model extraction or “distillation” attacks aimed at stealing AI intellectual property, and state-backed actors from North Korea, Iran, China and Russia are using AI for research, targeting and…
Security Affairs -
npm’s Update to Harden Their Supply Chain, and Points to Consider
In December 2025, npm overhauled its authentication in response to the Sha1-Hulud incident, revoking classic tokens and moving to session-based credentials to curb supply-chain abuse. The changes include short-lived tokens, typically two hours, and a default…
The Hacker News -
CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities
According to CISA, recently disclosed vulnerabilities affecting SolarWinds, Notepad++, Apple and Microsoft have been exploited in the wild, with SolarWinds CVE-2025-40536 described as a security control bypass in Web Help Desk that could allow…
-
AI-Driven Threats Targeting U.S. Organizations
AI-driven threats are reshaping the US threat landscape, with attackers leveraging generative AI to scale social engineering, automate vulnerability discovery, and adapt payloads in real time, according to the article. OpenAI’s June 2025 report identifies…
SOCRadar -
Fake shops target Winter Olympics 2026 fans
Malwarebytes warns that scammers have targeted Winter Olympics 2026 fans by creating lookalike domains to imitate the official Olympic merchandise store, where Tina plush is listed at €40 and currently out of stock. In roughly the past week, the company…
Malwarebytes -
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, four flaws were added to its Known Exploited Vulnerabilities catalog: CVE-2024-43468 (CVSS 9.8) for Microsoft Configuration Manager SQL Injection, CVE-2025-15556 (CVSS 7.7) for…
-
Chrome 145 Patches 11 Vulnerabilities
Chrome 145 has been released to the stable channel fixing 11 vulnerabilities, with three of them rated as high-severity, according to Google. The disclosed CVEs include CVE-2026-2313, a high-severity use-after-free in CSS, which earned an $8,000 bug bounty,…
-
China Revives Tianfu Cup Hacking Contest Under Increased Secrecy
China’s Tianfu Cup hacking contest returned in 2026 and is now overseen by the government, with the event framed by increased transparency concerns. The competition took place January 29-30, and the MPS announced the Tianfu Cup on January 16, with a…
SecurityWeek -
Shedding old code with ecdysis: graceful restarts for Rust services at Cloudflare
Cloudflare has open-sourced ecdysis, a Rust library that enables graceful restarts with no dropped live connections or refused new connections. Developed for years in production and open-sourced last month, it has powered zero-downtime upgrades across…
Cloudflare -
Inside Job: Abandoned Outlook Add-in “AgreeTo” Steals 4,000 Credentials
Researchers at KOI Security have revealed a new abuse of an abandoned Outlook add‑in called “AgreeTo,” which was resurrected by cybercriminals as a stealthy credential-stealing tool. The attackers claimed the abandoned Vercel URL and replaced the legitimate…
SecurityOnline -
Triple Threat Patched: Zimbra 10.1.16 Fixes XSS, XXE & LDAP Injection
Zimbra has rolled out a significant security update, releasing Zimbra 10.1.16 to address several vulnerabilities, with a strong recommendation for administrators and users to upgrade immediately. The patch fixes three injectable flaw categories, including…
SecurityOnline -
Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware
According to ReliaQuest, a China-based threat actor group identified as Storm-2603 has been caught exploiting a critical SmarterMail vulnerability to deploy Warlock ransomware, representing a significant escalation against email infrastructure. The attack…
-
Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware
Lazarus Group has expanded its fake-recruiter campaigns into the cryptocurrency sector, targeting Python and JavaScript developers with a new operation codenamed Graphalgo that lures victims with lucrative job offers before delivering multi-layered malware…
SecurityOnline -
The Human Hack: LummaStealer Returns with Deceptive “ClickFix” Attacks
According to Bitdefender, LummaStealer has re-emerged with a shifted focus on social engineering rather than software flaws, returning less than a year after a major disruption in 2025. The threat now relies heavily on human psychology, using deceptive…
SecurityOnline -
Back to the Future: SSHStalker Botnet Revives 2009 Tactics to Hijack Linux Servers
A security report on SSHStalker, described by Flare researchers, shows a Linux botnet reviving 2009 tactics to hijack servers, combining old-school IRC botnet methods with modern automation. The operation was uncovered after honeypots were hit over a…
SecurityOnline -
Trojan Horse in the Server Room: Muddled Libra’s Rogue VM Strategy Exposed
A Unit 42 investigation has pulled back the curtain on Muddled Libra, the cybercrime group also known as Scattered Spider or UNC3944, detailing a September 2025 incident. The report describes a rogue virtual machine inside a victim’s network that served as…
SecurityOnline -
Telegram Phishing Campaign Hijacks Accounts by Abusing Trust
A new phishing operation uncovered by CYFIRMA targets Telegram users by weaponising the platform’s own security features, steering away from credential harvesting and towards authorising attackers directly through Telegram’s official app. According to…
SecurityOnline
