News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 24 Feb· 43 articles
-
CrowdStrike warns attackers pivot across networks in 29 minutes
On 24 February 2026, DataBreaches[.]Net highlighted an analysis by CrowdStrike showing that in 2025 attackers moved from initial foothold to lateral movement in a matter of minutes, with an average of 29 minutes to pivot across a victim environment. The…
DataBreaches -
Attackers pivot in 29 minutes via credentials, CrowdStrike warns
In 2025, CrowdStrike found that attackers took on average 29 minutes to pivot to other systems after gaining an initial foothold, marking a 65% acceleration from the year before. The report notes the fastest breakout occurred in just 27 seconds, with another…
Dark Reading -
North Korean group Lazarus expands with Medusa ransomware
Lazarus Group has expanded its repertoire with Medusa ransomware, dropped in a recent attack on an organization in the Middle East, according to new research from the Symantec and Carbon Black threat hunter team. The researchers also note that Lazarus actors…
Dark Reading -
SolarWinds fixes four Serv U file server bugs that allow root
SolarWinds has issued updates addressing four critical Serv-U vulnerabilities that could allow remote code execution and potentially grant attackers full root access on unpatched servers. The flaws include CVE-2025-40538, a broken access control issue that…
-
Cloudflare unveils vinext, AI made Next.js rival 1.6x faster
On 24 February 2026, Cloudflare revealed that vinext, a drop-in replacement for Next[.]js built on Vite, was created in under a week by one engineer with AI. Early benchmarks show production builds 1.6x faster and client bundles about 57% smaller, with a…
Cloudflare -
RoguePilot lets hidden Copilot prompts seize GitHub repos
A vulnerability codenamed RoguePilot in GitHub Codespaces could allow attackers to seize control of repositories by injecting malicious Copilot instructions via a GitHub issue, enabling silent execution of commands and leakage of a privileged GITHUB_TOKEN.…
The Hacker News -
Seychelles bulletproof hoster scans open redirects to bypass auth
Open redirects remain a notable vulnerability, highlighted by OWASP’s history of listing “Unvalidated Redirects and Forwards” in 2010 and merging it into “Sensitive Data Exposure” in 2013. The vulnerability can be subtle: a user receives a 3xx redirect and…
SANS ISC -
Malicious Next.js repos trick developers into live code execution
Microsoft Defender Experts and the Microsoft Defender Security Research Team describe a coordinated developer-targeting campaign delivered through malicious repositories disguised as legitimate Next[.]js projects and recruitment-themed technical assessments.…
Microsoft -
Shadow AI negligence drove 53% of insider losses, report finds
Employee negligence driven by shadow AI cost organisations more than any other type of insider risk last year, accounting for 53% of the $19.5m lost on average per business, according to DTEX. The security vendor’s Cost of Insider Risks 2026 report was…
Infosecurity -
Pittsburgh orthopaedic breach: 56,954 left unclear after delay
Greater Pittsburgh Orthopaedic Associates disclosed a 2025 breach that occurred on or about August 10, 2025, with external listings on RansomHouse appearing on August 20, 2025. According to HHS’s public breach tool, 35,000 patients were affected, though…
DataBreaches -
Phishers clone Bitpanda crypto site to harvest logins and ID data
A sophisticated phishing campaign impersonating cryptocurrency brokerage Bitpanda has been uncovered by cybersecurity researchers, according to Cofense Phishing Defense Center. The operation combines credential theft with extensive personal data harvesting,…
Infosecurity -
UK regulators fine Reddit and US porn site $20M over minors' data
According to Ofcom and the Information Commissioner’s Office (ICO), the UK is enforcing age verification and children’s privacy rules with urgency, fining operators and data‑use practices that fall short. On 23 February 2026, Ofcom fined US‑based porn…
Malwarebytes -
LA County sues games platform Roblox over child safety
Los Angeles County has sued online games platform Roblox, with the February 19 filing making LA County the first California government body to take the company to court over child safety. Roblox claims over 151 million daily users, most of whom are kids, and…
Malwarebytes -
Arkanix infostealer stole browsers, Telegram and crypto wallets
Arkanix Stealer operated as a malware-as-a-service one-shot campaign, with its developer first advertising the infostealer in October 2025 and likely ceasing operations in December 2025 when its control panel and Discord channel disappeared, according to…
SecurityWeek -
Broadcom VMware Aria Operations2 articles this day · SecurityWeek first
VMware Aria Operations must be patched after CVE-2026-22719 · Broadcom patches command injection in VMware Aria CVE-2026-22719
-
VMware Aria Operations must be patched after CVE-2026-22719
Broadcom has released security updates for multiple flaws in VMware Aria Operations that could allow remote access, with the most severe being a command injection flaw tracked as CVE-2026-22719 (CVSS 8.1) that unauthenticated attackers could exploit to run…
-
Broadcom patches command injection in VMware Aria CVE-2026-22719
Broadcom has patched several vulnerabilities in VMware Aria Operations, including high-severity flaws, with the most critical being CVE-2026-22719, a command-injection issue that can be exploited by an unauthenticated attacker. According to Broadcom, this…
-
-
North Korea linked Medusa ransomware targets US healthcare
A new wave of cyber-attacks using Medusa ransomware has been linked to North Korean state-backed hackers, with researchers from Symantec and Carbon Black Threat Hunter Team saying the hostilities targeted a Middle East organisation and a US healthcare…
Infosecurity -
Mercenary group spoofs Ukrainian court to install RMS on EU bank
UAC-0050 has been observed targeting a European financial institution as part of a social engineering campaign that spoofed a Ukrainian judicial domain to deliver a link to a remote access payload. The attack chain starts with a spear‑phishing email…
The Hacker News -
N Korea Lazarus uses Medusa ransomware to extort US hospitals
Posted on 24 February 2026, the piece reports that Lazarus hackers are deploying Medusa ransomware in extortion campaigns targeting the U.S. healthcare sector and a Middle East entity. According to Symantec and Carbon Black Threat Hunter teams, these…
DataBreaches -
OT exposure soars 332% as IT borne attacks force SOC convergence
OT security is shifting from a focus on isolating OT to protecting the edge where IT and OT converge, a view reinforced by joint research from Palo Alto Networks OT Threat Research Lab, Siemens Cybersecurity Lab and the Idaho National Laboratory. The study…
unit42.paloaltonetworks.com -
Veteran Fortune 500 CISO Youngblood moves into AI and venture
Timothy Youngblood is profiled as a four-time Fortune 500 CISO/CSO, having served as Dell’s first CISO in 2010, then as CISO at Kimberley-Clark, corporate VP and CISO at McDonald’s, and SVP, CSO and product security officer at T-Mobile. He has also pursued…
SecurityWeek -
Two teens charged after Seoul bike app breach exposed 4.6M users
Two South Korean teenagers were this week charged with breaching Seoul’s public bike service, Ttareungyi. Identified only as Persons A and B, the pair, now of high school age, allegedly carried out the attack on Ttareungyi in June 2024 and stole data…
DataBreaches -
Shinyhunters threaten to leak 8M records from Dutch telecom Odido
Hackers threaten to publish data from Odido breaches unless the Dutch telecom pays, with the group alleging up to 8 million customers and 21 million data lines stolen. The cybercriminal group Shinyhunters is responsible for hacking Odido, and according to…
DataBreaches -
Sandworm_Mode supply chain worm hits NPM, steals GitHub secrets
SecurityWeek reports a new supply chain attack called Sandworm_Mode worming through the NPM registry, with the malicious code propagating like a worm and exfiltrating secrets while including a configurable dead switch that can wipe home directories if GitHub…
SecurityWeek -
NZ MediMap offline after patient names changed to 'Charlie Kirk
MediMap, a New Zealand health app used in aged care, disability, hospice and community settings to record medication doses, was taken offline after unauthorised access was detected following problems on Sunday afternoon, according to 1News. Some patient…
DataBreaches -
Investors pour $119bn into AI security startups as M&A surges
Investments in cybersecurity startups surged in 2025, driven by a rush to AI-native security solutions and a wave of mergers and acquisitions, according to Momentum Cyber. Venture-capital firms invested $119 billion in cybersecurity, with 400 M&A…
Dark Reading -
Security firm ReliaQuest says AI cuts attack times to minutes
AI is helping threat actors to accelerate attacks, but it can also empower incident responders to quickly contain threats, according to ReliaQuest. The firm’s Annual Cyber-Threat Report 2026 is based on an analysis of customer incidents and found that…
Infosecurity -
Microsoft calls for agentic SOC as 42% of alerts go uninvestigated
Security leaders are contending with truncated attack timelines and aging, siloed defenses that struggle to keep pace with real‑time threats, according to the Microsoft Security Blog. The piece argues for a shift to an agentic SOC that unifies threat signals…
Microsoft -
RoguePilot uses Copilot prompt injection to seize GitHub repos
SecurityWeek reports that a vulnerability in GitHub Codespaces could let attackers seize control of repositories by injecting malicious Copilot instructions into a GitHub issue, a chain described by Orca Security as enabling passive prompt injections.…
SecurityWeek -
Chinese APTs exploited CVE-2024-7694 in ThreatSonar security tool
According to SecurityWeek, Taiwan-based TeamT5 has confirmed that the vulnerability added recently by CISA to its Known Exploited Vulnerabilities (KEV) catalog was likely exploited by Chinese threat actors. The flaw, CVE-2024-7694, enables an attacker with…
-
Put identity first: prioritise risks by context not volume
Identity Prioritization isn't a backlog problem; it's a risk math problem, argues The Hacker News in its 24 February 2026 piece, framing identity risk as a function of context rather than volume. According to The Hacker News, risk arises from a compound of…
The Hacker News -
Lazarus adopts Medusa RaaS to extort hospitals and charities
The Lazarus Group, also known as Diamond Sleet and Pompilus, has been observed using Medusa ransomware in an attack targeting an unnamed entity in the Middle East, according to Symantec and Carbon Black Threat Hunter Team. Broadcom's threat intelligence…
The Hacker News -
Anthropic accuses three Chinese labs of distilling its Claude model
Anthropic warned that three Chinese AI labs have used a technique called model distillation against Claude, generating millions of queries to copy the model. According to Anthropic, DeepSeek, Moonshot and MiniMax have generated over 16 million exchanges with…
Infosecurity -
SOCRadar finds public Elasticsearch leak of 544M credentials
SOCRadar’s AI-powered Sensitive Data Exposure Monitoring service identified a publicly accessible and misconfigured Elasticsearch instance containing approximately 544,322,698 records. The database was exposed directly to the internet without authentication…
SOCRadar -
Arkanix info stealer harvested Telegram, VPN and browser data
Arkanix Stealer surfaced in late 2025 as a short-lived info-stealer promoted on dark web forums, likely created as an AI-assisted experiment and quickly abandoned. According to Kaspersky, ads for the MaaS offering described a control panel and configurable…
Security Affairs -
Spain arrests four over Anonymous Fénix hacktivist DDoS campaign
SecurityWeek reports that four members of Anonymous Fénix were arrested in Spain for involvement in distributed denial-of-service attacks aimed at government, political, and public websites. The group’s administrator and moderator were arrested last year,…
SecurityWeek -
AI enabled cyber attacks almost doubled in 2025, says CrowdStrike
AI-enabled cyber-attacks have nearly doubled in the last year, with CrowdStrike warning that threat actors are using machine learning and Large Language Models to optimise attack techniques and campaigns. According to the CrowdStrike Global Threat Report…
Infosecurity -
UnsolicitedBooker uses phishing to hit Central Asian telcos
The threat activity cluster known as UnsolicitedBooker has been observed targeting telecommunications companies in Kyrgyzstan and Tajikistan, marking a shift from prior attacks aimed at Saudi Arabian entities. The attacks involve the deployment of two…
The Hacker News -
Fake Zoom update page silently installs Teramind monitoring tool
A fake Zoom meeting “update” page is silently pushing surveillance software onto Windows machines, masquerading as a Zoom call and delivering an automatic Update Available prompt that downloads a covert installer without user permission. The installer is a…
Malwarebytes -
Russia's APT28 runs MacroMaze webhook macros to steal data
Russia-linked APT28 (aka UAC-0001, Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, STRONTIUM) launched Operation MacroMaze, targeting select entities in Western and Central Europe from September 2025 to January 2026, using webhook-based macro…
Security Affairs
