News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 25 Feb· 55 articles
-
Cisco Catalyst SD-WAN Controller and Manager2 articles this day · CISA first
CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127 · CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover
-
CISA orders emergency patch for Cisco SD WAN after CVE-2026-20127
On 25 February 2026, Cisco disclosed a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller and Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-20127, which allows an unauthenticated attacker to gain administrative access to…
-
CISA adds CVE-2026-20127: Cisco SD WAN allows admin takeover
CISA has added CVE-2026-20127, the Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability, to its Known Exploited Vulnerabilities catalogue. The issue affects Cisco Catalyst SD‑WAN Controller (formerly SD‑WAN vSmart) and Cisco…
-
-
Anthropic’s Claude Code flaws let repos seize PCs, steal keys
Three critical vulnerabilities in Anthropic’s Claude Code, an AI-powered coding tool, exposed developers to full machine takeover and credential theft simply by opening a project repository. Anthropic fixed the issues after Check Point Research discovered…
-
anthropics claude-code3 articles this day · Check Point first
Anthropic's Claude Code AI exploited by repos to steal API keys · Anthropic's Claude Code AI bugs let attackers run code and steal API keys
-
Anthropic's Claude Code AI exploited by repos to steal API keys
Untrusted repositories turn Claude code into an attack vector reports that flaws in Anthropic’s Claude Code could allow remote code execution and theft of API keys when users open untrusted repositories. Check Point Research found multiple vulnerabilities…
-
Anthropic's Claude Code AI bugs let attackers run code and steal API keys
Cybersecurity researchers have disclosed multiple security vulnerabilities in Anthropic's Claude Code, an AI-powered coding assistant, that could result in remote code execution and theft of API credentials. The findings, reported by Check Point Research,…
-
Check Point finds API key leak in Anthropic's AI code assistant
Catching attention with the headline Caught in the Hook, Check Point Research reveals three configuration-based vulnerabilities in Anthropic’s Claude Code that enable remote code execution and API key exfiltration, tracked as CVE-2025-59536 and…
-
-
Iran linked Handala hacks Clalit, leaks 10,000+ patient files
Clalit Health Services, the largest health maintenance organisation in Israel, is investigating a suspected cyberattack after an Iranian-linked hacking group called Handala claimed it breached the insurer’s systems and published thousands of documents…
DataBreaches -
Ransomware forum RAMP takedown drives gangs to vetted marketplaces
RAMP Forum Seizure Fractures Ransomware Ecosystem reports that researchers see the ransomware ecosystem fragmenting after US authorities seized infrastructure tied to the notorious RAMP cybercrime forum last month, with Rapid7 noting two possible successor…
Dark Reading -
CLAIR links Purdue and Zachman and maps power to data cascades
The CLAIR Model is presented as a new conceptual framework that links Purdue’s enterprise architecture with the Zachman framework to map critical infrastructure interdependencies, extending the traditional five-level Purdue hierarchy to a ten-level stack. It…
SANS ISC -
Zyxel fixes critical UPnP RCE affecting a dozen router models
Zyxel says it has fixed a critical remote code execution flaw affecting more than a dozen router models, tracked as CVE-2025-13942 with a CVSS of 9.8, which allows an unauthenticated attacker to execute OS commands on a vulnerable device via crafted UPnP…
-
PCI warns payment threats accelerate as BridgePay outage hits
According to the PCI Security Standards Council, the 2025 annual report shows threats to payments systems are speeding up even as the council expands its remit and activities. The report notes sustained global collaboration to safeguard payments, with…
Dark Reading -
SecuritySnack finds 250 domains linked to crypto scam laundering
SecuritySnack - Idolized Crypto Scams, published on 25 February 2026, documents a cryptocurrency scam operation active since at least January 2025 that spans roughly 250 identified domains across multiple themes. The investigation identifies two thematic…
dti.domaintools.com -
Google disrupts China linked UNC2814 espionage using Sheets API
According to Google Threat Intelligence Group (GTIG) and Mandiant, Google disclosed that it disrupted the infrastructure of UNC2814, a suspected China-nexus cyber espionage group, after the actors breached at least 53 organisations across 42 countries. The…
The Hacker News -
CISA adds Cisco SD WAN CVE-2022-20775 to KEV, warns of root risk
CISA has added CVE-2022-20775, the Cisco SD-WAN Path Traversal Vulnerability, to its Known Exploited Vulnerabilities catalogue; the flaw affects Cisco SD‑WAN and allows an authenticated local attacker to bypass CLI access controls to gain elevated privileges…
-
North Korea plants RCE and C2 in fake Next.js interview repos
Malicious Next[.]js repositories are being used to target developers with fake job interviews, delivering remote code execution and establishing a persistent command-and-control channel on infected machines. Microsoft sounded the alarm, noting that…
Dark Reading -
Stolen credentials and agentic AI widen supply chain attack risk
According to IBM X-Force’s 2025 Threat Intelligence Index, more than half of the 400,000 vulnerabilities tracked in 2025 required no authentication before exploitation, underscoring how weak access controls continue to fuel risk. The report also notes a…
SecurityWeek -
Attackers Target Cisco Catalyst SD WAN to Gain Persistent Access
The document discusses urgent cybersecurity concerns regarding Cisco Catalyst Software Defined Wide Area Networks (SD-WAN). Malicious actors are seen targeting these networks to gain unauthorized access and maintain persistent control. Key recommendations…
ncsc.gov.uk -
Google disrupts UNC2814 linked to China using Google Sheets C2
Google announced that it has disrupted a significant China-linked cyberespionage campaign targeting telecoms and government organisations worldwide, tracked by GTIG and Mandiant as UNC2814. The group has been active since at least 2017 and is described as…
SecurityWeek -
Harden Runner by StepSecurity adds EDR to GitHub Actions runners
According to StepSecurity, Harden Runner now supports Windows and macOS GitHub-hosted runners, delivering EDR-level runtime security across Linux, Windows, and macOS CI/CD pipelines. The release is described as the first EDR solution to provide runtime…
StepSecurity -
Nearby Glasses app alerts you to Meta, Ray Bans and Snap cameras
Developer creates app to detect nearby smart glasses, by Pieter Arntz, published on 25 February 2026, notes that an independent developer, prompted by concerns over abuse of smart glasses, built Nearby Glasses to warn when wearable cameras are nearby. The…
Malwarebytes -
SolarWinds patches four ServU file transfer RCEs, update to 15.5.4
SolarWinds has issued patches for four critical-severity flaws in its Serv-U file transfer appliance, tracked as CVE-2025-40538 to CVE-2025-40541, each with a CVSS score of 9.1 and capable of remote code execution in Serv-U version 15.5. The company explains…
-
SLH criminal group pays women $500 to $1,000 for helpdesk vishing
The Hacker News reports that the Scattered LAPSUS$ Hunters (SLH) cybercrime collective has been observed offering financial incentives to recruit women to carry out social engineering operations, specifically targeted at IT help desks for vishing campaigns.…
The Hacker News -
AI fuelled attacks spark 44% surge in public facing applications
There has been a 44% increase in cyber-attacks exploiting public-facing applications, according to IBM X-Force. The 2026 IBM X-Force Threat Intelligence Index points to missing authentication controls and AI-enabled vulnerability scanning as major drivers…
Infosecurity -
Execution evidence from ANY.RUN cloud sandbox slashes triage time
The Hacker News outlines five ways broken triage heightens business risk rather than reducing it, starting with decisions made without real evidence, where partial signals lead to escalation or approval without showing what a file or link does. The article…
The Hacker News -
Phone number phishing (TOAD) steals logins, bypasses gateways
TOAD, or telephone-oriented attack delivery, is now beating gateways by delivering only a phone number in phishing emails that bypass secure email filters. Researchers published an analysis of roughly 5,000 email-based threat detections that bypassed secure…
Dark Reading -
Google disrupts GRIDTIDE backdoor hiding in Google Sheets
The Google Threat Intelligence Group, in collaboration with Mandiant, has successfully disrupted the GRIDTIDE global cyber espionage campaign led by the cyber actor UNC2814, associated with the People's Republic of China. This campaign primarily targeted…
Google Cloud -
Medical device maker UFP hit by ransomware and data theft
Medical device maker UFP Technologies disclosed a cybersecurity incident that involved data theft and the disruption of some IT systems, with an IT intrusion detected on 14 February. The company said attackers exfiltrated files and that it is still…
SecurityWeek -
South Korea moves to tighten data and cyber laws after breaches
South Korea is considering updates to data and cyber laws after recent large‑scale data breaches across telecommunications, retail, and finance sectors, prompting lawmakers and regulators to act. According to Hogan Lovells, the proposed amendments centre on…
DataBreaches -
UAE halts AI driven ransomware campaign it calls terrorist
The United Arab Emirates said it stopped a ransomware attack this weekend and described it as having a terrorist nature, in a statement from the Cyber Security Council issued on Saturday. According to the Cyber Security Council, they “successfully thwarted…
DataBreaches -
Wynn confirms breach after ShinyHunters deleted data
Wynn Resorts Confirms Data Breach After Hackers Remove It From Leak Site, with the incident linked to the ShinyHunters leak site, which had previously listed the resort but is now removed, suggesting data was deleted at the extortionists’ prompting. The…
DataBreaches -
Soliton FileZen open to OS command injection CVE-2026-25108
CISA has added CVE-2026-25108 to the Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Soliton Systems K.K FileZen. The Soliton Systems K.K FileZen OS Command Injection Vulnerability allows a user who logs in to the product to trigger an…
-
Fake NuGet package impersonating Stripe.net stole API keys
A malicious NuGet package designed to mimic Stripe's official .NET library has been uncovered, marking a shift in tactics from cryptocurrency-focused campaigns to the broader financial sector, according to ReversingLabs. The package, named StripeApi[.]Net,…
Infosecurity -
L3Harris Exec Jailed for Selling Cyber Exploits to Russian Broker
An Australian national was sentenced to 87 months in a US prison for stealing trade secrets from a defence contractor and selling them to a Russian cyber-exploit broker. Peter Williams, 39, stole at least eight cyber exploits between April 2022 and June 2025…
SecurityWeek -
NuGet packages exfiltrate ASP.NET Identity and add backdoors
Cybersecurity researchers have found four malicious NuGet packages aimed at ASP[.]NET developers that exfiltrate ASP[.]NET Identity data, including user accounts, role assignments, and permission mappings, while also manipulating authorization rules to…
The Hacker News -
Extortion group ShinyHunters leaks 12.5m CarGurus PII
Hackers claim to have stolen personally identifiable information and internal corporate data from CarGurus, with Have I Been Pwned saying the breach involves information pertaining to approximately 12.5 million accounts. The incident was disclosed last week…
SecurityWeek -
New OT scoring model OTI rates Colonial Pipeline as high impact
A new OT-focused scoring model called the OTI Impact Score is being unveiled to gauge the magnitude of cyber incidents affecting operational technology, with the aim of clarifying how such events actually affect business outcomes. According to co-creator…
Dark Reading -
Google and Palo Alto lead $92.5B cybersecurity M&A surge in 2025
SecurityWeek’s M&A tracker shows 426 cybersecurity deals announced in 2025, with 334 of them involving pure-play companies and a 5% rise on the 2024 figure. According to SecurityWeek, the US accounted for roughly 67% of global activity, while the UK…
SecurityWeek -
ShinyHunters cybercrime group leaks 12.4M CarGurus user records
The ShinyHunters cyberattack on CarGurus led to the exposure of more than 12.4 million user records after the group leaked a 6.1GB compressed archive on February 21. The compromised data included emails, names, physical addresses, IP addresses and phone…
Security Affairs -
Wynn confirms ShinyHunters leak group stole 800,000 staff records
Wynn Resorts has confirmed that hackers stole employee data, with the group ShinyHunters claiming the breach and listing Wynn Resorts on its data leak site. According to SecurityWeek, Wynn said an unauthorized third party acquired certain employee data and…
SecurityWeek -
SOCRadar threat intel firm warns Shadow IT opens cloud estates to attackers
The article argues that in modern enterprises the attack surface is massive and ever-changing, extending beyond firewalls into cloud, mobile, and third-party ecosystems, making static inventories outdated. It warns that many organisations still rely on…
SOCRadar
