News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 26 Feb· 41 articles
-
Cisco Catalyst SD-WAN flaw exposes enterprise networks to hackers
Cisco has warned that hackers have been exploiting a critical bug in its Catalyst SD-WAN products to break into large enterprise networks for at least three years. The vulnerability has a maximum-rated severity score of 10.0 and enables attackers to remotely…
DataBreaches -
Fake Zoom update delivers Teramind malware to monitor Windows PCs
Malwarebytes’ deep dive into a campaign that started with a fake Zoom meeting “update” shows attackers using a legitimate Teramind monitoring tool to surveil Windows machines. The initial piece, published on 24 February 2026, documented a convincing fake…
Malwarebytes -
Fintech sues SonicWall after ransomware breach hits 780k
A large fintech company is suing its firewall vendor, Marquis v SonicWall, after a data breach blamed on a third-party security vendor. Marquis says its ransomware attack on 14 August compromised its IT network and customer data, including PII for some…
Dark Reading -
Cisco Catalyst SD-WAN Controller and Manager5 articles this day · The Hacker News first
Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years · CVE-2026-20127: Critical Cisco SD WAN flaw gives root access
-
Cisco Catalyst SD WAN zero day CVE-2026-20127 exploited for years
Cisco says a critical zero‑day in its Catalyst SD-WAN Controller, tracked as CVE-2026-20127, has been exploited in the wild for at least three years. The flaw is an authentication bypass with a maximum CVSS score of 10, and an attacker can log into the…
-
CVE-2026-20127: Critical Cisco SD WAN flaw gives root access
Cisco has disclosed a critical SD-WAN vulnerability, tracked as CVE-2026-20127 with a CVSS of 10.0, which has been exploited since 2023 to grant unauthenticated attackers full administrative access to Catalyst SD-WAN Controller and Manager by sending crafted…
-
Five Eyes warn Cisco SD WAN zero day grants admin CVE-2026-20127
UK and international security agencies have urged Cisco customers to patch a critical zero‑day in their SD-WAN kit that has been exploited since 2023, with CVE-2026-20127 described as an authentication bypass in the peering authentication of Cisco Catalyst…
-
Cisco patches exploited Catalyst SD WAN zero day CVE-2026-20127
Cisco has rolled out emergency patches for a critical Catalyst SD-WAN zero-day (CVE-2026-20127, CVSS 10/10) that has been exploited in the wild, with fixes affecting Catalyst SD-WAN Controller and Manager versions listed in the advisory. The flaw allows…
-
Critical CVE-2026-20127 in Cisco SD WAN gives remote admin access
Cisco has disclosed a maximum-severity flaw in the Cisco Catalyst SD-WAN Controller (formerly vSmart) and Catalyst SD-WAN Manager (formerly vManage), tracked as CVE-2026-20127 (CVSS 10.0), which has been exploited in the wild since 2023 to grant…
-
-
Trend Micro, Inc. TrendAI Apex One2 articles this day · SecurityWeek first
Trend Micro patches two Apex One RCE flaws CVE-2025-71210/71211 · TrendAI (ex Trend Micro) patches Apex One RCE and privilege flaws
-
Trend Micro patches two Apex One RCE flaws CVE-2025-71210/71211
Trend Micro has fixed two critical remote code execution flaws in Apex One, disclosed as CVE-2025-71210 and CVE-2025-71211, each with a CVSS score of 9.8. According to the advisory, a vulnerability in the Trend Micro Apex One management console could allow a…
-
TrendAI (ex Trend Micro) patches Apex One RCE and privilege flaws
TrendAI, the renamed Trend Micro business, announced patches for several critical and high‑severity vulnerabilities in the Windows and macOS versions of the Apex One endpoint security solution. A total of eight issues were addressed, including two critical…
-
-
New UAT 10027 Dohdoor targets US education and healthcare
Cisco Talos has identified a new threat cluster, tracked as UAT-10027, targeting U.S. education and healthcare organisations since at least December 2025 to deploy a previously unseen backdoor named Dohdoor. Initial access likely occurs through phishing,…
Security Affairs -
APT Attacks Exploit Zero Day and Phishing to Persist Inside Firms
An Advanced Persistent Threat (APT) is defined as a prolonged, targeted attack on a specific victim with the aim of compromising their system and gleaning information. According to Malwarebytes, the term originated about a decade ago and was primarily…
Malwarebytes -
NATO approves iPhone and iPad for NATO RESTRICTED data on NIAPC
Apple announced on 26 February 2026 that the iPhone and iPad have been approved by NATO to handle classified information and have been added to the NATO Information Assurance Product Catalogue (NIAPC). The devices are described as the first consumer devices…
SecurityWeek -
Aeternum C2 Botnet Uses Polygon Blockchain to Resist Takedowns
Aeternum C2 is a botnet loader that stores its commands on the public Polygon blockchain to resist takedowns, with researchers noting that commands are written to the blockchain as transactions and later read by infected hosts polling RPC endpoints.…
The Hacker News -
Boards must prioritise resilience as AI enabled cybercrime grows
According to SecurityWeek, the four risks reshaping organizational resilience in 2026 include AI acting as a force multiplier for cybercrime, with concerns not only about attack severity but also frequency and the risk to data integrity as dashboards and…
SecurityWeek -
Threat modelling AI apps evolve as prompts create risk surfaces
Threat modeling AI applications is about proactively identifying, assessing, and addressing risk in AI systems, recognising that we cannot predict every misuse or emergent behaviour but can design to reduce the likelihood and impact of failures or…
Microsoft -
Aeternum hides botnet C2 in Polygon blockchain blocking takedowns
Aeternum Botnet has shifted its command-and-control operations onto the Polygon blockchain, removing the central servers security teams have traditionally targeted. Aeternum C2, uncovered by Qrator Research Lab, uses smart contracts hosted on Polygon;…
Infosecurity -
AirSnitch attacks break Wi‑Fi client isolation and enable MITM
AirSnitch is a series of attacks that capitalises on weaknesses at the lowest levels of the Wi‑Fi stack, capable of breaking client isolation and enabling bidirectional man‑in‑the‑middle attacks across homes, offices and enterprises. The researchers…
Ars Technica -
Talos warns Dohdoor campaign targets US education, healthcare
Cisco Talos has attributed a previously undocumented threat activity cluster to an ongoing campaign targeting U.S. education and healthcare sectors, tracked under the moniker UAT-10027, with a never-before-seen backdoor named Dohdoor as the end goal.…
The Hacker News -
Broken GitHub workflow spammed 70+ npm @types TypeScript releases
On 17 February 2026, StepSecurity AI Package Analyst flagged a sudden flood of version releases across npm’s @types packages, including @types/mapbox__point-geometry and @types/tar. The incident centred on a single automated GitHub workflow,…
StepSecurity -
CISA: CVE-2026-20127 lets attackers gain admin on Cisco SD WAN
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Cisco SD-WAN flaws to its Known Exploited Vulnerabilities catalog, identified as CVE-2022-20775 and CVE-2026-20127. The latter carries a CVSS score of 10.0 and affects the Cisco…
-
Darktrace finds 32 million phishing emails fuel identity attacks
Darktrace says it detected more than 32 million high-confidence phishing emails in 2025, marking a substantial rise in identity-driven cyber threats. According to Darktrace, the data were collected from incidents across its global customer base and point to…
Infosecurity -
Moscow man accused of extorting Conti ransomware by posing as FSB
A Moscow resident has been accused of trying to extort money from the notorious Conti ransomware group by posing as an officer of Russia’s Federal Security Service (FSB), according to RBC. The suspect, Ruslan Satuchin, allegedly presented himself as an FSB…
DataBreaches -
Kali Linux integrates Anthropic Claude AI to speed cyber attacks
ThreatsDay Bulletin notes Kali Linux has integrated Anthropic’s Claude AI assistant via MCP to issue commands in natural language, alongside a broad run of related alerts and 15+ stories. The roundup covers a Belarusian Android spyware campaign, crypto…
-
ICO becomes board run UK regulator with expanded powers
A forthcoming update to the UK General Data Protection Regulation is set to overhaul the governance of the Information Commissioner's Office, moving it from a single-leader corporation sole model to a board-run government agency. According to the…
Infosecurity -
Datadog finds exploitable production flaws in 87% of firms
Eighty-seven percent of organisations have at least one exploitable software vulnerability in production, affecting 40% of all services, according to a new report from DataDog. The State of DevSecOps Report, based on telemetry from tens of thousands of…
Infosecurity -
Anthropic's Claude Code tool bugs let cloned repos hijack PCs
Claude Code Flaws Exposed Developer Devices to Silent Hacking shows that Check Point researchers discovered several vulnerabilities in Anthropic’s Claude Code tool, which could have allowed attackers to silently take control of a developer’s computer. The…
SecurityWeek -
Israeli Gambit nets $61m to map AI resilience against ransomware
The Israeli cybersecurity startup Gambit Security has emerged from stealth with $61 million in combined seed and Series A funding from Cyberstarts, Kleiner Perkins, and Spark Capital, according to SecurityWeek. Tel Aviv-based Gambit has built an AI-powered…
SecurityWeek -
Darktrace warns stolen identities now drive 70% of attacks
The Darktrace Annual Threat Report 2026 highlights a cybersecurity landscape defined by the speed of change, with ecosystems that are increasingly cloud-based, AI-driven, and operationally automated. According to The Darktrace Annual Threat Report 2026,…
-
Zyxel patches critical UPnP RCE flaw in 18 routers and extenders
Zyxel has issued patches for a critical vulnerability across dozens of device models, centred on the UPnP function and capable of remote code execution. The flaw, tracked as CVE-2025-13942 with a CVSS score of 9.8, affects 18 routers, ONTs and wireless…
-
Google disrupts UNC2814 GridTide campaign hiding in Google Sheets
Google and its international partners disrupted a long-running global hacking campaign linked to UNC2814, described by Google Threat Intelligence Group (GTIG) as “prolific” and “elusive.” The operation, active since 2017, targeted governments and…
Infosecurity -
Experts urge organisations to begin post quantum crypto migration
Experts interviewed by The Hacker News urge organisations to prepare for post-quantum cryptography (PQC) now, arguing that data encrypted today must endure future quantum threats. The piece highlights Orange Cyberdefense’s Security Navigator 2026, which…
The Hacker News -
SafePay claims Conduent back office breach, 25 million exposed
The Conduent breach has grown into one of the largest third‑party data incidents in US history, with state notifications pushing the affected total from roughly 10.5 million to more than 25 million people. Texas alone jumped from an early estimate of about 4…
Malwarebytes -
Fake Next.js repos lure developers and run malware in memory
Microsoft warns developers about fake Next[.]js repositories that deliver in‑memory malware, disguised as legitimate projects and assessments to gain persistent access. According to Microsoft Defender Security Research Team, the campaign uses multiple entry…
The Hacker News -
Documents show Instagram knew minors got explicit DMs since 2018
Instagram flagged explicit messages to minors in 2018, with image-blurring only arriving roughly six years later. According to newly unsealed court documents, internal emails showed Meta executives were aware that adults could find and message minors on the…
Malwarebytes -
US sanctions Operation Zero over stolen zero-days used in attacks
According to State Department and OFAC, the US government this week imposed sanctions on seven individuals and entities involved in acquiring and distributing cyber exploits harmful to national security. The designated owner of Russian exploit broker…
SecurityWeek -
Malicious StripeApi.Net NuGet package for .NET stole API keys
Cybersecurity researchers uncovered a malicious NuGet package named StripeApi[.]Net that impersonates Stripe[.]net in a bid to target the financial sector. The package was uploaded by a user called StripePayments on 16 February 2026 and the page closely…
The Hacker News -
Google disrupts suspected China linked UNC2814 using Sheets as C2
Google GTIG disrupted UNC2814, a suspected China-linked APT, halting attacks on 53 organisations across 42 countries. Google Threat Intelligence Group (GTIG) and its partners terminated attacker‑controlled Cloud Projects and accounts, disabled GRIDTIDE…
Security Affairs -
DShield honeypot and SIEM trace libredtail HTTP botnet scans
Over the past several months, the author has gained practical insight into deploying and operating a honeypot, noting that varying hardware, software, and network design can significantly alter outcomes. The DShield honeypot is described as a sensor that…
SANS ISC -
ISC Stormcast flags Orlando app security course, 29 Mar to 3 Apr
ISC Stormcast for Thursday, 26 February 2026 charts the day’s notes and links, including a podcast detail at 9826. The entry lists a forthcoming class titled Application Security: Securing Web Apps, APIs, and Microservices. It notes the venue as Orlando,…
SANS ISC
