News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 27 Feb· 42 articles
-
France health data breach hits 15M patients via Cegedim Sante
According to AFP, France’s health ministry said on Friday that administrative details and medical notes for more than 15 million people were hacked, with the incident dating to late 2025 and affecting information from about 1,500 medical practices that used…
DataBreaches -
Ex Nuance worker pleads guilty in insider Geisinger breach 1.2M
A former Nuance employee has admitted breaching Geisinger Health System patient records in 2023 and removing protected information—including names, dates of birth and addresses—affecting 1.2 million people. Max Vance, 46, of El Cajon, pleaded guilty in the…
DataBreaches -
Trump orders agencies to drop Anthropic AI after Pentagon clash
According to Associated Press, President Donald Trump said on 27 February 2026 that he was ordering all federal agencies to phase out use of Anthropic technology after a public dispute with the Pentagon over AI safety. The piece notes that the Pentagon had…
SecurityWeek -
Ransomware Strikes UMMC as Epic EMR Outage Echoes TV Episode
Life Mirrors Art: Ransomware Hits Hospitals on TV & IRL chronicles how a Mississippi incident and a TV subplot collided to sharpen the public focus on hospital cyber disruptions. On 19 February 2026, an episode of The Pitt aired that depicted a cyberattack…
Dark Reading -
World Cup 2026: RF jamming, hijacked links and drone risks
Cities hosting major events like the FIFA World Cup need to focus beyond traditional security to active and passive wireless threats, say experts. Wireless communications are critical to security systems, OT, and connectivity, and drones have become a…
Dark Reading -
World Cup 2026 Faces Drone and Wireless Surveillance Risks
With the FIFA World Cup arriving in 2026, cybersecurity experts warn that risks from drones and wireless surveillance will accompany the event, not just traditional physical and cyber security concerns. Wireless communications have grown in importance and…
Dark Reading -
Decentralised botnet Aeternum uses Polygon smart contracts for C2
Aeternum is a botnet that hides its command-and-control instructions in smart contracts on the Polygon blockchain, according to Qrator Labs. By decentralising its C2, the malware aims to be harder to detect and disrupt, avoiding traditional server-based…
Security Affairs -
DOJ Seizes $61M in Tether Linked to Pig Butchering Scams
According to The U.S. Department of Justice (DoJ), the seizure involved $61 million worth of Tether linked to pig butchering crypto scams, with the confiscated funds traced to cryptocurrency addresses used to launder criminally derived proceeds from…
The Hacker News -
Sangoma FreePBX2 articles this day · SecurityWeek first
CVE-2025-64328 fuels 900 FreePBX infections via EncystPHP · 900 FreePBX servers hit after CVE-2025-64328 postauth shell
-
CVE-2025-64328 fuels 900 FreePBX infections via EncystPHP
Over 900 Sangoma FreePBX instances remain infected with web shells in ongoing attacks that began exploiting a command injection vulnerability in December 2025, according to The Shadowserver Foundation. Of these, 401 are in the United States, 51 in Brazil, 43…
-
900 FreePBX servers hit after CVE-2025-64328 postauth shell
Approximately 900 Sangoma FreePBX instances remain infected with web shells in attacks that exploited a post-authentication command injection vulnerability starting December 2025. The exploited bug, tracked as CVE-2025-64328 (CVSS 8.6) and patched in…
-
-
RSAC session urges breach transparency to cut risk
Cybersecurity experts are urging a cultural shift toward greater breach transparency, arguing that organisations should disclose how and why incidents occur to drive real risk reduction, according to Dark Reading. At RSAC Conference, a session titled “A…
Dark Reading -
Go module impersonation steals passwords and gains SSH access
Security researchers disclosed a malicious Go module, github[.]com/xinfeisoft/crypto, that impersonates the legitimate golang[.]org/x/crypto codebase to harvest passwords and establish persistent access via an SSH backdoor named Rekoobe. The module injects…
The Hacker News -
Predator spyware on iOS bypasses indicators via kernel hook
In Other News: ATT&CK Advisory Council, Russian Cyberattacks Aid Missile Strikes, Predator Bypasses iOS Indicators reports on several notable developments. The piece notes Predator spyware can bypass Apple’s iOS recording indicators by installing a single…
SecurityWeek -
Mnemonic leak at Korea's tax service sparks $4.8M crypto theft
A security blunder at South Korea’s National Tax Service led to the theft of $4.8 million in cryptocurrency after a press release photo showed the mnemonic phrase for a seized wallet. The phrase, described as the master password for virtual assets, enabled…
DataBreaches -
APT37 hits airgapped networks via USB in Ruby Jumper campaign
APT37, a North Korea-linked cyber espionage group, has been observed deploying a new campaign to breach air-gapped networks using removable media infection tools. The Ruby Jumper operation, dubbed by researchers, utilises six malicious tools across the…
Infosecurity -
Claude Code Security under fire as three critical flaws surface
Claude Code Security made a big splash when it was introduced, but researchers say its impact may be overstated for now. Anthropic unveiled Claude Code Security on Feb. 20, built into the web version of Claude Code, and the tool is available in research…
Dark Reading -
ManoMano hit by data breach via Zendesk portal used by Indra
38 million people were allegedly impacted by a data breach at ManoMano after hackers compromised a customer service portal, with the incident occurring in January and disclosed on 27 February 2026, according to SecurityWeek. The breach involved a customer…
SecurityWeek -
Anthropic's Claude Code Security Spots Architecture Flaws in Code
Claude Code Security is a capability built into Claude Code,Anthropic’s agentic coding platform, currently in limited research preview for Enterprise and Team customers. It scans source codebases for vulnerabilities and proposes targeted patches for human…
SOCRadar -
ScarCruft Ruby Jumper uses Zoho C2 to hit air-gapped targets
ScarCruft, the North Korean threat actor, has been attributed with a fresh Ruby Jumper campaign that deploys a backdoor using Zoho WorkDrive for command-and-control communications to fetch additional payloads, marking the first time the group has abused the…
The Hacker News -
Chilean man extradited to US over Telegram card data trafficking
A 24-year-old Chilean national has been extradited to the US over his alleged role in running a cybercrime operation that trafficked payment card data. The suspect, Alex Rodrigo Valenzuela Monje, allegedly known online as VAL4K, was arraigned in Utah federal…
SecurityWeek -
Anthropic Defies Pentagon Over AI Safeguards Friday Deadline
Anthropic has refused to bend to the Pentagon on AI safeguards, with a public feud unfolding as officials push for Friday’s deadline. According to Associated Press, Anthropic seeks narrow assurances that Claude will not be used for mass surveillance of…
SecurityWeek -
Public Google API keys in code can grant Gemini AI access
Public Google API keys that were once considered safe to publish can now function as real Gemini AI credentials, meaning any key found in public JavaScript or application code may let attackers connect to Gemini, access data, or run up someone else’s cloud…
Malwarebytes -
NATO approves Indigo iPhone and iPad for RESTRICTED data
Apple’s iPhone and iPad have been listed as NATO-approved for handling classified information, becoming the first consumer devices cleared for NATO’s RESTRICTED classification and are now shown in the NATO Information Assurance Product Catalogue. According…
Security Affairs -
FedEx phishing delivers DonutLoader style backdoor via PowerShell
A Fedex-themed phishing email delivered by the attacker includes an attached archive named "fedex_shipping_document.7z" with the SHA256 hash a02d54db4ecd6a02f886b522ee78221406aa9a50b92d30b06efb86b9a15781f5. The archive contains a Windows script (.bat file)…
SANS ISC -
Spanish prompts enable Claude to hack Mexican government data
The DataBreaches[.]Net post, published on 27 February 2026, reports that a hacker exploited Anthropic PBC’s artificial intelligence chatbot Claude to attack Mexican government networks. According to Gambit Security, the unknown Claude user wrote…
DataBreaches -
Court of Appeal Expands Data Security Duty to All Personal Data
On 19 February 2026, the UK Court of Appeal handed down its decision in DSG Retail Limited v The Information Commissioner, ruling that a controller’s data security duty applies to all personal data for which it acts as controller, irrespective of whether the…
DataBreaches -
Dutch prison agency breach exposes staff emails for five months
According to Dutch News, hackers had access to data from the Dutch prisons agency DJI for at least five months. The incident saw cyber criminals able to view e-mail addresses, phone numbers and security certificates of DJI staff, a detail Argos said could…
DataBreaches -
Aeternum Botnet Uses Polygon Blockchain for Onchain C2
According to SecurityWeek, Aeternum Botnet Loader, also known as Aeternum C2, relies on the Polygon blockchain for command-and-control, boosting resilience against takedowns by operating on smart contracts. The malware was first spotted in December 2025…
SecurityWeek -
Initial Access Brokers (IABs) Fuel US Dark Web Market Growth
The article outlines how the Dark Web operates as a structured marketplace that informs what threats US firms face, with SOCRadar’s US Threat Landscape Report 2026 – based on data from January 2025 to January 2026 – noting that 88.3% of posts referencing US…
SOCRadar -
UK cuts DNS vulnerability backlog 75% as fixes speed up 87%
The UK government has claimed it has reduced its backlog of critical vulnerabilities by 75% and reduced cyber-attack fix times by 87%, according to the official statement published on 26 February. Serious security weaknesses in public sector websites are…
Infosecurity -
Juniper Networks Junos OS Evolved2 articles this day · SecurityWeek first
Juniper CVE-2026-21902 targets PTX routers with RCE flaw · Juniper fixes CVE-2026-21902 RCE in Junos OS Evolved
-
Juniper CVE-2026-21902 targets PTX routers with RCE flaw
Juniper Networks issued an out-of-band security update for Junos OS Evolved to fix CVE-2026-21902, a critical remote code execution vulnerability affecting PTX routers, with a CVSS score of 9.3. The flaw lies in the On-Box Anomaly Detection framework, which…
-
Juniper fixes CVE-2026-21902 RCE in Junos OS Evolved
Juniper Networks released an out-of-band update for its Junos OS Evolved to patch a critical remote code execution vulnerability tracked as CVE-2026-21902 that affects PTX series high-performance routers. The issue concerns the On-Box Anomaly detection…
-
-
Fake Google security check spawns PWA based browser RAT and APK
A Malwarebytes piece details a fake Google security check that escalates into a browser-based RAT, distributed as a Progressive Web App and designed to harvest broad data without installing a traditional app. In the four-step flow, victims are guided to…
Malwarebytes -
Europol halts The Com network behind ransomware and extortion
A global law enforcement operation co-ordinated by Europol dubbed ‘Project Compass’ has taken action against ‘The Com’, a notorious online collective responsible for high-profile cyber-attacks and various forms of extortion and exploitation. The group, made…
Infosecurity -
Trojanised gaming tools spread RAT using PowerShell and LOLBins
Threat actors are luring users into running trojanized gaming utilities distributed via browsers and chat platforms to spread a Java-based remote access trojan (RAT). The campaign employs a downloader that stages a portable Java runtime and executes a…
The Hacker News -
North Korea linked Andariel shifts to espionage and ransomware
Andariel is described as a North Korea–linked threat group operating under the Reconnaissance General Bureau (RGB), widely viewed by security researchers as a sub-cluster of the Lazarus Group. Since around 2009, it has shifted from regional disruption…
SOCRadar -
AI speeds incident response and generates reports in minutes
AI accelerates incident response by correlating alerts and generating reports in minutes, helping teams scale beyond manual limits, writes Pierluigi Paganini on 27 February 2026. According to Prophet Security, a leading provider of AI SOC solutions, a…
Security Affairs -
Public .env files expose API keys, US leads with 2.8M exposed
Researchers at Mysterium VPN identified 12,088,677 IP addresses serving publicly accessible .env-style files, exposing credentials and tokens such as API keys, database passwords, and JWT signing keys. According to Mysterium VPN, the United States leads the…
Security Affairs -
Meta sues scam advertisers in Brazil China Vietnam over cloaking
Meta has filed lawsuits against deceptive advertisers based in Brazil, China and Vietnam as part of its effort to curb celeb-bait scams on its platforms, according to about.fb[.]com/news/2026/02/meta-takes-legal-action-against-scam-advertisers/. As part of…
The Hacker News -
ManoMano data breach hits 38M customers via third party service
ManoMano disclosed a data breach affecting 38 million customers, linked to a third-party service provider. According to BleepingComputer, the incident involved unauthorized access in January 2026 that led to the extraction of personal data associated with…
Security Affairs
