News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Mon 2 Mar· 47 articles
-
OpenClaw flaw lets malicious site hijack agent CVE-2026-25253
A newly disclosed vulnerability in OpenClaw, the open source AI agent that has seen meteoric adoption among developers, is now patched and underscoring the security risks of deploying AI agents without adequate controls, according to Dark Reading. The flaw…
-
Evoke Wellness Breach Discrepancies Grow Amid Insider Theft Probe
Evoke Wellness at Hilliard is in the spotlight again after external counsel for OCAT, LLC dba Evoke submitted a breach notification to the Maine Attorney General’s Office, claiming the incident was discovered on 7 August 2025 and potentially affected 261…
DataBreaches -
NCSC flags Iran linked DDoS and phishing threats as tensions rise
The UK’s National Cyber Security Centre (NCSC) has warned organisations of a potential uptick in Iranian cyber threats amid rising Middle East tensions, with the advisory aimed at companies that operate in or have supply chains in the region. According to…
Security Affairs -
Insight Hospital Breach Exposes 900k Files in Dark Web Dump
According to Insight Hospital and Medical Center, an unauthorized individual accessed its network between 22 August 2025 and 11 September 2025, with a substitute notice issued on 26 January 2026 after the hospital learned of unusual activity in September…
DataBreaches -
Europol busts The Com network after 30 arrests in Project Compass
The Com arrest operation, Project Compass, began in January 2025 and has culminated in 30 arrests of alleged members, according to Europol. Europol notes that 179 members have been fully or partially identified by investigators, with 62 victims identified…
Dark Reading -
Denmark School District hit by INC Ransom ransomware
A Wisconsin K-12 district, the Denmark School District in the Village of Denmark, experienced a weeklong outage described as a cyber incident, with five school days of no internet access forcing teachers and students to use paper-based workarounds, according…
DataBreaches -
Project Compass delivers first year wins against The Com network
According to Europol, in its first year of operation Project Compass has delivered concrete operational results against “The Com”, a decentralised extremist network targeting minors and vulnerable individuals both online and offline. Since January 2025,…
DataBreaches -
Silent OAuth Redirects Target Public Sector in Phishing Campaign
Microsoft Security Watch details how OAuth redirection abuse can enable phishing and malware delivery by abusing the by-design redirect mechanism in OAuth flows, often targeting government and public-sector organisations. According to Microsoft Defender…
Microsoft -
DHS breach claimed by Department of Peace group as contracts leak
Hacktivists calling themselves “Department of Peace” claimed they hacked the Department of Homeland Security and leaked allegedly stolen documents online, according to the article. The purported data released by DDoSecrets relates to contracts between DHS,…
DataBreaches -
Doppelgänger RRN Impersonation Hub Targets Western Media at Scale
According to DomainTools Investigations, the Doppelgänger / RRN disinformation ecosystem represents a coordinated, infrastructure-led operation that mirrors legitimate journalism through high‑fidelity impersonation, branding a central RRN hub with…
dti.domaintools.com -
Google Chrome4 articles this day · Dark Reading first
Chrome CVE-2026-0628 enables WebView abuse to access camera, mic · Chrome CVE-2026-0628 lets extensions hijack Gemini Live AI
-
Chrome CVE-2026-0628 enables WebView abuse to access camera, mic
Cybersecurity researchers disclosed a now-patched Chrome flaw, CVE-2026-0628 (CVSS 8.8), described as insufficient policy enforcement in the WebView tag that could let attackers leverage a malicious extension to inject scripts into a privileged page. The…
-
Chrome CVE-2026-0628 lets extensions hijack Gemini Live AI
A vulnerability in Chrome could have allowed malicious extensions to hijack the browser’s Gemini Live AI assistant, potentially enabling spying on users and exfiltration of data, according to Palo Alto Networks. The issue, tracked as CVE-2026-0628, was…
-
Chrome Gemini CVE-2026-0628 lets extensions hijack the panel
Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel reports a high-severity flaw in Google's Gemini feature for Chrome, allowing malicious extensions with basic permissions to hijack the Gemini Live in Chrome panel.…
-
Google patches CVE-2026-0628 in Chrome Gemini AI panel
A high-severity flaw in Google's Gemini AI integration within the Chrome browser could have allowed malicious extensions with basic permissions to escalate privileges, capture the victim’s camera and microphone without consent, take screenshots, and access…
-
-
Google Readies Merkle Tree Certificates for Post Quantum TLS
According to the Chrome Secure Web and Networking Team, Google is developing an evolution of HTTPS certificates based on Merkle Tree Certificates (MTCs) to help secure the web against future quantum risks, while avoiding traditional X.509 certificates in the…
The Hacker News -
Chrome tests Merkle Tree Certificates to future proof TLS
Chrome has unveiled a plan to shield HTTPS connections from the future threat of quantum computers by redesigning how certificates work, focusing on Merkle Tree Certificates (MTCs) rather than enlarging existing X.509 root store certificates. According to…
Infosecurity -
Iran to widen cyber attacks after air strikes, says Google GTIG
According to Google Threat Intelligence Group (GTIG), John Hultquist warned that Iran will “absolutely” respond to the US and Israeli air strikes with cyber-attacks against a wide range of targets in the Middle East and beyond, following the escalation of…
Infosecurity -
Samsung ends ACR data collection without consent after Texas suit
Samsung has settled a lawsuit with the Texas Attorney General over how its smart TVs collect and monetise viewing data using Automated Content Recognition (ACR), agreeing to stop collecting ACR data from Texans without explicit, informed consent and to…
Malwarebytes -
Iran retaliates after cyber campaign, HydraC2 botnet DDoS hits
A sharp escalation in the Middle East has entered a hybrid phase blending military strikes with large-scale cyber operations, creating spillover risks for organisations in the region and globally, according to Infosecurity Magazine. The developments followed…
Infosecurity -
Microsoft Windows2 articles this day · The Hacker News first
APT28 exploits MSHTML CVE-2026-21513 to run code via LNK · MSHTML CVE-2026-21513 exploited by APT28; patch issued
-
APT28 exploits MSHTML CVE-2026-21513 to run code via LNK
Russia-linked APT28 reportedly exploited the MSHTML zero-day CVE-2026-21513 before Microsoft patched it, a high-severity flaw that was addressed in February 2026. According to Akamai, the vulnerability, an Internet Explorer security control bypass that can…
-
MSHTML CVE-2026-21513 exploited by APT28; patch issued
APT28 has been tied to CVE-2026-21513, a high-severity MSHTML vulnerability that bypasses security features and was patched during February 2026 Patch Tuesday. According to Microsoft, the flaw allows an unauthorised attacker to bypass a security feature over…
-
-
OpenClaw flaw lets sites bruteforce login via loopback WebSocket
SecurityWeek reports that a vulnerability in the OpenClaw AI assistant could allow malicious websites to hijack AI agents by luring victims to exploit a locally bound gateway. The flaw arose because the OpenClaw gateway runs a local WebSocket server on…
SecurityWeek -
Trojanized FileZilla 3.69.5 uses DLL hijacking to steal FTP creds
A trojanized copy of the open-source FTP client FileZilla 3.69.5 is circulating online, with the archive containing the legitimate application but a single malicious DLL added to the folder. When downloaded, extracted, and launched, Windows loads the…
Malwarebytes -
MSG confirms data breach tied to Cl0p zero day Oracle EBS
Madison Square Garden has confirmed being impacted by a data breach stemming from a cybercrime campaign targeting Oracle’s E-Business Suite (EBS) customers, with the Cl0p ransomware and extortion group named by the hackers as the perpetrators in November…
SecurityWeek -
OpenClaw ClawJacked Allows Token Theft in Browser Cloud IDEs
OpenClaw’s ClawJacked vulnerability affects certain browser-based cloud development environments and stems from how authentication tokens are stored and accessed during active sessions. Identified and disclosed by researchers at Oasis Security, the flaw…
SOCRadar -
Cisco SD WAN CVE-2026-20127 flaw bypasses auth for admin
The weekly recap highlights several high‑impact issues, including a Cisco SD‑WAN zero‑day that has been exploited since 2023 for admin access, tracked as CVE‑2026‑20127 with a CVSS score of 10.0. According to Cisco, exploitation is part of post‑compromise…
-
Shutdown Threatens DHS Incident Reporting Rule, Delays Compliance
A partial government shutdown threatens to derail a key federal cybersecurity agency’s incident reporting rule and delay answers that companies need to comply with, according to DataBreaches[.]Net. The Department of Homeland Security shutdown may push back…
DataBreaches -
Nick Andersen named acting CISA chief amid leadership shakeup
Nick Andersen has been appointed acting director of the United States’ Cybersecurity and Infrastructure Security Agency (CISA), according to SecurityWeek. Andersen, who until now served as executive assistant director for cybersecurity at CISA, is replacing…
SecurityWeek -
APT372 articles this day · SecurityWeek first
APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2 · APT37 targets airgapped systems using five tools in Ruby Jumper
2 outlets-
APT37 Ruby Jumper infiltrates airgapped nets via LNK and cloud C2
North Korea-linked APT37, also known as ScarCruft, has been observed in a campaign dubbed Ruby Jumper that leverages Zoho WorkDrive for command and control and a USB-based implant to breach air‑gapped networks. The campaign begins with malicious LNK files…
Security Affairs -
APT37 targets airgapped systems using five tools in Ruby Jumper
A North Korea‑linked threat actor tracked as APT37 has been observed using five new malicious tools in a campaign targeting air‑gapped systems, according to SecurityWeek’s report. The operation, part of a December 2025 campaign named Ruby Jumper, utilised…
SecurityWeek
-
-
CISA publishes POEM framework to bolster insider threat readiness
According to CISA, the agency published guidance on assembling a Multi-Disciplinary Insider Threat Management Team to help critical infrastructure stakeholders, including private sector entities across sectors, implement an insider threat mitigation…
DataBreaches -
AWS launches Security Hub Extended to unify cross domain findings
AWS has launched a new version of its Security Hub, called Security Hub Extended, to reduce cross-domain security tool sprawl by correlating findings across multiple security domains within a single mini-SOC. The update, announced in early 2026, allows…
SecurityWeek -
NCSC urges UK firms to tighten security as Middle East risk grows
The NCSC alerts UK organizations to review their cyber security in light of the ongoing conflict in the Middle East. Although the direct cyber threat from Iran remains stable, indirect threats, especially to those engaged in the region, have increased.…
ncsc.gov.uk -
SafeLine WAF blocks sophisticated bots and zero days behind Nginx
According to The Hacker News, SafeLine is a self-hosted web application firewall (WAF) that sits in front of your app and inspects every HTTP request before it reaches your code. It not only looks for broken packets or known bad IPs, but also watches traffic…
The Hacker News -
Google tests Merkle Tree Certificates for post quantum HTTPS
Google is pursuing quantum-safe HTTPS for Chrome by evolving certificates to Merkle Tree Certificates (MTCs). According to Google, the Chrome Root Store will not immediately accept post-quantum certificates because of potential impacts on TLS performance and…
SecurityWeek -
OpenClaw Flaw Enables Prompt Injection via Local WebSocket
OpenClaw users have been urged to upgrade to the latest version after researchers revealed that an indirect prompt injection attack could give adversaries full remote control. The ClawJacked bug is a high-severity issue in the popular AI assistant platform,…
Infosecurity -
RTF hides embedded ZIPs in OLE objects; URLs found via oledump
The SANS ISC diary explains how ZIP files can be embedded inside an RTF document, using OLE objects that can be analysed with oledump[.]py. It notes that options --storages and -E %CLSID% reveal the abused CLSID, and that the Stream CONTENTS can contain the…
SANS ISC -
Wireshark 4.6.4 fixes three vulnerabilities and 15 bugs
Wireshark has released version 4.6.4, with the update fixing 3 vulnerabilities and 15 bugs. The diary entry was published on 2 March 2026 and notes the release details provided by the SANS Internet Storm Center. According to Didier Stevens, the new release…
SANS ISC -
US, Israel and Iran Cyberwar Escalates as Iran Suffers Blackout
According to SecurityWeek, the US-Israel and Iran cycle of cyber operations has run alongside real‑world hostilities, with reports of wiper malware, DDoS and disruptions to critical infrastructure as each side responds. The conflict escalated on 28 February…
SecurityWeek -
Ransomware Extortion Grows as Victims Soar and Payments Fall
Ransomware actors are extorting bigger payments from a smaller number of victims, as the number of those victims surges but overall revenues fall, according to Chainalysis. The blockchain analytics firm revealed in its analysis that the overall figure…
Infosecurity
