News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 3 Mar· 53 articles
-
Interpol led ransomware takedown in 19 countries nets 574 arrests
Dark Reading Confidential follows Will Thomas, a senior threat researcher with Team Cymru, whose work helped Interpol crack a sprawling African cybercrime syndicate. The episode notes that Operation Sentinel, coordinated by Interpol, spanned 19 countries and…
Dark Reading -
Facebook outage blocks login as Ads Manager and WhatsApp API hit
Facebook is experiencing a global outage, with users worldwide reporting they cannot access their accounts. The outage began around 4:15 PM ET, and affected users attempting to sign in are shown the message: “Account Temporarily Unavailable. Your account is…
Security Affairs -
1,700 Dutch officers warned after improper access to Lisa case
1,700 Dutch police officers will receive a letter in the coming period because they used police systems when there was likely no need to do so. The officers were looking for information about the violent death of 17-year-old Lisa from Abcoude, and the letter…
DataBreaches -
Crypto sector hit by AI enabled social engineering and tooling
The Cybersecurity Reading List for the week of 2 March 2026 surveys a slate of threat intelligence pieces from GTIG, including UNC1069’s targeting of the cryptocurrency sector with new tooling and AI-enabled social engineering, and reflections on…
dti.domaintools.com -
EV-signed malware poses as Teams to push remote access tools
According to Microsoft Defender Security Research Team, in February 2026 a campaign attributed to an unknown threat actor used phishing emails and masqueraded software to deliver signed malware impersonating workplace applications. The malicious executables,…
Microsoft -
TPMS tire sensors can be intercepted to track vehicles and owners
Vehicle Tire Pressure Sensors Enable Silent Tracking reveals that TPMS, designed for safety and maintenance, can be exploited to infer movements and driver patterns. A study by researchers from universities in Spain, Switzerland, and Luxembourg deployed…
Dark Reading -
Qualcomm Multiple Chipsets2 articles this day · SecurityWeek first
Qualcomm graphics CVE-2026-21385 memory flaw targeted Android · Android fixes CVE-2026-21385 after zero day in Qualcomm graphics
-
Qualcomm graphics CVE-2026-21385 memory flaw targeted Android
According to Google’s Android bulletin, the new Qualcomm bug has been exploited in limited and targeted attacks against vulnerable Android devices. CVE-2026-21385 is a high-severity memory corruption flaw in Qualcomm's graphics kernel affecting a wide range…
-
Android fixes CVE-2026-21385 after zero day in Qualcomm graphics
Google has rolled out Android security updates containing patches for nearly 130 vulnerabilities, including an exploited zero-day tracked as CVE-2026-21385 that affects the graphics component of over 200 Qualcomm chipsets and can lead to memory corruption…
-
-
Hooked on Linux Rootkits: Kernel Hooking and Evasion Tactics
Elastic Security Labs’ Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft is the first part of a two‑part series, exploring Linux rootkit taxonomy, evolution and hooking techniques, with part two focusing on detection engineering. The piece…
elastic.co -
Drone strikes hit UAE AWS data centres, Bahrain facility damaged
Two AWS data centres in the United Arab Emirates were described as being “directly struck” and another facility in Bahrain was damaged after a drone landed nearby, highlighting the industry’s vulnerability to physical disasters, according to Associated…
SecurityWeek -
Ariomex breach tied to compromised helpdesk exposes 11k records
Ariomex, an Iran-based crypto exchange, suffered a data leak, with Resecurity (USA) reporting that the breach exposed end-user details, their transactions, and related context from 2022 to 2025. According to Resecurity, the leaked database is circulating on…
Security Affairs -
Gartner: ban AI browsers, but push for controlled enablement
Gartner recently recommended that enterprises ban AI browsers, according to Gartner. The piece notes that the browser has become the fundamental corporate user interface, with more than 85% of the workday now taking place in a browser. LayerX research shows…
Dark Reading -
Fake IT helpdesk lures with Havoc C2 using DLL sideloading
Threat hunters have flagged a new campaign in which actors pose as fake IT support to deliver the Havoc command-and-control (C2) framework as a prelude to data exfiltration or ransomware. The intrusions were identified by Huntress last month across five…
The Hacker News -
RedAlert spyware hijacks Israel's rocket app via fake update
A new mobile espionage campaign, dubbed RedAlert, exploits civilian fears amid the Israel-Iran conflict by trojanising Israel’s official Red Alert rocket warning app and distributing it via SMS phishing, first identified on 3 March 2026. The campaign…
Infosecurity -
Pentagon declares Anthropic a supply chain risk; OpenAI steps in
The Pentagon has cut ties with Anthropic, the maker of Claude AI, designating the San Francisco-based company a “supply-chain risk to national security” and barring any contractor, supplier, or partner doing business with the US military from dealing with…
Malwarebytes -
Fig Security raises $38M to automate SecOps detection pipelines
Fig Security has emerged from stealth and announced a funding round of $38 million across seed and Series A, as it positions itself to bolster SecOps resilience. Founded in March 2025, the company is led by CEO Gal Shafir, with CPO Nir Loya Dahan and CTO Roy…
SecurityWeek -
APT41 Silver Dragon Uses GearDoor Backdoor Through GDrive C2
According to Check Point Research, Silver Dragon is an advanced persistent threat tracked as active across Europe and Southeast Asia since at least mid-2024, with a focus on government entities. The group gains initial access by exploiting public-facing…
Check PointSilver Dragon -
MSG data breach tied to Cl0p's Oracle flaw CVE-2025-61882
Madison Square Garden confirmed a data breach tied to the 2025 Oracle E-Business Suite hacking campaign, part of a wider operation that affected more than 100 organisations. In the campaign, the Cl0p ransomware group exploited zero-day flaws to access data…
-
AI as force multiplier fuels phishing and supply chain attacks
Easy access to large language models (LLMs) and other AI tools has significantly lowered the barrier to entry for cybercriminals to conduct effective cyber-attacks rapidly and at scale, according to the 2026 Cloudflare Threat Report. The report describes AI…
Infosecurity -
Honeywell IQ4 exposed risk as 7500 internet interfaces await CVE
SecurityWeek reports a clash between researcher Gjoko Krstic and Honeywell over the impact of a vulnerability in Honeywell’s IQ4 building management controller. Krstic says he identified nearly 7,500 internet-exposed IQ4 interface instances, with an…
SecurityWeek -
CrushFTP Brute Force Attacks Target Admin Logins from French IP
CrushFTP, a Java-based open source file transfer system available on multiple operating systems, is currently being targeted by brute-force scans rather than exploitation of a specific vulnerability. According to SANS[.]edu, prior notable flaws include…
-
Ariomex Tied to Iran Sanctions Evasion via Large Crypto Flows
A newly obtained database from Iranian cryptocurrency exchange Ariomex suggests the platform may have played a role in sanctions evasion and large-scale capital transfers linked to actors inside the country, according to Infosecurity Magazine. Resecurity…
Infosecurity -
Live threat intel feeds cut dwell time and boost analyst triage
The Hacker News outlines a convincing case for upgrading Tier 1 in the SOC, noting that frontline analysts often have the least experience yet bear the heaviest detection burden. It argues that Tier 1 must be supported by robust monitoring and triage…
The Hacker News -
AI powered CyberStrikeAI targets FortiGate in 55 countries
Open-Source CyberStrikeAI is an AI-native, open-source security testing platform that was reportedly used to drive AI-assisted FortiGate attacks, spanning 55 countries. According to Team Cymru’s analysis, the activity followed an analysis of the IP address…
The Hacker News -
AI Increases Pressure on Cybersecurity Leaders, Seemplicity Finds
US cybersecurity leaders are under increasing pressure to address process gaps and escalating threats, according to Seemplicity. The security vendor polled 300 CISOs and their equivalents to produce its State of the Cybersecurity Workforce Report, published…
Infosecurity -
Cloudflare Edge Native Threat Intel Powers Instant Firewall Rules
Cloudflare’s Threat Intelligence Platform has evolved to be actionable, scalable, and ETL-less, outlined in a 3 March 2026 post that describes a shift from traditional data handling to edge-native threat intelligence. The platform uses a sharded,…
Cloudflare -
CVE-2026-22813 Signals 2026 Shift to High Trust Exploits
According to the 2026 Cloudflare Threat Report, Cloudforce One sees a threat landscape growing in variety and intensity, with AI aiding real-time mapping and deepfake-enabled fraud, and attackers increasingly relying on trusted cloud tooling to blend in with…
-
Coruna iOS exploit kit targets iPhones up to 17.2.1, says Google
The Google Threat Intelligence Group (GTIG) has reported on a new iOS exploit kit named "Coruna" that targets iPhone models running iOS 13.0 to 17.2.1. The kit includes five exploit chains, totaling 23 exploits, some using advanced, non-public techniques.…
Google Cloud -
GTK attack, gateway bounce and MITM bypass WiFi client isolation
Researchers from UC Riverside, together with one from KU Leuven, report that four computer scientists and one additional researcher uncovered weaknesses that can bypass Wi‑Fi client isolation in home, work, airport, and coffee shop networks. Their study,…
SecurityWeek -
Tehran traffic cameras hacked by Israeli spies to track Khamenei
Israeli spies hacked nearly every traffic camera in Tehran for years in order to monitor the movements of Ayatollah Ali Khamenei in an unprecedented intelligence-gathering campaign, according to The Independent. The article notes that officials surveilled…
DataBreaches -
Hawaii Cancer Center ransomware exposes 1.2M records
The personal information of approximately 1.2 million people was compromised in a ransomware attack at the University of Hawaiʻi Cancer Center. The incident occurred on 31 August 2025 and affected servers supporting the centre’s research operations, with no…
SecurityWeek -
Zscaler urges scalable workload identity, mutual TLS at RSAC 2026
AI agent workloads are getting more complex, and securing their authentication across mixed environments is a growing priority for organisations. The article notes that many workloads operate with non-human identities and rely on static credentials or…
Dark Reading -
Data broker breaches cost Americans $20.8B, Congress finds
According to Congress’s Joint Economic Committee, breaches at data brokers have cost American consumers more than $20 billion, with the panel pegging losses at $20.8 billion after four major breaches. The report cites breaches involving Equifax in 2017…
DataBreaches -
LLMs deanonymise burner accounts across platforms, study finds
Pseudonymity on the internet may be less durable than many users realise, with researchers showing that large language models can deanonymise burner accounts at scale. In experiments, recall reached as high as 68 percent and precision up to 90 percent when…
Ars Technica -
Iran Hacktivists Rally After Strikes as State Attacks Quiet
SecurityWeek reports that the Iran cyber front has seen hacktivist activity surge while state-sponsored attacks remain notably quiet, following the US-Israel strikes in late February 2026. The joint operations, named Operation Epic Fury and Operation Roaring…
SecurityWeek -
Chrome Gemini side panel CVE-2026-0628 exposes extension abuse
The Chrome flaw, tracked as CVE-2026-0628, allowed a low-privilege extension to inject code into Gemini’s side panel and inherit its powerful capabilities, including local file access, screenshots, and camera and microphone control. The vulnerability…
-
Phishing via OAuth URL redirection targets government agencies
Microsoft researchers warn that threat actors abuse OAuth URL redirection to target government and public-sector organisations and deliver malware, turning a legitimate by-design feature into an identity-based threat that can bypass email and browser…
Security Affairs -
Iranian backed hackers escalate DDoS and data theft
As war continues, pro-Iranian actors have launched a barrage of cyberattacks in response to the US-Israeli military action, targeting critical infrastructure, data exfiltration and displacement of services to inflict economic and physical disruption,…
Dark Reading -
Governance Gap Exposes Identity Dark Matter in AI Agents
The Hacker News weekend feature argues that Model Context Protocols (MCPs) are enabling a new wave of AI agents that can access apps, data, and workflows across enterprises, turning AI into active, prompt-driven workers rather than mere chatbots. It…
The Hacker News -
Starkiller Phishing Suite Uses AiTM Proxy to Bypass MFA
The article discusses the Starkiller Phishing Suite, which employs an Attack-in-the-Middle (AitM) reverse proxy technique to bypass multi-factor authentication. This method represents a significant security threat, as it enables attackers to gain…
The Hacker News
