News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 4 Mar· 46 articles
-
Cisco FMC CVE-2026-20079 and CVE-2026-20131 grant root access
Cisco has patched two maximum-severity vulnerabilities in its Secure Firewall Management Center (FMC) that could allow attackers to gain root access to managed firewalls. The issues are CVE-2026-20079, a authentication bypass with a CVSS score of 10.0, and…
-
Darktrace FAI links cloud breach to perfctl using CVE-2021-4034
Darktrace’s Forensic Acquisition & Investigation (FAI) is described as an automated cloud-forensic solution that rapidly investigates a compromised cloud server by pulling data from Darktrace’s Cloudypots honeypot network, which observes attacker activity in…
-
Broadcom VMware Aria Operations2 articles this day · Security Affairs first
VMware Aria Operations hit by CVE-2026-22719 RCE exploit · CISA Adds CVE-2026-22719 and CVE-2026-21385 to the Exploited List
-
VMware Aria Operations hit by CVE-2026-22719 RCE exploit
VMware Aria Operations is being exploited via a high‑severity command injection flaw, CVE-2026-22719, described as enabling an unauthenticated attacker to execute arbitrary commands and potentially achieve remote code execution in affected cloud…
-
CISA Adds CVE-2026-22719 and CVE-2026-21385 to the Exploited List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two flaws affecting Qualcomm and Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (KEV) catalog, according to Security Affairs. The newly listed CVEs are…
-
-
Remediation blends automation and orchestration to cut MTTR
Security teams are urged to choose between automation and orchestration to shorten MTTR, with the article arguing that a unified remediation structure combines both approaches to reduce risk. It explains automation as the speedier, high-confidence fix for…
Security Affairs -
Europol shuts LeakBase data forum in global raid with arrests
LeakBase has been seized and arrests made as part of a global action coordinated by Europol, according to Europol. The operation targeted a major online forum for stolen data, specialising in leaked databases and “stealer logs” used to harvest credentials.…
DataBreaches -
Global takedown halts Tycoon 2FA phishing platform that bypassed MFA
Tycoon 2FA was a phishing-as-a-service platform used to send fraudulent emails to over 500,000 organisations every month, enabling impersonation of users and bypassing multi-factor authentication. The operation disrupted tens of millions of phishing emails…
SecurityWeek -
LexisNexis Breach Exfiltrates 2GB via React2Shell AWS Misconfig
According to SecurityWeek, LexisNexis has confirmed a data breach after hackers leaked data allegedly stolen from its systems, with the intruders claiming to have exfiltrated more than 2GB of files and 400,000 personal information records. The intrusion was…
SecurityWeek -
Hacktivist DDoS Wave Strikes 110 Organisations Across 16 Countries
Cybersecurity researchers have reported a surge in hacktivist DDoS activity linked to the Middle East conflict, with 149 hacktivist DDoS claims targeting 110 organisations across 16 countries, according to Radware. The attacks were carried out by 12 groups,…
The Hacker News -
Salt Typhoon targets unpatched gear as telemetry drives defence
Stranger Things meets cybersecurity, as explained in a piece by Nadir Izrael, uses narrative from the show to highlight real-world risks such as ransomware, state-sponsored cyberwarfare, and AI-enabled attacks threatening enterprise networks. The article…
Dark Reading -
Global Coalition on Telecoms unveils 6G security principles
A coalition of seven governments has launched a set of voluntary cybersecurity and cyber resilience principles for 6G, the next generation of mobile networks. The Global Coalition on Telecoms (GCOT) was established in October 2023 to set out a shared…
Infosecurity -
Microsoft and Europol shut down Tycoon2FA PhaaS AiTM MFA bypass
The article discusses the Tycoon2FA phishing-as-a-service platform, which emerged in August 2023 and rapidly spread, leading to millions of phishing messages targeting over 500,000 organizations monthly. Developed by the threat actor Storm-1747, Tycoon2FA…
Microsoft -
Global raid targets Tycoon2FA phishing service that bypassed MFA
Investigators claimed on 4 March 2026 that they had taken out another key player in the global cybercrime supply chain by seizing infrastructure linked to the Tycoon2FA phishing-as-a-service operation. The effort was led by Microsoft and Europol and…
Infosecurity -
Zurich to buy Beazley in £8.1B deal to expand cyberinsurance reach
Zurich has agreed to acquire UK-based Beazley for approximately £8.1 billion ($11 billion), strengthening its position in the cyberinsurance market. The deal awaits final shareholder and regulatory approvals and is expected to complete in the second half of…
SecurityWeek -
Phishing emails spoof LastPass alerts to steal master passwords
LastPass has warned users about a new phishing campaign using fake security alerts that claim unauthorised access or master password changes to steal users’ master passwords. The emails, which spoof LastPass’s display name, are sent from multiple addresses…
Security Affairs -
Intigriti chief hacker says bug bounties steer talent from crime
Inti De Ceukelaire is chief hacking officer at the Intigriti bug bounty platform, where he has been for the last seven years, according to SecurityWeek. He describes being a hacker as something he gradually realised he was, driven more by bending systems to…
SecurityWeek -
Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044
A surge in attempts to compromise internet-connected surveillance cameras across the Middle East has been identified amid ongoing regional tensions, with activity attributed to infrastructure linked to Iranian threat actors, according to Check Point…
-
Cloudflare's Attack Signature Detection flags SQLi threats
Cloudflare’s latest post introduces Attack Signature Detection as the next evolution in managed rules, designed to give full visibility into every signature match without sacrificing protection. When enabled, the detection runs on every request in an “always…
Cloudflare -
Ukrainian HTA dropper uses steganography to deploy MeowMeow
A newly identified malware campaign leveraging a Ukrainian email service to build credibility has been uncovered, with the operation beginning from an email sent from an address hosted on ukr[.]net. According to ClearSky advisory, the recipient is redirected…
Infosecurity -
Cloudflare adds boot time authentication and edge MFA to SASE
Cloudflare has announced two new tools in its SASE toolbox to modernise remote access: mandatory authentication and Cloudflare’s own MFA. The mandatory authentication feature, when enabled via your MDM configuration, makes the Cloudflare One Client the…
Cloudflare -
UK govt rules out VPN ban as online safety drive looms
According to The Guardian, while discussions around a British firewall have captured headlines, there are no current plans on the statute books to ban VPNs for everyone, with ministers and regulators recognising VPNs as lawful tools with legitimate uses. The…
Malwarebytes -
Coruna iOS Exploit Kit uses 23 exploits including CVE-2024-23222
Google Threat Intelligence Group (GTIG) has described Coruna, also known as CryptoWaters, as a powerful iOS exploit kit targeting Apple devices running iOS 13.0 to 17.2.1, with five full exploit chains and a total of 23 exploits. The framework fingerprinted…
-
OAuth error redirects lure users to phishing or malware pages
Attackers are abusing OAuth’s error redirects to push users from legitimate login pages to phishing or malware pages, without completing a sign‑in or stealing tokens from the OAuth flow itself. The technique relies on silent OAuth authentication flows and…
Malwarebytes -
Cracked apps carry infostealers and cryptominers, warns Barracuda
Employees seeking free versions of paid software may unknowingly install malware-laced cracked apps that can steal credentials, deploy cryptominers, or open the door to ransomware, according to Barracuda. The article notes that these apps are often not on a…
SecurityWeek -
JetStream Security raises $34M to govern enterprise AI blueprints
JetStream Security has launched with $34 million raised in an oversubscribed seed round led by Redpoint Ventures, with additional support from CrowdStrike Falcon Fund and angel investors, according to SecurityWeek. The US-based AI governance startup, founded…
SecurityWeek -
CVE-2026-21385 Qualcomm graphics zero day exploited on Android
A high-severity Android vulnerability, tracked as CVE-2026-21385, has been found in a Qualcomm graphics/display component and is already being exploited in limited, targeted attacks, Malwarebytes reports. The flaw resides in an open‑source Qualcomm component…
-
Coruna iPhone exploit kit targets iOS 13 to 17.2.1
According to Google Threat Intelligence Group, a new and powerful exploit kit named Coruna targets Apple iPhone models running iOS 13.0 (released in September 2019) up to 17.2.1 (released in December 2023). The kit contained five full iOS exploit chains and…
DataBreaches -
Phishing campaign uses spoofed LastPass alerts to harvest logins
According to LastPass, a new phishing campaign is targeting users with fake alerts that claim unauthorized access or master password changes. The emails purport to come from LastPass and rely on a spoofed display name, exploiting that many email clients only…
SecurityWeek -
Live Webinar: Designing an OT SOC for Safety and Continuity
SecurityWeek reports on a live Industrial Cybersecurity Webinar that will explore a blueprint for an OT security operations centre designed to safeguard operations and maintain business continuity. The event, titled Webinar Today: Designing an OT SOC for…
SecurityWeek -
Google to roll Chrome updates every two weeks from September 2026
Google on Tuesday announced that new Chrome iterations will be released every two weeks, moving away from the current four‑week release cycle, with the shift taking effect in September 2026. Since 2021 major Chrome versions have shipped every four weeks, and…
SecurityWeek -
Silver Dragon APT Uses Google Drive C2 to Target Governments
According to Check Point, the APT group Silver Dragon, linked to APT41, has been targeting governments in Europe and Southeast Asia since mid-2024, widening its playbook from phishing to Google Drive C2. The campaign gains initial access via exploitation of…
Security Affairs -
New RFP Guide Reframes AI Usage Control to Interaction Level Security
The Hacker News reports a newly released RFP Guide for evaluating AI Usage Control and AI Governance solutions, designed to help security teams move from vague goals to specific, measurable criteria. The guide promotes a shift from cataloguing every app to…
The Hacker News -
Silver Dragon APT uses phishing to hijack Windows services
A Chinese threat group, described as a spinoff of APT41, has been conducting cyber-espionage campaigns against targets in the EU and Southeast Asia, with phishing used to gain initial access before hijacking legitimate system services for C2 and persistence.…
Dark Reading -
GCOT issues 6G security principles as Sweden and Finland join
The Global Coalition on Telecoms (GCOT) has published principles for the security and resilience of 6G networks at Mobile World Congress 2026, with Sweden and Finland announced on the Tuesday as new members and GCOT founded in 2023 by Australia, Canada,…
SecurityWeek -
OpenID warns that digital estate standards gap invites deepfakes
The OpenID Foundation has warned that a lack of standardisation in how governments and tech firms handle the digital accounts of the deceased could invite fraud and exploitation. According to OpenID Foundation, its report, The Unfinished Digital Estate,…
Infosecurity -
Kaspersky: 2025 Mobile Threats Adware Keenadu Backdoor
According to Kaspersky Security Network, in 2025 over 14 million attacks involving malware, adware or unwanted mobile software were blocked, with adware accounting for 62% of detections. The year also saw more than 815 thousand malicious installation…
securelist.com -
XWorm V6.4 uses Process Hollowing to inject into .NET compiler
A new XWorm wave is described as multi-technology malware, continuing to spread despite the family not being new. The diary notes the Javascript is obfuscated and will drop a PowerShell script in the temporary directory…
SANS ISC -
Laravel Packages Deliver Cross Platform RAT via Packagist
Cybersecurity researchers have flagged malicious Packagist PHP packages masquerading as Laravel utilities that act as a conduit for a cross-platform remote access trojan (RAT) usable on Windows, macOS and Linux. The packages cited are nhattuanbl/lara-helper…
The Hacker News -
FreeScout CVE-2026-28289 enables unauth RCE via TOCTOU bypass
A critical vulnerability in the open source FreeScout help desk and shared mailbox solution can allow zero-click remote code execution, according to Ox Security. Tracked as CVE-2026-28289 (CVSS 10/10), the flaw is a patch bypass for CVE-2026-27636, a…
-
Dark Web posts flag data leaks from Eholo OptimizerAI PlayStation
SOCRadar’s Dark Web Team identified multiple new underground posts this week alleging data leaks and sales involving Eholo, OptimizerAI, PlayStation, Florajet, Coinbase and a MalFactory stealer builder. According to SOCRadar Dark Web Team, the Eholo post…
SOCRadar
