News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 5 Mar· 51 articles
-
DevSecOps Study Finds 87% Exploitable in CI/CD Pipelines
According to Datadog's State of DevSecOps 2026 report, CI/CD pipelines and GitHub Actions remain prime targets for supply chain attacks, a warning StepSecurity has long sounded. The findings show that 87% of organisations have at least one exploitable…
StepSecurity -
Windows DWM Use After Free Enables Privilege Escalation to SYSTEM
Elastic Security Labs detail a Use-After-Free vulnerability in Windows Desktop Window Manager (DWM) that enables reliable local privilege escalation from a low-privilege user to SYSTEM, demonstrated through a working exploit and a patch discussion. The flaw…
elastic.co -
APT36 scales AI driven malware line to hit Indian entities
Nation-State Actor Embraces AI Malware Assembly Line. Pakistan's APT36 threat group has begun using vibe-coding to churn out malware at scale, blending AI tools with multiple programming languages. Bitdefender dubbed the tactic “Distributed Denial of…
Dark Reading -
CISA flags Apple iOS kernel exploit CVE-2023-41974 in KEV list
CISA has added CVE-2023-41974 to the Known Exploited Vulnerabilities (KEV) catalogue, affecting Apple iOS and iPadOS. Apple iOS and iPadOS Use-After-Free Vulnerability could allow an app to execute arbitrary code with kernel privileges. Technical detail: The…
-
Lotus Blossom supply chain attack hits Notepad++ updates
DomainTools Investigations’ March 2026 update shines a spotlight on two major threat themes: the weaponisation of trust in supply chains and high-velocity fraud. In a Hot off the Presses piece, DTI researchers detail the Lotus Blossom (G0030) operation,…
dti.domaintools.com -
CVE-2021-30952: Apple Integer Overflow Could Allow Code Execution
CISA has added CVE-2021-30952 to the Known Exploited Vulnerabilities (KEV) catalogue, affecting Apple across multiple products (tvOS, macOS, Safari, iPadOS and watchOS) with an integer overflow or wraparound vulnerability in the processing of malicious web…
-
CVE-2023-43000 Use-After-Free flaw hits Apple Safari on macOS iOS
CISA has added CVE-2023-43000 to the Known Exploited Vulnerabilities (KEV) catalogue, affecting Apple and its Multiple Products; the vulnerability is named Apple Multiple products Use-After-Free Vulnerability and is described as a memory corruption risk in…
-
Tycoon 2FA phishing service disrupted after MITM MFA token theft
Europol and several private sector partners, including Microsoft, Trend Micro, and Cloudflare, disrupted the Tycoon 2FA phishing-as-a-service platform this week in an international operation. Microsoft seized 330 domains that composed the platform’s user…
Dark Reading -
Rockwell CVE-2021-22681 risks unauthorised Logix access
CISA has added CVE-2021-22681 to its Known Exploited Vulnerabilities (KEV) catalogue. The affected vendor is Rockwell, and the product is listed as Multiple Products. The vulnerability is Rockwell Multiple Products Insufficient Protected Credentials…
-
KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk
CISA has added CVE-2017-7921 to its Known Exploited Vulnerabilities (KEV) catalogue, affecting Hikvision and multiple Hikvision products. The vulnerability is titled Hikvision Multiple Products Improper Authentication Vulnerability and could allow a…
-
Cisco flags 48 firewall flaws; two CVEs enable FMC auth bypass
Cisco disclosed 48 vulnerabilities across its firewall ecosystem, with two regarded as the most critical. The issues affect Adaptive Security Appliance (ASA), Secure FTD, and Secure Firewall Management Center (FMC), and Cisco says all 48 have fixes and urges…
-
Phobos ransomware operator pleads guilty to U.S. wire fraud
Russian national Evgenii Ptitsyn, 43, pleaded guilty in the United States to wire fraud conspiracy for his role in the Phobos ransomware operation, and faces a maximum penalty of 20 years in prison with sentencing set for July 15. According to the DoJ, the…
Security Affairs -
CVE-2026-22719 Unauthenticated command injection risks RCE in VMware Aria Operations
CISA has added CVE-2026-22719 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects Broadcom’s VMware Aria Operations (formerly vRealize Operations, vROps). It is named Broadcom VMware Aria Operations Command Injection…
-
Qualcomm Chipset CVE-2026-21385 Corruption Sparks Ransomware Risk
CISA has added CVE-2026-21385 to the Known Exploited Vulnerabilities (KEV) catalogue, affecting Qualcomm and its multiple chipsets. The vulnerability is named Qualcomm Multiple Chipsets Memory Corruption Vulnerability and is described as a memory corruption…
-
Microsoft spotlights women in cybersecurity to drive AI security
Women’s History Month, celebrated on 5 March 2026 and in the lead‑up to International Women’s Day on 8 March 2026, is used by Microsoft Security to reflect on progress and to champion those shaping the future of cybersecurity.
Microsoft -
Security in the SDLC to curb insider threats and hiring gaps
Software development practices are highlighted as a way for enterprises to tackle real-life risks by embedding security from the start of projects. The article spotlights the Software Development Life Cycle (SDLC) as a framework that can be applied beyond…
Dark Reading -
Chrome extensions impersonating AI tools exfiltrate chat data
Microsoft Defender Security Research Team has found malicious Chromium-based browser extensions that impersonate legitimate AI assistant tools to harvest LLM chat histories and browsing data, with reporting noting approximately 900,000 installs and activity…
Microsoft -
Insider risk rises as AI fuels phishing and data exfiltration
The Infosecurity Magazine report from 5 March 2026 notes that insider threats are rising, with businesses increasingly worried about the cybersecurity implications of malicious or negligent employees. According to Mimecast’s State of Human Risk Report 2026,…
Infosecurity -
Cisco warns CVE-2026-20122 and CVE-2026-20128 exploited in SD-WAN
Cisco has disclosed that two Catalyst SD-WAN Manager vulnerabilities are under active exploitation in the wild. The flaws are CVE-2026-20122, an arbitrary file overwrite issue with a CVSS of 7.1, and CVE-2026-20128, an information-disclosure flaw with a CVSS…
-
2025 zero-days: PRC-nexus groups target enterprise appliances
Google: Half of 2025’s 90 exploited zero-days were aimed at enterprises, with 43 of the total affecting enterprise technologies, marking an all-time high. In 2025, Microsoft accounted for 25 of the zero-days, followed by Google with 11, Apple with eight, and…
SecurityWeek -
Phishing delivers BadPaw loader and MeowMeow backdoor; APT28 link
Researchers have uncovered a Russian campaign targeting Ukrainian entities with two new malware families, BadPaw and MeowMeow, delivered through phishing emails that link to a ZIP archive. When opened, an HTA file displays a Ukrainian-language lure about…
Security Affairs -
LatAm Faces Double US Attacks as Ransomware and Infostealers Surge
LatAm now faces twice as many cyberattacks as the US, according to Check Point’s unpublished March 2026 threat report shared with Dark Reading, which shows Latin American organisations currently facing about 3,100 cyber threats per week, compared with just…
Dark Reading -
ContextCrush flaw in Context7 MCP Server enables poisoned AI rules
A significant vulnerability known as ContextCrush has been discovered in the Context7 MCP Server, which aids in delivering documentation to AI coding assistants. This flaw allows attackers to inject harmful instructions into AI tools via trusted…
Infosecurity -
Cloudflare rolls out Path MTU Discovery to stabilise sessions
Cloudflare’s Dynamic Path MTU Discovery for the One Client shifts from a passive observer to an active participant in path discovery to tackle the PMTUD Black Hole problem. The approach probes MTUs by sending encrypted packets of varying sizes to the…
Cloudflare -
Zero days in the wild hit enterprise devices as AI aids attackers
In 2025, the Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in the wild, marking a decrease from 2023's record of 100 but an increase from 2024's 78. Nearly half (48%) of these vulnerabilities targeted enterprise…
Google Cloud -
DDR5 botnet hits DRAM pages 6.5s stock checks; Reddit faces ICO
The ThreatsDay Bulletin this week highlights a large-scale DDR5 bot operation that submitted more than 10 million web scraping requests to DRAM product pages, rapidly checking stock every 6.5 seconds with cache-busting parameters to beat detection and push…
The Hacker News -
OSINT toolkit tracks Iran Israel conflict as DDoS signals emerge
The SOCRadar blog piece tracks the U.S.-Israel-Iran war through an OSINT toolkit, launched with the claim that open-source intelligence enables researchers to observe real-time signals without classified access. It highlights a multi-tool stack, including…
SOCRadar -
Webinar: Guard Against Harvest Now with Hybrid Cryptography
Security leaders are being invited to an upcoming webinar on Post-Quantum Cryptography best practices, as organisations confront the risk of harvest now, decrypt later where data encrypted today could be read in future decades. The piece notes that attackers…
The Hacker News -
Russian Ptitsyn pleads guilty to Phobos ransomware scheme
According to the US Justice Department, Evgenii Ptitsyn, a 43-year-old Russian national, has pleaded guilty in a US court to wire fraud conspiracy connected to the Phobos ransomware operation. Ptitsyn was arrested in South Korea in June 2024 and extradited…
SecurityWeek -
Catalyst SD WAN flaws CVE-2026-20128 exploited, Cisco warns
Cisco warns that two recently patched Catalyst SD-WAN vulnerabilities are being exploited in the wild, with patches already available for five Catalyst SD-WAN flaws. According to Cisco, CVE-2026-20128 is an information-disclosure issue in the Data Collection…
-
New iOS exploit kit Coruna targets iPhone 13 to 17.2.1 wallets
A sophisticated exploit kit capable of compromising Apple iPhones running iOS versions 13.0 through 17.2.1 has been uncovered by cybersecurity researchers, according to GTIG. The toolkit, internally named Coruna, includes five full exploit chains and 23…
Infosecurity -
Iran-nexus Dust Specter hits Iraqi govt with two infection chains
A campaign attributed to a suspected Iran-nexus threat actor, named Dust Specter by Zscaler ThreatLabz, targeted Iraqi government officials by impersonating Iraq’s Ministry of Foreign Affairs and deploying a set of new malware two infection chains. The…
The Hacker News -
Delta CNCSoft G2 CVE-2026-3094 could enable remote code execution
According to CISA, successful exploitation of the vulnerability could allow an attacker to achieve remote code execution on the Delta Electronics CNCSoft-G2 device. The affected product is Delta Electronics CNCSoft-G2, with versions prior to V2.1.0.39…
-
ISC Maintains Green Threat Level as Orlando Web Apps Course Looms
According to Internet Storm Center, the ISC Stormcast for Thursday, 5 March 2026 notes a threat level of green and is presented by handler on duty Guy Bruneau. The diary entry highlights the next class: Application Security: Securing Web Apps, APIs, and…
SANS ISC -
Reclaim Security raises $20M Series A to speed safe remediations
Reclaim Security has announced a $20 million Series A funding round, taking its total funding to $26 million, according to SecurityWeek. The investment was led by Acrew Capital, with additional support from QP Ventures and Ibex Investors, and comes as the…
SecurityWeek -
Malwarebytes adds Windows File Shredder to permanently erase data
Windows File Shredder is a new feature in Malwarebytes Tools for Windows that securely deletes files from your hard drive or USB drive, making them completely unrecoverable even to specialized recovery software. It goes beyond ordinary deletion, which…
Malwarebytes -
MFA Won't Stop Windows Logon Attacks via NTLM and Kerberos Abuse
Many organisations implement multi-factor authentication (MFA) and assume stolen passwords are no longer a threat, but in Windows environments that assumption is often wrong. The article explains that MFA is typically enforced through IdPs like Microsoft…
The Hacker News -
FreeScout CVE-2026-28289 enables zero click RCE via crafted email
Security researchers are urging FreeScout customers to patch a maximum-severity remote code execution vulnerability that requires no user interaction to achieve full system compromise. According to Ox Security, CVE‑2026‑28289 (Mail2Shell) bypasses an earlier…
-
Supreme Court to decide if geofence warrants violate privacy
The Supreme Court is to decide whether geofence warrants are constitutional, a case that Google has submitted an opinion on. The practice, described as a “reverse warrant,” gathers data about a broad group based on location and time, returning every device…
Malwarebytes -
Global operation closes LeakBase cybercrime forum data trade
LeakBase, a well-known cybercrime forum, has been shut down as part of an international law enforcement operation named Operation Leak. The forum had been active since 2021 and, by December 2025, reportedly counted about 142,000 registered users who traded…
SecurityWeek
