News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 9 Mar· 41 articles
-
Xygeni GitHub Action breach pins v5 to backdoored C2 shell
The official Xygeni GitHub Action (xygeni-action) was compromised on 3 March 2026 when an attacker using stolen maintainer credentials injected a full C2 reverse shell backdoor and moved the mutable v5 tag to the malicious commit. The backdoor was hidden in…
StepSecurity -
CISA flags CVE-2026-1603 authentication bypass in Ivanti EPM
CISA has added CVE-2026-1603 to the Known Exploited Vulnerabilities (KEV) catalogue. The affected vendor is Ivanti, and the product is Ivanti Endpoint Manager (EPM). The vulnerability, Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability, is an…
-
CISA KEV flags CVE-2025-26399 in SolarWinds Web Help Desk
CISA has added CVE-2025-26399 to the Known Exploited Vulnerabilities (KEV) catalogue, affecting SolarWinds and its Web Help Desk product. The vulnerability is SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability, which could allow an…
-
CVE-2021-22054 Omnissa Workspace One SSRF flaw could expose data
CISA has added CVE-2021-22054 to its Known Exploited Vulnerabilities (KEV) catalogue. The affected vendor is Omnissa and the product is Workspace One UEM. The vulnerability, Omnissa Workspace ONE Server-Side Request Forgery, could allow a malicious actor…
-
White House shifts to preemption and deterrence in cyber strategy
The White House’s new cyber strategy is a seven-page document that signals a shift to preemption and deterrence to tackle cyber threats, framing cybersecurity as both a defensive challenge and a strategic domain. It notes an executive order aimed at…
Dark Reading -
FBI warns of phishing impersonating officials over permit fees
The FBI warns of phishing campaigns in which crooks impersonate U.S. city and county officials to target people applying for planning or zoning permits. According to FBI’s public service announcement (PSA), attackers use publicly available permit information…
Security Affairs -
Fake Claude Code install pages lure via Google malvertising
A new variation of the ClickFix technique is being used to spread fake Claude Code install pages, blending malvertising with social engineering to capitalise on AI coding tools. Researchers at Push Security discovered that the campaign distributes cloned…
Dark Reading -
macOS OpenClaw npm fake installer steals Keychain data and RAT
Security researchers have uncovered a malicious npm package that pretends to be an OpenClaw installer in order to deploy a remote access trojan and harvest data from macOS hosts. The package, named @openclaw-ai/openclawai, was uploaded on 3 March 2026 by a…
The Hacker News -
February cybersecurity M&A spree expands AI driven security
According to SecurityWeek, forty-two cybersecurity-related merger and acquisition deals were announced in February 2026, with high-profile activity from players including Arctic Wolf, Booz Allen, Check Point, Sophos, Palo Alto Networks and Zscaler. Notable…
SecurityWeek -
PowerShell data theft via Elastic Cloud SIEM targets 216 hosts
A campaign exploiting multiple software flaws to steal system data and store it in a cloud-based security platform has been uncovered by cybersecurity researchers, with investigators noting a threat actor used a free-trial Elastic Cloud SIEM instance to…
Infosecurity -
Trump Admin Unveils Cyber Strategy to Modernise Federal Networks
A new national cyber strategy released by the Trump Administration aims to strengthen US digital defenses, counter foreign adversaries and accelerate innovation, with the document published on 6 March 2026. According to The White House, the strategy frames…
Infosecurity -
Russia linked actors phish officials on Signal and WhatsApp
Dutch intelligence agencies MIVD and AIVD warn of a global campaign by Russia-linked threat actors aiming to compromise Signal and WhatsApp accounts used by government and military officials. The alert says targets include Dutch government employees, with…
Security Affairs -
North Korea's UNC4899 uses AI IDE backdoor to seize crypto funds
The Hacker News reports that the North Korean threat actor UNC4899 is suspected to be behind a sophisticated cloud compromise campaign targeting a cryptocurrency organisation in 2025 to steal millions of dollars in cryptocurrency. The activity is attributed…
The Hacker News -
RFCs Promote Encrypted Client Hello Privacy as Cloudflare Leads
Published on 9 March 2026, SANS ISC reports that two related RFCs—RFC 9848 (Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings) and RFC 9849 (TLS Encrypted Client Hello)—have been introduced, with Cloudflare among the early implementers. The…
SANS ISC -
GITHUB_TOKEN stolen via Pwn Request flaw in kubernetes-el CI
On 5 March 2026, a threat actor exploited a classic “Pwn Request” vulnerability in the CI workflow of kubernetes-el/kubernetes-el, a popular Emacs package for managing Kubernetes clusters. The attacker stole the repository’s GITHUB_TOKEN with full write…
StepSecurity -
UK opens Online Crime Centre to shut down scam accounts and texts
A new Online Crime Centre is set to take the fight to cyber-crime as part of the UK government’s expanded anti-fraud strategy. In a joint announcement, the UK Home Office and the National Crime Agency said the unit will combine expertise from government,…
Infosecurity -
Cloudflare beta scanner targets API logic flaws starting with BOLA
Security is shifting from pure defence to active testing with the beta launch of Cloudflare’s Web and API Vulnerability Scanner, aimed at detecting logic flaws in APIs, starting with Broken Object Level Authorization (BOLA) as the first vulnerability type.…
Cloudflare -
Pingora 0.8.0 fixes HTTP smuggling CVEs 2026-2833/2835/2836
In December 2025, Cloudflare received reports of HTTP/1.x request smuggling vulnerabilities in the Pingora OSS framework when used as an ingress proxy, and the team has now detailed how these flaws operate and were addressed in Pingora 0.8.0. The issues are…
-
Threat Roundup: CVE-2026-21385 exploited; Coruna iOS exploit kit
The weekly recap flags a flurry of activity, led by a Qualcomm flaw that has been exploited in the wild: CVE-2026-21385, a high‑severity buffer over-read in the Graphics component with a CVSS of 7.8, with Google noting indications of limited, targeted…
-
AI security drives Cyber 150 cohort as startups surge globally
IT-Harvest has announced the second cohort of its Cyber 150 awards, revealing that 22% of winners offer AI security products and that 33 of the top 150 startups fall under the AI security category. According to IT-Harvest research, the global cybersecurity…
Infosecurity -
Fake Claude Code pages install Amatera infostealer on Windows Mac
Malwarebytes warns of fake Claude Code install pages targeting Windows and Mac users, where attackers clone pages and swap the one-liner install commands with malware to steal passwords, cookies, sessions and access to developer environments. The campaign,…
Malwarebytes -
Bitdefender flags 310 Meta scams fuelling deposit fraud worldwide
The Bitdefender Labs investigation reveals a global investment scam ecosystem operating across 25 countries, primarily using Meta platforms for dissemination. Key findings include 310 coordinated scam campaigns utilizing over 26,000 advertisements in…
bitdefender.com -
Microsoft Frontier Wave 3 GA Brings Agent 365 and Copilot
Microsoft describes Frontier Transformation’s next step with Wave 3 of Microsoft 365 Copilot, Microsoft Agent 365, and Microsoft 365 E7, and says Agent 365 will be generally available on 1 May 2026 with a price of $15 per user per month. Agent 365 is…
Microsoft -
Dutch warn Russia linked social engineering on Signal, WhatsApp
According to the Netherlands’ General Intelligence and Security Service (AIVD) and the Military Intelligence and Security Service (MIVD), on 9 March 2026 they reported a cyber campaign linked to Russia that targets accounts on messaging platforms such as…
SOCRadar -
Quiz sites push deceptive prompts to hijack browser alerts
According to Malwarebytes, quiz sites can trick users into enabling unwanted browser notifications by presenting a prompt that says “Show notifications” and a misleading “Click Allow to continue” message, with the actual aim of granting permission to push…
Malwarebytes -
ClickFix Variant Uses Windows Terminal to Deliver Lumma Stealer
A new ClickFix attack variant is evading detection by instructing victims to use Windows Terminal instead of the traditional Run dialog. This campaign utilizes fake CAPTCHA pages and prompts to trick users into executing harmful PowerShell commands. By…
SecurityWeek -
Phishing on abused .arpa domains hijacks DNS to cloak pages
According to Infoblox, a threat actor has been abusing the internet infrastructure TLD .arpa to host phishing content on domains that should not resolve to IP addresses. The campaign exploits DNS record management controls, with the attacker creating IPv6…
SecurityWeek -
Chinese linked group targets Asia critical infra with Web shells
An undefined Chinese-speaking threat actor is waging long-running cyberespionage against critical Asian infrastructure, using a mix of custom malware, open source tools, and living-off-the-land binaries across Windows and Linux. The threat cluster, tracked…
Dark Reading -
Mid-market security gains with GravityZone in Bitdefender webinar
Mid-market organisations are seeking security levels comparable with their enterprise peers, and the article asks whether the long-promised security platform can finally deliver for lean teams operating on small budgets. It frames the challenge as…
The Hacker News -
InstallFix malvertising clones Claude pages to Amatera Stealer
SecurityWeek reports that cloned webpages impersonating popular development tools are being used in the InstallFix campaign to deliver information-stealing malware. According to Push Security, threat actors replace legitimate install commands on cloned pages…
SecurityWeek -
Cognizant breach exposes 3.4M patients via TriZetto portal
Cognizant’s TriZetto Provider Solutions data breach exposed information belonging to more than 3.4 million patients, with the incident first detected on 2 October 2025 after suspicious activity in a portal used by healthcare providers. An investigation found…
Security Affairs -
TPS breach hits 3.4M patient records; Cognizant under scrutiny
Millions of patients have had personal and health insurance information compromised after a breach at IT firm TriZetto Provider Solutions (TPS). A breach notification disclosure posted by the Office of the Maine Attorney General revealed that over 3.4…
Infosecurity -
Ownership transfer turns Chrome extensions into code injectors
Two Google Chrome extensions have been found to have turned malicious after ownership transfer, enabling code injection and data theft for downstream users, according to The Hacker News. The extensions QuickLens - Search Screen with Google Lens (ID:…
The Hacker News -
Ghanaian Pleads Guilty in $100m Romance Fraud and BEC Scheme
A Ghanaian national pleaded guilty to a role in a global romance fraud and business email compromise scheme, Derrick Van Yeboah, 40, according to Infosecurity Magazine. The Justice Department announced the guilty plea for Van Yeboah, whose operation was…
Infosecurity -
Dark Web: 6.5M Canadian leads, Canva accounts and AT&T data leak
SOCRadar’s Dark Web Team reported a string of new underground posts this week, including alleged data listings tied to FNATH and AT&T, a claimed free leak involving Rapikom Venezuela, and credential-focused listings referencing Canva and Canadian leads. The…
SOCRadar -
Iranian MuddyWater Deploys Dindoor Backdoor Through Deno Runtime
A recently uncovered cyber espionage campaign attributed to MuddyWater, an Iranian state-aligned threat group, has targeted United States networks and several sectors including aviation, financial services, and software development. Researchers say the…
SOCRadar -
Security Week flags fake Meet updates and OpenClaw installers
A week in security for March 2–8 highlighted a string of threat developments and warnings from Malwarebytes Labs. The roundup notes that attackers could gain control of a PC through a fake Google Meet update and warns about fake OpenClaw installers that…
Malwarebytes -
China linked group CL UNK 1068 targets Asia in cyber espionage
High-value organisations in South, Southeast, and East Asia have been targeted by a Chinese threat actor as part of a years-long campaign, with Palo Alto Networks Unit 42 attributing the activity to a previously undocumented group dubbed CL-UNK-1068. The…
The Hacker News -
Anthropic AI Finds 22 Firefox Flaws; Two Exploits in Labs
Anthropic said its Claude Opus 4.6 AI model identified 22 Firefox vulnerabilities in January 2026, with most of them rated high severity and all fixed in Firefox 148, released in January 2026. The researchers note that Claude Opus 4.6 was used in late 2025…
Security Affairs -
ISC StormCast March 9 Green Threat Didier Stevens On Duty
ISC Stormcast for Monday, March 9th, 2026 is published with a threat level of green, and the diary lists Didier Stevens as the Handler on Duty. The page links to a podcast detail at isc.sans[.]edu/podcastdetail/9840, indicating ongoing briefing content…
SANS ISC
