News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 12 Mar· 51 articles
-
What's known about wiper attack on Stryker, a major supplier of lifesaving devices
Ars Technica reports that Stryker, a multinational medical device maker, confirmed a cyberattack that disrupted much of its Microsoft-based infrastructure, with responders saying there is no indication that ransomware or malware were involved and that the…
Ars Technica -
Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia
Unit 42 researchers designate a cluster named CL-STA-1087 as a suspected China-based espionage operation targeting military organisations in Southeast Asia, with activity traced back to at least 2020. The campaign is characterised by patience, precision…
unit42.paloaltonetworks.com -
Iran MOIS Colludes With Criminals to Boost Cyberattacks
Iranian MOIS is increasingly mixing with the cybercriminal underground to bolster its offensive activity, a shift described as a new tactic by Check Point researchers. On 11 March, a wiper attack hit the Fortune 500 medical technology company Stryker and was…
Dark Reading -
Insights: Increased Risk of Wiper Attacks
Unit 42 is tracking an increased risk of wiper attacks related to the conflict with Iran, including multiple incidents impacting organisations in Israel and the US. The primary threat actor described is the Handala Hack group (aka Void Manticore, COBALT…
unit42.paloaltonetworks.com -
Commercial Spyware Opponents Fear US Policy Shifting
Commercial spyware opponents fear that US policy may be shifting, even as key actions last year signalled a tougher stance. Rescinded sanctions and reactivated contracts have created confusion about the Trump administration's spyware policy and where it…
Dark Reading -
Apple patches Coruna exploit kit flaws for older iOS versions
Apple has patched flaws used by the Coruna exploit kit in older iOS versions, according to Google, addressing vulnerabilities that could be triggered by malicious web content and exploited to gain kernel privileges. The fixes cover iOS 16.7.15 and iPadOS…
-
Rust-Based VENON Malware Targets 33 Brazilian Banks with Credential-Stealing Overlays
Rust-based VENON is a banking malware targeting Brazilian users, designed to infect Windows systems and identified by Brazilian cybersecurity company ZenoX, according to ZenoX. It is reported to target 33 financial institutions and digital asset platforms,…
The Hacker News -
“Handala Hack” – Unveiling Group’s Modus Operandi
Handala Hack is an online persona operated by Void Manticore (also known as Red Sandstorm, Banished Kitten), an actor affiliated with Iran’s MOIS, with Karma and Homeland Justice as other linked fronts used in campaigns against Israel, Albania, and US-based…
Check Point -
Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks
Cybersecurity researchers have disclosed details of an AI-generated malware codenamed Slopoly used by a financially motivated threat actor named Hive0163, seen during a ransomware operation in early 2026. The malware, described as an AI-assisted backdoor,…
The Hacker News -
Dev Machine Guard Is Now Open Source: See What's Really Running on Your Developer Machine
Dev Machine Guard has been open-sourced, with StepSecurity releasing the core scanning engine so developers and security teams can gain visibility into what runs on a developer machine. The project is described as a single bash script that inventories IDEs,…
StepSecurity -
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
According to Microsoft Threat Intelligence, Storm-2561 is behind a credential‑theft campaign in which fake VPN clients are distributed via SEO poisoning. Identified in mid‑January 2026 by Microsoft Defender Experts, the campaign redirects users searching for…
Microsoft -
Why Stryker's Outage Is a Disaster Recovery Wake-Up Call
A cyberattack that appears to have knocked tens of thousands of Stryker systems offline this week is a sobering reminder of the need for robust and tested business continuity and disaster recovery plans. Iranian threat group Handala claimed responsibility…
Dark Reading -
Announcing Pwn2Own Berlin for 2026
Announcing Pwn2Own Berlin for 2026 was published by the Zero Day Initiative on March 12, 2026, by Dustin Childs. The event returns to Berlin with 31 targets across 10 categories, including virtualization, web browser, servers, containers, and AI-focused…
thezdi.com -
PixRevolution Malware Hijacks Brazil's PIX Transfers in Real Time
PixRevolution is an Android banking trojan that quietly sits on a victim’s device and can hijack Brazil’s instant PIX transfers in real time, according to Zimperium’s analysis. The malware monitors the device and, during a PIX transaction, replaces the…
Infosecurity -
From transparency to action: What the latest Microsoft email security benchmark reveals
According to Microsoft Defender for Office 365 ICES vendor ecosystem, the latest benchmarking data show that Microsoft Defender removes an average of 70.8% of malicious email post-delivery, helping to shrink dwell time when threats bypass initial filters.…
Microsoft -
Apple iOS and iPadOS2 articles this day · SecurityWeek first
Apple issues emergency fixes for Coruna flaws in older iOS versions · Apple Updates Older iOS Versions to Patch Coruna Exploits
-
Apple issues emergency fixes for Coruna flaws in older iOS versions
Apple has issued security updates for older iPhones and iPads to address vulnerabilities linked to the Coruna exploits, delivering iOS 16.7.15 and iPadOS 15.8.7 for devices no longer receiving major OS updates. The Coruna kit, also known as CryptoWaters,…
-
Apple Updates Older iOS Versions to Patch Coruna Exploits
Apple has released security updates for legacy iOS and iPadOS versions to patch Coruna exploits, with iOS and iPadOS 16.7.15 and 15.8.7 respectively. In early March 2026, researchers from Google and iVerify disclosed Coruna, a nation-state grade exploit kit…
-
-
Critical Zero-Click Flaw in n8n Allows Full Server Compromise
Researchers at Pillar Security have identified two new critical vulnerabilities in self-hosted and cloud n8n deployments, including a zero-click unauthenticated flaw and a sandbox-escape issue. The zero-click flaw is tracked as CVE-2026-27493 and carries a…
-
Managing Elastic Security Detection Rules with Terraform
Elastic Security Labs explain how to define and deploy Elastic Security detection rules and exceptions as code using the Elastic Stack Terraform Provider, alongside the detection-rules repository as a complementary path. The article notes that with V0.12.0…
elastic.co -
Detecting and analyzing prompt abuse in AI tools
Detecting and analysing prompt abuse in AI tools examines how prompt abuse, notably prompt injection, has become a key security concern as AI becomes embedded in everyday workflows.
Microsoft -
How to Scale Phishing Detection in Your SOC: 3 Steps for CISOs
According to The Hacker News, scaling phishing detection now hinges on a three-step model for CISOs: Safe Interaction, Automation, and SSL Decryption, designed to expose real phishing behaviour early without increasing risk. In practice, interactive…
The Hacker News -
elemntor Ally – Web Accessibility & Usability2 articles this day · SecurityWeek first
Critical SQL Injection bug in Ally plugin threatens 400,000+ WordPress sites · Ally WordPress Plugin Flaw Exposes Over 200,000 Websites to Attacks
-
Critical SQL Injection bug in Ally plugin threatens 400,000+ WordPress sites
An unauthenticated SQL injection flaw, tracked as CVE-2026-2413 (CVSS 7.5), in the Ally WordPress plugin could allow attackers to steal sensitive data from more than 400,000 sites. The vulnerability stems from insecure handling of the subscribers query, with…
-
Ally WordPress Plugin Flaw Exposes Over 200,000 Websites to Attacks
A security flaw in the Ally WordPress plugin could allow unauthenticated attackers to inject SQL queries and extract sensitive information from the databases of over 200,000 sites. Tracked as CVE-2026-2413 (CVSS 7.5), the vulnerability stems from an SQL…
-
-
Meta Launches New Protection Tools as It Helps Disrupt Scam Centers
On 12 March 2026, Meta announced a major operation conducted with law enforcement to disrupt scam centers targeting its users, involving the FBI, the DOJ Scam Center Strike Force, and police in Thailand. The effort targeted scam centres in Southeast Asia…
SecurityWeek -
ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More
ThreatsDay Bulletin this week highlights a string of practical security tricks, including OAuth consent abuse where Wiz warned that a large-scale campaign in early 2025 used 19 distinct malicious OAuth applications impersonating brands such as Adobe,…
-
This Android vulnerability can break your lock screen in under 60 seconds
A new Android vulnerability, tracked as CVE-2026-20435, could let attackers gain access to a phone in under 60 seconds by exploiting certain MediaTek SoCs that use Trustonic’s TEE. According to MediaTek’s March Security bulletin, the flaw affects devices…
-
CISA Issues Emergency Directive Over Exploited Cisco SD-WAN Flaws
A newly issued emergency directive from the US Cybersecurity and Infrastructure Security Agency warns that attackers are actively exploiting vulnerabilities in Cisco Catalyst SD-WAN infrastructure used across US federal networks. The directive, known as…
-
The Human IOC: Why Security Professionals Struggle with Social Vetting
The Human IOC: Why Security Professionals Struggle with Social Vetting argues that applying SOC‑level rigor to rumours about people and organisations can determine a security team’s effectiveness. Written by Joshua Goldfarb and published on 12 March 2026,…
SecurityWeek -
Splunk, Zoom Patch Severe Vulnerabilities
Splunk and Zoom have issued security updates this week to fix a range of critical- and high-severity vulnerabilities across their products, according to SecurityWeek. Zoom addressed a critical-severity flaw in Workplace for Windows that could allow…
-
Inductive Automation Ignition Software
According to CISA, the Inductive Automation Ignition Software vulnerability could allow an attacker to execute malicious code with OS application service account permissions due to deserialization of untrusted data. The affected product is Inductive…
-
Siemens Heliox EV Chargers
The ICS Advisory for Siemens Heliox EV Chargers, released on 12 March 2026, identifies an improper access control vulnerability that could allow an attacker to reach unauthorized services via the charging cable. The affected devices are Heliox Flex 180 kW EV…
CISA -
Siemens SIDIS Prime
Siemens SIDIS Prime is affected by multiple vulnerabilities in OpenSSL, SQLite and several Node[.]js packages, with Siemens releasing a new version and advising users to update to the latest SIDIS Prime release (V4.0.800 or later). The advisory lists…
-
Siemens RUGGEDCOM APE1808 Devices
Siemen’s RUGGEDCOM APE1808 devices are the focus of CISA’s ICS Advisory ICSA-26-071-02, released on 12 March 2026. The advisory notes Fortinet FortiOS vulnerabilities linked to Siemens Industrial products, with affected APE1808 versions listed as vers:all/*…
-
Siemens SIMATIC
The Siemens SIMATIC advisory (ICS Advisory ICSA-26-071-04) warns of a vulnerability in SIMATIC S7-1500 family devices that could allow code injection if a user is tricked into importing a specially crafted trace file via the device web interface. The issue…
-
Attackers Don't Just Send Phishing Emails. They Weaponize Your SOC's Workload
Attackers are increasingly weaponising the workload of Security Operations Centres, turning phishing floods into a test of analysts’ capacity rather than a simple lure. The piece explains that high-volume campaigns can overwhelm triage queues, turning…
The Hacker News -
International security chiefs to convene in Glasgow for flagship CYBERUK conference
The CYBERUK 2026 conference, hosted by the UK's National Cyber Security Centre (NCSC), will take place from April 21-23 in Glasgow, bringing together over 2,500 international leaders in cyber security from various sectors. The event features notable speakers…
ncsc.gov.uk -
Police Scotland Fined After Sharing Victim’s Phone Data
Police Scotland has been fined £66,000 and reprimanded after a serious data protection failure in which the entire contents of a female officer’s phone were shared with a colleague she accused of rape. The incident spanned several months in early 2021 and…
Infosecurity -
Cisco Patches High-Severity IOS XR Vulnerabilities
Cisco has released the semiannual IOS XR software security advisory bundle, detailing four high-severity vulnerabilities. The two most severe—CVE-2026-20040 and CVE-2026-20046—carry a CVSS score of 8.8 and could allow an attacker to execute arbitrary…
-
Microsoft Authenticator could leak login codes—update your app now
A vulnerability in Microsoft Authenticator for both iOS and Android (CVE-2026-26123) could leak one-time sign-in codes or authentication deep links to a malicious app on the same device. Deep links are predefined URIs that open an app and complete actions…
-
Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
Apple has backported fixes for a WebKit memory corruption flaw tracked as CVE-2023-43010 to older iOS, iPadOS and macOS Sonoma versions after it was observed being used in the Coruna exploit kit, according to The Hacker News. The vulnerability was addressed…
