News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 13 Mar· 46 articles
-
Google Skia4 articles this day · The Hacker News first
U.S. CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog · CISA Adds CVE-2026-3909 to Known Exploited Vulnerabilities Catalogue
-
U.S. CISA adds Google Chrome flaws to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Google Chrome vulnerabilities, CVE-2026-3909 and CVE-2026-3910, to its Known Exploited Vulnerabilities (KEV) catalog. Both vulnerabilities, which have a CVSS score of 8.8, can be…
-
CISA Adds CVE-2026-3909 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE‑2026‑3909 – the Google Skia Out‑of‑Bounds Write Vulnerability – to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Google’s Skia graphics library, which is embedded in Chrome, ChromeOS, Android, Flutter and other…
-
Google fixed two new actively exploited flaws in the Chrome browser
Google has released security updates for two high-severity Chrome flaws that have been exploited in the wild, tracked as CVE-2026-3909 and CVE-2026-3910. Google experts found both vulnerabilities on 10 March 2026, and the company notes that exploits exist in…
-
Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8
Google fixed two Chrome zero-days that were being exploited in the wild, affecting the Skia and V8 components. The vulnerabilities are CVE-2026-3909, an out-of-bounds write in Skia, and CVE-2026-3910, an inappropriate implementation in V8, both rated with a…
-
-
Supply-chain attack using invisible code hits GitHub and other repositories
According to Aikido Security, researchers have identified a supply-chain attack that floods repositories with malicious packages containing invisible code, a technique designed to defeat conventional defences. They found 151 malicious packages uploaded to…
Ars Technica -
From legacy architecture to Cloudflare One
From legacy architecture to Cloudflare One, the piece notes that a 30,000-user organisation faced moving 1,000+ legacy applications from fragmented VPNs to a new SASE-based setup in a single window, a process described as high risk for operational…
Cloudflare -
Hackers targeted Poland’s National Centre for Nuclear Research
Hackers targeted Poland’s National Centre for Nuclear Research, but security systems detected the intrusion and blocked it before any damage occurred. The centre stated that no production, research, or operational activities were disrupted and that the MARIA…
Security Affairs -
CISA Adds CVE-2026-3910 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE‑2026‑3910 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Google’s Chromium V8 engine – the JavaScript engine used by Chromium‑based browsers such as Google Chrome, Microsoft Edge and Opera – and is described as an…
-
Fake PoCs, Misunderstood Risks Cause Cisco SD-WAN Chaos
Amid Cisco’s public disclosure on 25 February 2026 of half a dozen new SD-WAN Manager vulnerabilities, at least three have been exploited in the wild, including CVE-2026-20127, which carries a CVSS score of 10. VulnCheck researchers highlighted that public…
-
Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware
According to Unit 42 of Palo Alto Networks, a suspected China-based cyber espionage operation has targeted Southeast Asian military organisations as part of a state-sponsored campaign dating back to at least 2020, tracked under the moniker CL-STA-1087. The…
The Hacker News -
Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026
Meta has announced plans to discontinue support for end-to-end encrypted chats on Instagram after 8 May 2026. If you have chats affected by this change, you will see instructions on how you can download any media or messages you may want to keep, and if…
The Hacker News -
Interpol's 'Operation Synergia III' Nets 94 Arrests in Major Cybercrime Sweep
Interpol's Operation Synergia III netted 94 arrests in a wide-ranging cybercrime sweep, coordinated with law enforcement units from 72 countries and private sector partners. According to Interpol, the operation ran from 18 July 2025 to 31 January 2026 and…
Infosecurity -
Will AI Save Consumers From Smartphone-Based Phishing Attacks?
Phishing remains the leading smartphone security issue, with the latest Omdia 2025 Mobile Device Security Consumer Survey reporting that 27% of consumers experienced phishing scams, the most common incident ahead of malware at 26%. According to Omdia,…
Dark Reading -
Watch out for fake Malwarebytes renewal notices in your calendar
Malwarebytes warns of a scam campaign that floods calendars with fake renewal notices impersonating Malwarebytes in an attempt to spur victims into calling a “billing support” number. The fake invites are designed to look like receipts for large charges,…
Malwarebytes -
Starbucks Data Breach Impacts Employees
Starbucks says the incident involved phishing attacks targeting an employee portal and was detected on February 6, with unauthorized access to Starbucks Partner Central accounts. Hackers accessed these accounts after obtaining user credentials through fake…
SecurityWeek -
INTERPOL Dismantles 45,000 Malicious IPs, Arrests 94 in Global Cybercrime
According to INTERPOL, the international law enforcement operation resulted in the takedown of 45,000 malicious IP addresses and servers used in connection with phishing, malware and ransomware campaigns. The crackdown spanned 72 countries and territories…
The Hacker News -
US and European authorities disrupt socksEscort proxy service tied to AVrecon botnet
Authorities in the US and Europe disrupted the SocksEscort proxy service, which was powered by the AVrecon botnet and had infected about 360,000 devices since 2020. On 11 March 2026, Europol and partners launched Operation Lightning, revealing that the…
Security Affairs -
45,000 malicious IP addresses taken down in international cyber operation
An international cybercrime operation has taken down more than 45,000 malicious IP addresses and servers involved in phishing, malware and ransomware, according to Interpol. Law enforcement from 72 countries and territories participated in Operation Synergia…
DataBreaches -
The Broken Records: tracing the human cost of the 2022 British MoD leak
According to Action on Armed Violence (AOAV), a Ministry of Defence data breach in February 2022 exposed sensitive personal information relating to approximately 18,700 Afghan nationals who had assisted UK forces and applied for protection. The breach was…
DataBreaches -
In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown
In Other News: N8n Flaw Exploited notes that CISA has added a vulnerability in the open source workflow automation tool n8n to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-68613, which allows remote code execution and appears to be the…
-
Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials
Microsoft disclosed details of a credential theft campaign that distributes fake VPN clients via SEO poisoning, redirecting users searching for legitimate enterprise software to malicious ZIP files on attacker‑controlled sites to deploy digitally signed…
The Hacker News -
How to Investigate a Stealer Log: From Raw Data to Incident Response
The piece explains that information-stealing malware, or infostealers, quietly harvest sensitive data such as saved passwords, active session cookies, and other credentials, packaging them into stealer logs that are sold on Dark Web marketplaces and Telegram…
SOCRadar -
Investigating a New Click-Fix Variant
Atos Researchers have identified a new variant of the ClickFix technique in which attackers prompt users to run a malicious command via the Win+R Run dialog, mapping a network drive with a batch file from an external server. The variant uses net use to…
The Hacker News -
Most Google Cloud Attacks Start With Bug Exploitation
Most Google Cloud attacks now begin with bug exploitation rather than stolen credentials or misconfigurations, a trend highlighted in Robert Lemos’s March 13, 2026 Dark Reading piece. The article notes that attacks on user-managed cloud software—such as the…
Dark Reading -
U.S. Tax Season: How Threat Actors Exploit IRS Phishing, W-2 Fraud, and Dark Web Activity
The article explains that during the U.S. tax season threat actors deploy IRS-themed phishing, W-2 fraud and dark web activity to harvest sensitive data, impersonate IRS or payroll entities, and pressure victims into revealing information or sending funds.…
SOCRadar -
Real-Time Banking Trojan Strikes Brazil's Pix Users
A new Android-based banking Trojan named PixRevolution targets Brazil’s Pix mobile payments, sitting stealthily on the device until the user initiates a transfer. According to Aazim Yaswant in a blog post, the campaign combines real-time operators or AI…
Dark Reading -
Google patches two Chrome zero-days under active attack. Update now
Google has released an out-of-band security update for Chrome desktop that patches two high‑severity zero‑day vulnerabilities that were under active attack. Both bugs can be exploited remotely and require only that a user visits a malicious website, with the…
Malwarebytes -
Iran-Linked Hackers Take Aim at US and Other Targets, Raising Risk of Cyberattacks During War
According to Associated Press, pro-Iranian hackers are targeting sites in the Middle East and are beginning to stretch into the United States, raising the risk to American defence contractors, power stations and water plants. The group behind the activity…
SecurityWeek -
What the Telus 1 Petabyte Breach Could Mean for Customers and Third-Party Risk
The post, published on 13 March 2026, explains that Telus Digital confirmed unauthorized access to a limited number of systems, with the incident described as a breach rather than a full disruption to services. The threat actor behind the incident claimed to…
SOCRadar -
Bold Security Emerges From Stealth With $40 Million in Funding
Bold Security has emerged from stealth with $40 million in funding from Bessemer Venture Partners, Picture Capital, and Red Dot Capital Partners, a move that the New York-based company says will accelerate its global go‑to‑market plans and platform…
SecurityWeek -
AI-assisted Slopoly malware powers Hive0163’s ransomware campaigns
IBM X-Force researchers have traced Hive0163’s ransomware activity to an AI-assisted malware dubbed Slopoly, used to maintain persistent access during attacks. The group, described as financially motivated and focused on post‑compromise activity, is linked…
Security Affairs -
Google Paid Out $17 Million in Bug Bounty Rewards in 2025
Google announced paying out $17.1 million in rewards through its bug bounty programmes in 2025, bringing the total handed out over the past 15 years to $81.6 million. Google paid over $3.7 million for Chrome vulnerabilities and more than $3.5 million for…
SecurityWeek -
Veeam Backup & Replication: CVE-2026-21666 and Related RCE Fixes
Veeam shipped new security fixes for Veeam Backup & Replication on 12 March 2026, publishing separate knowledge bases for its supported major branches. The updates address a cluster of vulnerabilities that include multiple Remote Code Execution paths and a…
-
Iran-Linked Hacker Attack on Stryker Disrupted Manufacturing and Shipping
Stryker, the US-based medtech group, admitted that an Iran-linked cyberattack disrupted its global operations by impacting the company’s Microsoft environment, though the intrusion appears to have been limited to IT systems rather than operational…
SecurityWeek -
Law Enforcement Dismantles SocksEscort Proxy Network in Operation Lightning
International law enforcement partners executed Operation Lightning and dismantled the proxy service SocksEscort, which is alleged to have compromised over 360,000 routers and IoT devices in 163 countries since 2020 and offered its customers over 35,000…
Infosecurity -
Fake Temu Coin airdrop uses ClickFix trick to install stealthy malware
According to Stefan Dasic, Malwarebytes details a new ClickFix campaign that adapts its opening steps for a different outcome, this time luring victims with a convincing fake website promoting a $TEMU airdrop. The site prompts users to click an I’m not a…
Malwarebytes -
Onyx Security Launches With $40 Million in Funding
According to SecurityWeek, Onyx Security launched with $40 million in funding from Conviction and Cyberstarts to control and secure autonomous AI agents. The startup, founded by Bar Kogan and Gil Elbaz, has built a secure AI control plane that lets…
SecurityWeek -
Beyond File Servers: Securing Unstructured Data in the Era of AI
File servers still exist but the article argues that most modern workflows now run in collaboration tools, code platforms, chats and AI systems, making a purely file-centric view of data insufficient. It traces how data security tools like DSPM were designed…
Security Affairs -
Authorities Disrupt SocksEscort Proxy Service Powered by AVrecon Botnet
Authorities in the United States and Europe have disrupted SocksEscort, a malicious proxy service that facilitated criminal activity and linked about 363,000 IP addresses from 163 countries to the operation since 2020. According to Europol and the US Justice…
SecurityWeek -
Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation
Cybersecurity researchers have disclosed nine security vulnerabilities in the Linux kernel’s AppArmor module, dubbed CrackArmor by the Qualys Threat Research Unit (TRU), that could be exploited by unprivileged users to bypass protections, escalate to root,…
The Hacker News
