News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 19 Mar· 54 articles
-
Justice Department Disrupts Iranian Cyber Enabled Psychological Operations
The Justice Department has seized four MOIS-linked domains as part of disrupting Iranian cyber-enabled psychological operations, according to the U.S. Attorney’s Office, District of Maryland. The four domains—Justicehomeland[.]org, Handala-Hack[.]to,…
DataBreaches -
AI Conundrum: Why MCP Security Can't Be Patched Away
Organizations rushing to connect their LLM-powered apps to external data sources via the Model Context Protocol (MCP) are creating attack surfaces that security controls aren’t built to handle, researchers warn. The threat is architectural and not easily…
Dark Reading -
Critical Ubiquiti UniFi UniFi security flaw allows potential account hijacking
Ubiquiti has patched two vulnerabilities in its UniFi Network app, including a maximum-severity flaw that could enable account takeover. The issue tracked as CVE-2026-22557 (CVSS 10.0) affects UniFi Network application version 10.1.85 and earlier, and an…
-
Hundreds of millions of iPhones can be hacked with a new tool found in the wild
Hundreds of millions of iPhones can be hacked with a new tool found in the wild, researchers say. DarkSword, a powerful iPhone-hacking technique, has been seen in use by Russian hackers and was disclosed by researchers at Google and cybersecurity firms…
Ars Technica -
Powering the agents: Workers AI now runs large models, starting with Kimi K2.5
Cloudflare announces that Workers AI now runs large models, starting with Moonshot AI’s Kimi K2.5, bringing frontier open-source models to its AI inference platform as of 19 March 2026. The Kimi K2.5 model features a 256k context window and supports…
Cloudflare -
Speagle Malware Hijacks Cobra DocGuard to Steal Data via Compromised Servers
Speagle, a newly identified malware, hijacks Cobra DocGuard’s functionality and infrastructure to secretly harvest sensitive data from infected hosts and send it to a Cobra DocGuard server that has been compromised by the attackers. According to Symantec and…
The Hacker News -
New tools and guidance: Announcing Zero Trust for AI
According to Microsoft Security Blog, Microsoft is expanding Zero Trust to AI with a new set of tools and guidance for the AI lifecycle, including a new AI pillar in the Zero Trust Workshop, updated Data and Networking pillars in the Zero Trust Assessment…
Microsoft -
54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security
A new analysis by The Hacker News and ESET reveals that 54 EDR killers use a BYOVD technique to exploit 34 vulnerable drivers, enabling threat actors to disable security before encrypting data. EDR killers act as external components that terminate security…
The Hacker News -
Oasis Security Raises $120 Million for Agentic Access Management
Oasis Security has raised $120 million in a Series B funding round, bringing its total funding to $195 million since the company was founded in 2022. The New York-based identity management startup has developed a non-human identity and agentic access…
SecurityWeek -
1stProtect Emerges From Stealth With $20 Million in Funding
1stProtect today emerged from stealth with $20 million in funding from Andra Capital and All Blue Capital, the company said. The San Francisco-based startup has built an endpoint security platform that monitors system behaviour and verifies user intent to…
SecurityWeek -
Cisco Secure Firewall Management Center (FMC)3 articles this day · CISA first
CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue · U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalog
-
CISA Adds CVE-2026-20131 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE‑2026‑20131 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Cisco Secure Firewall Management Center (FMC) and Cisco Security Cloud Control (SCC) firewall‑management software. It is a deserialization of untrusted…
-
U.S. CISA adds a flaw in Cisco FMC and Cisco SCC Firewall Management to its Known Exploited Vulnerabilities catalog
According to CISA, the U.S. Cybersecurity and Infrastructure Security Agency, a flaw in Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management has been added to the Known Exploited Vulnerabilities…
-
CISA Adds One Known Exploited Vulnerability to Catalog
According to CISA, on March 19, 2026, one new vulnerability has been added to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The entry is CVE-2026-20131, named Cisco Secure Firewall Management Center (FMC)…
-
-
Critical ScreenConnect Vulnerability Exposes Machine Keys
SecurityWeek reports that ConnectWise has issued a security update for ScreenConnect to improve handling of machine keys after the critical vulnerability CVE-2026-3564, which carries a CVSS of 9.0, was disclosed. The latest version, ScreenConnect 26.1,…
-
Privacy Platform Cloaked Raises $375M to Expand Consumer Tools and Enterprise Reach
Cloaked has announced a $375 million Series B funding round and growth financing to accelerate its product roadmap and scale its platform for both individual users and businesses, bringing total known funding to more than $400 million. The round was led by…
SecurityWeek -
Google details new 24-hour process to sideload unverified Android apps
Google is planning major Android security changes for 2026, starting with a new 24-hour gap to bypass verification when sideloading unverified apps, part of a broader “advanced flow” that will be available before verification enforcement begins later this…
Ars Technica -
DomainTools Investigations | Exposure of TLS Private Key for Myclaw 360 in Qihoo 360 “Security Claw” AI Platform
DomainTools’ investigation confirms the exposure of a TLS private key tied to a wildcard certificate for *.myclaw.360[.]cn, used by Qihoo 360’s Security Claw AI platform. The certificate was issued by WoTrus RSA DV SSL CA 2 and was originally valid from 12…
dti.domaintools.com -
Ransomware Affiliate Exposes Details of 'The Gentlemen' Operation
A ransomware affiliate known as 'hastalamuerte' has revealed operational details about a group called The Gentlemen, shedding light on its tactics, techniques and internal disputes. New research by Group-IB, published on 19 March, provided rare insight into…
Infosecurity -
UMMC continues investigating cyberattack and recovering from impact.
In February, the University of Mississippi Medical Center announced it was closing dozens of clinics statewide after a cyberattack disrupted multiple IT systems and cut off access to its Epic EMR platform, which contained patients’ medical records, with a…
DataBreaches -
Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury
SecurityWeek reports that Iran had already built cyberattack capabilities for a potential response before the Epic Fury strikes, with a six‑month buildup of Iran‑linked infrastructure including US‑based shell companies. A study by Augur Security tracks…
SecurityWeek -
Synacor Zimbra Collaboration Suite (ZCS)3 articles this day · SecurityWeek first
Russian hackers exploit Zimbra flaw in Ukrainian govt attacks · Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376
-
Russian hackers exploit Zimbra flaw in Ukrainian govt attacks
Hackers part of APT28, a state-backed threat group linked to Russia’s military intelligence service (GRU), are exploiting a Zimbra Collaboration Suite vulnerability in attacks targeting Ukrainian government entities, according to Bleeping Computer. The…
-
Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376
Russia-linked threat actors are alleged to be exploiting a critical XSS flaw in Zimbra, tracked as CVE-2025-66376, to target Ukrainian users, with the campaign leveraging HTML emails to run scripts when opened. The vulnerability resides in the Classic UI and…
-
Russian APT Exploits Zimbra Vulnerability Against Ukraine
A Russian state-sponsored threat actor has exploited a high-severity XSS vulnerability in Zimbra Collaboration in attacks against Ukraine, according to SecurityWeek. The flaw, tracked as CVE-2025-66376 (CVSS 7.2) affects the Classic UI and was addressed in…
-
-
Marquis Data Breach Affects 672,000 Individuals
Marquis, a Texas-based provider of marketing and compliance solutions for credit unions and banks, disclosed that a data breach revealed last year affects roughly 672,000 individuals. The company said it discovered in August 2025 that hackers gained access…
SecurityWeek -
When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures
During tax season, Microsoft Threat Intelligence notes a surge in phishing and malware campaigns that exploit time pressure and familiar tax emails, including refund notices, payroll forms, and requests from tax professionals to trick targets into opening…
Microsoft -
Financial Brands Targeted in Global Mobile Banking Malware Surge
A global surge in mobile banking malware is reshaping the fraud landscape, targeting 1,243 financial brands across 90 countries, according to Zimperium zLabs. The firm’s latest report analysed 34 active malware families affecting apps with more than three…
Infosecurity -
ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploits, MCP Abuse, LiveChat Phish & More
ThreatsDay Bulletin revisits FortiGate RaaS activity, led by The Gentlemen, a nascent ransomware-as-a-service (RaaS) operation that allegedly uses CVE-2024-55591, a critical FortiOS/FortiProxy authentication bypass, for initial access. According to Group-IB,…
-
Security Firm Aura Discloses Data Breach Impacting 900,000 Records
Aura has disclosed a data breach caused by a targeted phone phishing attack against one of its employees. According to Aura, the phishing gave attackers access to the employee’s account for approximately an hour, after which access was terminated and its…
SecurityWeek -
Apple Multiple Products2 articles this day · Malwarebytes first
DarkSword emerges as powerful iOS exploit tool in global attacks · A DarkSword hangs over unpatched iPhones
-
DarkSword emerges as powerful iOS exploit tool in global attacks
DarkSword is described as a new iOS exploit kit that has been used since late 2025 by multiple threat actors, including surveillance vendors and likely nation-state actors, to steal data from Apple devices in campaigns targeting Saudi Arabia, Turkey,…
-
A DarkSword hangs over unpatched iPhones
Researchers at Google have identified an iOS exploit chain, named DarkSword, that has been used since late last year by multiple actors to infect iPhones with malware in targeted attacks. DarkSword combines six vulnerabilities in iOS and Safari to deploy…
-
-
Hacker Conversations: Ben Harris, from Unintentional Young Hacker to Intentional Adult CEO
Ben Harris, described in SecurityWeek as a hacker with a rebellious streak who nonetheless avoided harm, founded WatchTowr and became its CEO in August 2021, building a platform that provides a real-time attack view of customers’ environments to identify…
SecurityWeek -
Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario
Published on 20 March 2026, this Elastic Security Labs piece provides a real‑world walkthrough of TeamPCP’s multi‑stage container compromise, demonstrated through D4C runtime telemetry across execution, persistence, lateral movement, and monetization phases.…
elastic.co -
New Perseus Android Banking Malware Monitors Notes Apps to Extract Sensitive Data
Security researchers have disclosed a new Android banking malware family named Perseus, which aims to take control of infected devices and carry out financial fraud. Perseus is built on Cerberus and Phoenix and is distributed through dropper apps on phishing…
The Hacker News -
Deaconess patients’ sensitive data stolen in vendor breach
A data breach at a third-party medical records vendor exposed the personal and health information of patients at two Deaconess Health System hospitals in Western Kentucky, with the Evansville-based health system saying the incident was disclosed nearly two…
DataBreaches -
Cyberattack leaves drivers with required breathalyzer test systems in 46 states unable to start vehicles
A cyberattack has shut down a nationwide breathalyzer test system found in vehicles of OUI offenders, impacting thousands of drivers in Maine and 45 other states. Intoxalock is the company targeted by the attack, and since the breach the device will not…
DataBreaches -
Personal information of 16,000 individuals leaked from Seoul National University Hospital
According to DataBreaches[.]Net, patient records of around 16,000 individuals were partially leaked from Seoul National University Hospital due to a clerical error, reported by Jung Si-Nae. The hospital announced the data breach on its website on Thursday,…
DataBreaches -
Chilling Effects: NZ GP stops uploading patient notes to MyIndici as a precaution
A Wellington GP clinic has stopped uploading consultation notes to patient portal MyIndici as an extra layer of protection for patients’ data, saying it makes a precautionary move rather than due to a breach. The clinic, Newlands Medical Centre, told RNZ…
DataBreaches -
Your tax forms sell for $20 on the dark web
Your tax forms fetch $20 on the dark web, with Malwarebytes Labs noting a recent listing advertising 100 complete tax forms for $2,000, effectively pricing a fully documented stolen identity at $20. The piece describes Stolen Identity Refund Fraud (SIRF) as…
Malwarebytes -
How Ceros Gives Security Teams Visibility and Control in Claude Code
Claude Code, Anthropic's AI coding agent, runs across engineering organisations at scale, reading files, executing shell commands, calling external APIs and connecting to MCP servers, all with the developer’s full permissions and before any network security…
The Hacker News -
Raven Emerges From Stealth With $20 Million in Funding
Raven Emerges From Stealth With $20 Million in Funding reports that Raven, a cybersecurity startup protecting cloud-native applications at runtime, has come out of stealth with $20 million in combined seed and post-seed funding. The rounds were led by…
SecurityWeek
