News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 23 Mar· 59 articles
-
Initial Access Broker sentenced to 81 months in prison for enabling Yanluowang ransomware gang
Aleksei Volkov, a Russian citizen described as an initial access broker, was sentenced to 81 months in prison for aiding major cybercrime groups, including the Yanluowang ransomware gang, in attacks against U.S. companies and other organisations. According…
DataBreaches -
Hackers increasingly target school districts
Hackers are increasingly treating school districts like easy ATMs for personal data, with Bronx families squarely in the crosshairs. A Turn To Tara segment on News 12 New York spotlighted a sharp jump in cyberattacks on schools and highlighted warnings from…
DataBreaches -
CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem
CanisterWorm is a self-propagating npm worm deployed by the TeamPCP threat actor, described as a direct continuation of the Trivy compromise (v0.69.4). After attackers embedded a credential harvester in Trivy’s CI/CD toolchain and stole npm tokens from…
StepSecurity -
AI in the SOC: What Could Go Wrong?
Two enterprise cybersecurity leaders trialled AI in their SOCs for six months, sharing their findings at RSAC 2026 Conference. Mittal, overseeing a Fortune 500 food manufacturing company, reported that mean time to discovery improved 26% to 36%, mean time to…
Dark Reading -
Google Authenticator: The Hidden Mechanisms of Passwordless Authentication
Passwordless authentication is examined in depth here as part of Unit 42’s series on passkey adoption, with this post focusing on Google Authenticator and the architecture behind synced passkeys for desktop users. The piece explains that Google’s cloud…
unit42.paloaltonetworks.com -
Trivy Supply Chain Attack Targets CI/CD Secrets
A Trivy supply chain attack saw a threat actor systematically targeting cloud credentials, SSH keys, tokens and other sensitive secrets stored in automated enterprise software build and deployment pipelines after compromising Trivy, the widely deployed cloud…
Dark Reading -
After hack, some ignition interlock users couldn't start their own cars
After a cyberattack hit Intoxalock on 14 March, the calibration backend for its ignition interlock devices went offline, leaving many users unable to calibrate and at risk of their vehicles being locked. The company said that five days later on 18 March it…
Ars Technica -
QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025
QNAP fixed four vulnerabilities demonstrated at Pwn2Own Ireland 2025 by Team DDOS, all linked to SD-WAN router issues assigned CVE-2025-62843 to CVE-2025-62846. The researchers chained multiple bugs in QNAP devices to gain root access and earned a $100,000…
-
Tool updates: lots of security and logic fixes, (Mon, Mar 23rd)
Jim Clausing explains that a batch of updates was applied after reviewing Claude’s suggestions to his Python scripts, with fixes spanning both security and logic issues. The diary notes a logic inversion error with the -f switch and unhandled errors in…
SANS ISC -
CISOs Debate Human Role in AI-Powered Security
CISOs Debate Human Role in AI-Powered Security covers a RSAC 2026 Conference panel where Google Cloud, Vodafone and PayPal discussed evolving AI use cases and how to deploy them safely. The panel, featuring Francis deSouza, Emma Smith and Shaun Khalfan,…
Dark Reading -
Supercharge Your SOC
On 24 March 2026, Paul Ewing examines how Detection Engineers are navigating the AI-enhanced SOC landscape in the Elastic Security Labs piece “Supercharge Your SOC.” The article argues that generative AI and advanced coding agents are transforming how…
elastic.co -
Streamlining the Security Analyst Experience
Elastic Security Labs outlines an Agentic SOC where AI Agents and AI Agent Skills perform SOC workflows such as detection engineering, alert triage, investigation, escalation, response, and threat hunting, without replacing human analysts but transforming…
elastic.co -
Security Automation with Elastic Workflows: From Alert to Response
Elastic Security Labs presents a practical guide to building intelligent, automated security playbooks with Elastic Workflows, designed to run inside Kibana and integrate directly with alerts, cases, and security data. The article walks through a full triage…
elastic.co -
Investigating from the Endpoint Across Your Environment with Elastic Security XDR
Elastic Security XDR unifies endpoint protection with multi-domain security analytics to help analysts trace and contain multi-stage attacks across hybrid and cloud environments, with endpoint telemetry and supporting artifacts analysed alongside workloads,…
elastic.co -
CVE-2026-3055: Citrix NetScaler ADC and NetScaler Gateway Out-of-Bounds Read
On 23 March 2026, Citrix published a security advisory for CVE-2026-3055, a critical out-of-bounds read affecting NetScaler ADC and NetScaler Gateway. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated remote attackers to leak…
-
Checkmarx KICS GitHub Action Compromised: Malware Injected in All Git Tags
According to Ashish Kurmi, on 23 March 2026 all release tags in the Checkmarx/kics-github-action repository were compromised with a malicious infostealer injected into setup[.]sh, meaning any workflow referencing the Action by a version tag is executing…
StepSecurity -
North Korean Hackers Abuse VS Code Auto-Run Tasks to Deploy StoatWaffle Malware
North Korean hackers are exploiting Visual Studio Code's auto-run task feature to distribute StoatWaffle malware. This method allows attackers to execute malicious code without user interaction, increasing the likelihood of successful infiltration. The alert…
The Hacker News -
Most Cybersecurity Staff Don’t Know How Fast They Could Stop a Cyber-Attack on AI Systems
According to ISACA, more than half of IT and cybersecurity professionals (56%) have no idea how quickly they could shut down AI systems affected by a cyber-attack or security incident, based on a survey of over 3400 security and digital professionals…
Infosecurity -
Tycoon2FA Phishing Service Resumes Activity Post-Takedown
Tycoon2FA, a subscription-based phishing-as-a-service platform launched in 2023, resumed activity after a Europol-led takedown earlier this month, continuing to compromise email accounts and bypass multifactor authentication using adversary-in-the-middle…
Infosecurity -
Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started
Microsoft Defender stopped a GPO-based ransomware incident at a large educational institution, with predictive shielding intercepting the attack before it deployed. The target had more than a couple of thousand devices, 33 servers, 11 domain controllers and…
Microsoft -
RSAC 2026 Conference Announcements Summary (Pre-Event)
RSAC 2026 Conference Announcements Summary (Pre-Event) rounds up a flood of vendor updates ahead of the San Francisco event, with SecurityWeek curating the most significant product and service news. Highlights include 1Password unveiling Unified Access to…
SecurityWeek -
‘CanisterWorm’ Springs Wiper Attack Targeting Iran
A new wiper campaign dubbed CanisterWorm targets Iran by using a self-propagating worm that spreads through exposed cloud services and wipes data on systems set to Iran’s timezone or with Farsi as the default language. The operation, attributed to a…
Krebs on Security -
FriendlyDealer mimics official app stores to push unvetted gambling apps
Malwarebytes reports a social-engineering campaign dubbed FriendlyDealer that impersonates Google Play and the Apple App Store to push unvetted gambling apps across at least 1,500 domains. The operation uses a reusable kit to generate dozens of fake…
Malwarebytes -
High-Tech Sector Overtakes Finance as Top Target for Cyber-Attacks, Mandiant Reports
According to Mandiant’s latest incident response data, the high-tech sector was the most targeted industry for cyber-attacks in 2025, dethroning financial services as the primary focus of threat actors. High-tech companies accounted for 17% of all Mandiant…
Infosecurity -
The March Madness scam playbook
March Madness is used by scammers to exploit fans during the NCAA basketball tournament, with the post outlining a playbook that hinges on money, emotion, and urgency. The article identifies fake ticket marketplaces and resale fraud, where scammers set up…
Malwarebytes -
Attackers Hide Infostealer in Copyright Infringement Notices
Attackers are using copyright-infringement notices in a targeted phishing campaign that aims to install PureLog Stealer, a low-cost infostealer, across healthcare, government, hospitality and education sectors in several countries. Primarily, Trend Micro…
Dark Reading -
Trivy Supply Chain Attack Expands With New Compromised Docker Images
A new set of compromised Docker images tied to the Trivy supply chain attack has been identified, expanding the impact across developer environments and CI/CD pipelines. On 19 March 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner…
Infosecurity -
M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds
According to Google, the M-Trends 2026 report is based on information from its Threat Intelligence Group and more than 500,000 hours of Mandiant incident investigations conducted in 2025. One of the standout findings is that the time from initial access to…
-
AstraZeneca Data Breach: What You Need to Know
AstraZeneca is the target of a newly surfaced Dark Web post claiming an alleged data breach linked to the LAPSUS$ threat group, with claims that internal code and infrastructure data have been exposed. The Dark Web listing allegedly includes source code in…
SOCRadar -
Pro-Iranian Nasir Security is targeting energy companies in the Gulf
According to Resecurity, a group called Nasir Security, believed to be linked to Iran, is targeting energy organisations in the Middle East, focusing on the Gulf region. The threat actors are said to have attacked supply chain vendors involved in…
Security Affairs -
Chip Services Firm Trio-Tech Says Subsidiary Hit by Ransomware
Semiconductor services firm Trio-Tech has disclosed that one of its Singapore subsidiaries was hit by ransomware, with file-encrypting malware deployed on its network on 11 March. The subsidiary immediately activated response protocols, quarantining systems…
SecurityWeek -
44 Aqua Security repositories defaced after Trivy supply chain breach
Malicious Trivy images on Docker Hub linked to a supply chain attack led researchers to discover that Aqua Security’s internal GitHub organisation was compromised by TeamPCP, which defaced 44 repositories in minutes. On March 22, 2026, we observed all 44…
Security Affairs -
If threat actors gave you a chance to redact the patient data they hacked before they leak it, would you take them up on the offer? Read about the Woundtech incident.
Wound Technology Network, known as Woundtech, a Florida-based mobile wound treatment provider, disclosed that unauthorized individuals accessed its systems between 6 December 2025 and 9 December 2025, with awareness of the intrusion on 2 January 2026.…
DataBreaches -
M-Trends 2026: Data, Insights, and Strategies From the Frontlines
The M-Trends 2026 report by Mandiant provides deep insights into the evolving cyber threat landscape based on extensive incident investigations conducted in 2025. Key findings include: 1) A rise in global median dwell time to 14 days, particularly among…
Google Cloud -
3.7 Million Telehealth Patients Allegedly Affected By Two Recent Breaches
DataBreaches[.]net reports that 3.7 million telehealth patients have allegedly been affected by two breaches linked to a threat actor known as “Stuckin2019” (or simply “Stuck”). OpenLoop Health is cited as having listed patient data for sale on January 7,…
DataBreaches -
Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack
SecurityWeek reports that a threat actor compromised Aqua Security’s Trivy open source vulnerability scanner in a supply chain attack that began in late February, with hackers publishing a malicious scanner release and replacing tags to point to…
SecurityWeek -
GitHub is starting to have a real malware problem
According to Catalin Cimpanu, GitHub is slowly becoming a very dangerous website as more threat actors are starting to use it to host and distribute malware disguised as legitimate software repositories, a trend that has moved from an infrequent sighting in…
DataBreaches -
Hackers target schools, towns in alarming attacks. Why aren’t more using New Jersey’s MS-ISAC ybersecurity service?
Hackers have been targeting schools and towns, with a nationwide data breach exposing millions of K-12 students’ information prompting discussion about New Jersey’s MS-ISAC membership. In November 2025, New Jersey signed on as a statewide member of the…
DataBreaches -
AU: Fairfield Council obtains injunction against unknown threat actors in ransomware incident
According to The Sydney Morning Herald, a western Sydney council, Fairfield Council, has obtained an injunction against unknown threat actors in a ransomware incident. The breach occurred in October last year and involved servers containing personal,…
DataBreaches -
CVE-2025-32975: Quest KACE SMA SSO Authentication Bypass Enables Admin Takeover
CVE-2025-32975 affects Quest KACE SMA and allows an authentication bypass in the appliance’s SSO handling, potentially enabling an unauthenticated attacker to impersonate legitimate users and pursue administrative takeover. The vulnerability is pre-auth and…
