News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 27 Mar· 41 articles
-
LeakBase’s “Chucky” detained in Russia
Police have detained a Taganrog resident suspected of administering LeakBase, one of the largest hacker platforms, according to TASS. The detained individual is said to have overseen “one of the largest international hacker platforms, LeakBase,” the agency’s…
DataBreaches -
CISA Adds CVE-2025-53521 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities (KEV) catalogue. The entry affects F5 BIG-IP systems. The vulnerability could allow a threat actor to achieve remote code execution. CVE-2025-53521 is an unspecified vulnerability residing…
-
The European Commission confirmed a cyberattack affecting part of its cloud systems
The European Commission confirmed a cyberattack affecting part of its cloud systems, detected on 24 March and now contained, with mitigation measures applied and no disruption to website availability. Early findings suggest some data may have been accessed,…
Security Affairs -
Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor
Multiple malicious Visual Studio Code extensions published by IoliteLabs—solidity-macos, solidity-windows, and solidity-linux—have been discovered targeting Solidity and Web3 developers on Windows, macOS and Linux, disguising themselves as legitimate…
StepSecurity -
How Microsoft Defender protects high-value assets in real-world attack scenarios
High‑value assets such as domain controllers, web servers and identity infrastructure are highlighted as frequent targets in sophisticated cyber attacks, and Microsoft Defender uses asset context and Security Exposure Management to tailor protection…
Microsoft -
Ransomware Attack Totally Cripples Jackson County Sheriff’s Office in Indiana
A ransomware attack has crippled the Jackson County Sheriff’s Office in Indiana, with IT operations completely disrupted and the department’s computer network, including all PCs, Wi‑Fi, and the primary police report filing system, rendered unusable.…
DataBreaches -
Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits
Apple is now sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS to alert users of web-based attacks and urge them to install the update, a development first reported by MacRumors. The notification reads: “Apple is…
The Hacker News -
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV Files
TeamPCP, the threat actor behind earlier supply‑chain exploits affecting Trivy, KICS and litellm, has compromised the telnyx Python package by pushing two malicious versions to PyPI. The versions, 4.87.1 and 4.87.2, were published on 27 March 2026 and…
The Hacker News -
China Upgrades the Backdoor It Uses to Spy on Telcos Globally
Chinese threat actors have tinkered with a state-of-the-art backdoor called BPFdoor, upgrading it to covertly persist inside the most sensitive parts of global telecommunications systems and other critical networks, according to Rapid7 researchers. Rapid7’s…
Dark Reading -
Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account
According to Associated Press, a pro-Iranian hacking group named Handala claimed Friday to have hacked an FBI director’s personal account and to have posted photographs of Kash Patel, along with a work resume and other personal documents. The group said it…
SecurityWeek -
New Wave of AiTM Phishing Targets TikTok for Business
Infosecurity reports a new wave of Adversary-in-the-Middle (AiTM) phishing pages aimed at TikTok for Business accounts, identified on 27 March 2026. Push Security said the pages were registered on 24 March within a nine-second window and were hosted behind…
Infosecurity -
New AITM phishing wave hijacks TikTok Business accounts
Push Security researchers have uncovered a new wave of AITM phishing pages targeting TikTok for Business accounts, with the aim of hijacking them for malvertising. The campaign includes TikTok and Google-themed fake pages and loads links to prior operations,…
Security Affairs -
TeamPCP Targets Telnyx Package in Latest PyPI Software Supply Chain Attack
TeamPCP has again expanded its supply chain attacks on open-source repositories by targeting Telnyx, according to Socket researchers, in a campaign that compromised the Telnyx Python package on PyPI. The malicious versions published to PyPI, 4.87.1 and…
Infosecurity -
PTC Windchill PDMLink2 articles this day · SecurityWeek first
CISA and BSI warn orgs of critical PTC Windchill and FlexPLM flaw · CISA Flags Critical PTC Vulnerability That Had German Police Mobilized
-
CISA and BSI warn orgs of critical PTC Windchill and FlexPLM flaw
CISA and BSI warn organisations of a critical vulnerability in PTC Windchill and FlexPLM, tracked as CVE-2026-4681, with a CVSS score of 10.0 and no patch currently available. According to the advisory issued by the vendor, the flaw enables remote code…
-
CISA Flags Critical PTC Vulnerability That Had German Police Mobilized
CISA issued an advisory about a critical vulnerability in PTC’s Windchill product lifecycle management software, tracked as CVE-2026-4681, which can allow a remote, unauthenticated attacker to achieve arbitrary code execution. The vulnerability affects…
-
-
‘CanisterWorm’ Springs Wiper Attack Targeting Iran. But why?
According to Brian Krebs, a financially motivated data theft and extortion group is attempting to inject itself into the Iran war by unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran’s time…
DataBreaches -
Wartime Usage of Compromised IP Cameras Highlight Their Danger
Compromised internet-connected cameras have become a notable military asset in recent conflicts, with Russia, Iran, Israel, Ukraine, and the United States all using the tactic to gain eyes inside adversaries’ borders. In the latest incident, Israel and the…
Dark Reading -
Top 10 Cyber Threat Intelligence Trainings
According to SOCRadar, the Top 10 Cyber Threat Intelligence Trainings include a mix of platform-led and independent programmes, ranging from fundamentals to advanced threat intelligence. The list opens with SOCRadar’s own courses, such as Fundamentals of…
SOCRadar -
TeamPCP Supply Chain Campaign: Update 002 - Telnyx PyPI Compromise, Vect Ransomware Mass Affiliate Program, and First Named Victim Claim, (Fri, Mar 27th)
According to Aikido Security, JFrog and SafeDep, TeamPCP compromised Telnyx’s PyPI package repository, publishing malicious telnyx versions 4.87.1 and 4.87.2 on 27 March 2026 at around 03:51 UTC, with the attacker using stolen PyPI credentials rather than a…
SANS ISC -
In Other News: Palo Alto Recruiter Scam, Anti-Deepfake Chip, Google Sets 2029 Quantum Deadline
According to Palo Alto Networks’ Unit 42 threat research team, a phishing campaign has been active since August 2025 in which attackers impersonate the company’s recruiters to defraud senior‑level professionals. The scammers use LinkedIn data to craft…
SecurityWeek -
How Are You Blocking Open Source Reconnaissance Tools?
Today, SOCRadar examines how benign internet-wide scanners such as Shodan, FOFA, ZoomEye and GreyNoise can almost indistinguishably trigger security alerts, creating operational noise for security teams. The piece notes that blocking scanners with firewalls…
SOCRadar -
Open VSX Bug Let Malicious VS Code Extensions Bypass Pre-Publish Security Checks
Cybersecurity researchers disclosed a now-patched flaw in Open VSX’s pre-publish scanning pipeline that could let a malicious VS Code extension pass vetting and go live in the registry. The bug, codenamed Open Sesame, stemmed from a Java-based service that…
The Hacker News -
Criminals are renting virtual phones to bypass bank security
Criminals are increasingly using virtual phones, specifically cloud-based Android devices, to circumvent bank security measures. These 'rent-a-phones' can replicate real device fingerprints, allowing fraudsters to engage in account takeover (ATO) attacks.…
Malwarebytes -
OpenAI Launches Bug Bounty Program for Abuse and Safety Risks
OpenAI has launched a public safety bug bounty programme focused on AI-specific abuse and safety risks in its products, in addition to its existing security programme. According to OpenAI, submissions will be triaged by its Safety and Security Bug Bounty…
SecurityWeek -
Infrastructure Attacks With Physical Consequences Down 25%
Infrastructure attacks with physical consequences fell by 25% in 2025, marking a notable lull in major OT incidents at industrial and critical infrastructure sites, according to Waterfall Security Solutions. The quantity of physically impactful OT attacks…
Dark Reading -
Quantum Computing Threat to Encryption Is Closer Than Expected, Warns Google
Advances in quantum computing could render traditional encryption methods obsolete by 2029, Google has warned. The firm says the threat to encryption is already relevant today due to store-now-decrypt-later attacks, and that digital signatures will become a…
Infosecurity -
AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion
Threat actors are using adversary-in-the-middle AitM phishing pages to seize TikTok for Business accounts, according to Push Security. The campaign begins by tricking victims into clicking a malicious link that leads to a lookalike TikTok for Business page…
The Hacker News -
UK Cracks Down on Chinese Crypto Marketplace for Funding Southeast Asia Scam Hubs
The UK government has sanctioned a network of individuals and organisations allegedly linked to scam compounds in Southeast Asia, with Xinbi described as one of the region’s largest illicit online cryptocurrency marketplaces and said to have inflows of over…
Infosecurity -
TP-Link Patches High-Severity Router Vulnerabilities
TP-Link has released patches for four high-severity vulnerabilities in Archer NX router models that could be exploited to fully compromise devices, according to SecurityWeek. The bugs, tracked as CVE-2025-15517, CVE-2025-15518, CVE-2025-15519, and…
-
Google Sets 2029 Deadline for Quantum-Safe Cryptography
Google has announced its plan to migrate to post-quantum cryptography by the end of 2029, with PQC migration described as a safe, staged effort across its systems, products and services. The timeline was set out in a blog post authored by Heather Adkins,…
Dark Reading -
We Are At War
Rising geopolitical tensions are reframed as cyber operations and technology becoming politicised, with the piece arguing that we are already in a state of cyberwarfare, not merely a technical niche. It highlights state-linked campaigns and a diverse threat…
The Hacker News -
ShadowPrompt: Zero-Click Prompt Injection Chain in Anthropic’s Claude Chrome Extension
ShadowPrompt describes a zero-click prompt injection chain targeting Anthropic’s Claude Chrome extension, where simply visiting a malicious webpage could cause Claude to receive and act on an attacker-supplied prompt as if the user authored it. The core flaw…
SOCRadar -
Bogus Avast website fakes virus scan, installs Venom Stealer instead
A fake website impersonating Avast antivirus is misleading users by pretending to run virus scans and falsely claiming their systems are infected. When users attempt to 'fix' these purported threats, they unknowingly download Venom Stealer, malware designed…
Malwarebytes -
RSAC 2026 Conference Announcements Summary (Days 3-4)
RSAC 2026 Day 3–4 announcements showcase a wave of AI-enabled security innovations and new partnerships. Accenture and Anthropic unveiled Cyber[.]AI for security operations, described as using Claude as a central reasoning engine to automate workflows, with…
SecurityWeek -
Coruna iOS Exploit Kit Likely an Update to Operation Triangulation
Coruna is an iOS exploit kit that contains an updated version of a kernel exploit used in Operation Triangulation over three years ago, according to SecurityWeek’s report. It targets 23 vulnerabilities in iOS, including CVE-2023-32434 and CVE-2023-38606, two…
-
U.S. CISA adds an Aquasecurity Trivy flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an Aquasecurity Trivy flaw to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2026-33634 and CVE-2026-33017, with a CVSS score of 9.3. On 19 March 2026, attackers…
-
Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware
Bearlyfy, a pro-Ukrainian threat group also known as Labubu, has been attributed to more than 70 cyber attacks against Russian firms since it first surfaced in January 2025, with recent campaigns using a custom Windows ransomware strain codenamed…
The Hacker News -
TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package
On March 27, 2026, TeamPCP injected a WAV steganography-based credential stealer into two releases of the telnyx Python SDK on PyPI. The attack affected telnyx 4.87.1 and 4.87.2, with the latter fix introducing a casing change that altered the Windows…
StepSecurity -
LangChain, LangGraph Flaws Expose Files, Secrets, Databases in Widely Used AI Frameworks
Cybersecurity researchers disclosed three security vulnerabilities affecting LangChain and LangGraph that could expose filesystem data, environment secrets, and conversation history. The flaws enable three independent attacker paths to drain sensitive data…
-
China-linked Red Menshen APT deploys stealthy BPFDoor implants in telecom networks
China-linked Red Menshen APT has been operating a long-running espionage campaign by infiltrating telecom networks, mainly in the Middle East and Asia, with activity going back to at least 2021. Rapid7 Labs described the group as using stealthy BPFDoor…
Security AffairsRed Menshen
