News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 30 Mar· 47 articles
-
AI-Powered 'DeepLoad' Malware Steals Credentials, Evades Detection
AI-powered DeepLoad is a new malware strain that can steal credentials immediately after gaining a foothold, capturing both stored browser passwords and live keystrokes via a standalone stealer and a malicious browser extension. The researchers say the junk…
Dark Reading -
Citrix NetScaler5 articles this day · SecurityWeek first
CISA Adds CVE-2026-3055 to Known Exploited Vulnerabilities Catalogue · ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
-
CISA Adds CVE-2026-3055 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE-2026-3055 to its Known Exploited Vulnerabilities catalogue. The entry covers Citrix NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS and NDcPP appliances. Citrix NetScaler Out-of-Bounds Read Vulnerability permits memory overread…
-
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
The weekly wrap highlights a Citrix NetScaler flaw, CVE-2026-3055 with a CVSS of 9.3, described as a memory overread exploited in active campaigns as of 27 March 2026, and linked to SAML IDP configurations. In top news, the FBI confirmed that actors gained…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation, in a release dated 30 March 2026. The vulnerability listed is CVE-2026-3055, described as a Citrix NetScaler Out-of-Bounds…
-
Critical Citrix NetScaler Vulnerability Exploited in the Wild
A critical vulnerability in Citrix NetScaler ADC and NetScaler Gateway is being exploited in the wild, security researchers have confirmed. The flaw, CVE-2026-3055, is a critical out-of-bounds read with a CVSS v4.0 score of 9.3 that arises from insufficient…
-
Exploitation of Fresh Citrix NetScaler Vulnerability Begins
Exploitation of a fresh critical-severity Citrix NetScaler vulnerability has begun in the wild, CVE-2026-3055, which carries a CVSS score of 9.3 and was described by Citrix as an out-of-bounds read issue. Appliances configured as a SAML Identity Provider and…
-
-
Aquasecurity Trivy2 articles this day · SANS ISC first
10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions · TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released, (Mon, Mar 30th)
-
10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions
In March 2026, StepSecurity outlined how TeamPCP weaponised 76 Trivy version tags overnight, with the second Trivy compromise (CVE-2026-33634, CVSS 9.4) following days later and affecting 76 of 77 version tags in aquasecurity/trivy-action. The attackers…
-
TeamPCP Supply Chain Campaign: Update 004 - Databricks Investigating Alleged Compromise, TeamPCP Runs Dual Ransomware Operations, and AstraZeneca Data Released, (Mon, Mar 30th)
This update consolidates intelligence from 28–30 March 2026, two days since the previous diary entry, and notes Databricks is investigating an alleged compromise linked to TeamPCP’s credential harvest. It confirms that TeamPCP now operates two parallel…
-
-
F5 BIG-IP2 articles this day · ncsc.gov.uk first
Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitation · Vulnerability affecting F5 BIG-IP APM
-
Fortinet BIG-IP Vulnerability Reclassified as RCE, Under Exploitation
Fortinet’s BIG-IP vulnerability, CVE-2025-53521, has been reclassified from a high-severity DoS flaw to an remote code execution (RCE) vulnerability with a 9.8 CVSS score, and is currently being exploited in the wild. The flaw was first disclosed and patched…
-
Vulnerability affecting F5 BIG-IP APM
The NCSC has issued an alert regarding a critical vulnerability (CVE-2025-53521) in F5 BIG-IP Access Policy Manager, which could lead to unauthenticated remote code execution. All organizations using this system are advised to take swift action, including…
-
-
China-Linked groups target Southeast Asian government with advanced malware in 2025
In 2025, three China-linked threat clusters targeted a Southeast Asian government in a complex, well-funded cyber operation, deploying a range of malware families including HIUPAN, PUBLOAD, EggStremeFuel/Loader, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis…
Security Affairs -
OpenAI Patches ChatGPT Data Exfiltration Flaw and Codex GitHub Token Vulnerability
According to Check Point, a previously unknown vulnerability in OpenAI ChatGPT allowed sensitive conversation data to be exfiltrated without user knowledge, with a single malicious prompt capable of turning a normal chat into a covert leakage channel. OpenAI…
The Hacker News -
Manufacturing and Healthcare Share Struggles with Passwords
Manufacturing and healthcare face shared security weaknesses rooted in password hygiene, with insiders viewing access management as a roadblock and attackers seeing it as a route in. The piece notes that both sectors contend with legacy technology, downtime…
Dark Reading -
Addressing the OWASP Top 10 Risks in Agentic AI with Microsoft Copilot Studio
Agentic AI is moving from pilots to production, which reshapes the security conversation as these systems can retrieve sensitive data, invoke tools, and act with real identities and permissions. The OWASP Top 10 for Agentic Applications (2026) outlines ten…
Microsoft -
DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials
DeepLoad malware uses the ClickFix social engineering tactic to distribute a previously undocumented loader and steal browser credentials, according to ReliaQuest researchers Thassanai McCabe and Andrew Currie. The campaign starts with a ClickFix lure that…
The Hacker News -
Storm Brews Over Critical, No-Click Telegram Flaw
Storm Brews Over Critical, No-Click Telegram Flaw reports that the vulnerability, allegedly triggered by a corrupted sticker in Telegram, carries a 9.8 CVSS score and was identified by Michael DePlante of the Trend Micro Zero Day Initiative (ZDI), which…
Dark Reading -
Cybercriminals Exploit Tax Season With New Phishing Tactics
A wave of tax-themed cyber campaigns delivering malware, remote access tools, fraud schemes and credential phishing has been detected in early 2026. Proofpoint researchers identified more than a hundred such operations, highlighting how attackers continue to…
InfosecurityTA2730 -
macOS Tahoe 26.4 Will Block Terminal Paste Attacks by ClickFix Scammers
Malwarebytes reports that Apple is adding a new macOS security feature that will warn users when they paste certain commands into the Terminal, as part of efforts to combat ClickFix attacks. The feature will be available for macOS Tahoe 26.4 and will display…
Malwarebytes -
Healthcare IT Platform CareCloud Probing Potential Data Breach
Healthcare IT platform CareCloud has disclosed a cybersecurity incident that may have affected patient information in one of its electronic health record environments. In a March 27 filing with the SEC, the company said its network was temporarily disrupted…
SecurityWeek -
Silent Drift: How LLMs Are Quietly Breaking Organizational Access Control
LLMs are increasingly used to generate policy as code for organisational security, compliance and operations, with the model producing enforcement logic in languages such as Rego or Cedar in seconds. But the article notes that policies can be syntactically…
SecurityWeek -
It’s a mystery … alleged unpatched Telegram zero-day allows device takeover, but Telegram denies
A researcher from TrendAI Zero Day disclosed a vulnerability tracked as ZDI-CAN-30207, described as a zero-click remote code execution flaw with a CVSS score of 9.8 that could allow attackers to take full control of targeted Android and Linux devices simply…
Security Affairs -
Lloyds IT Glitch Exposed Data of Nearly 500,000 Banking Customers
Lloyds Banking Group confirmed a software defect during an overnight system update exposed the personal data of up to 447,936 customers, after an IT glitch allowed users to see other customers' transactions and account information. The incident occurred on…
Infosecurity -
ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime
Check Point Research disclosed a hidden outbound communication path from ChatGPT’s isolated execution runtime to the public internet, enabling silent exfiltration of chat content, uploaded files, and other sensitive data. They showed how a single malicious…
Check Point -
3 SOC Process Fixes That Unlock Tier 1 Productivity
The piece outlines three SOC process fixes to unlock Tier 1 productivity. Process #1 advocates replacing tool switching with one cross-platform investigation workflow, emphasising unified observation across Windows, macOS, Linux and Android using ANY[.]RUN…
The Hacker News -
Huskeys Emerges From Stealth With $8 Million in Funding
Huskeys, an Israeli cybersecurity startup, has emerged from stealth with $8 million in seed funding, the company said. Founded in 2025 by Itai Gafni and Roy Weisfeld in Tel Aviv, Huskeys has developed an edge security management platform that adds an agentic…
SecurityWeek -
Estonian hospital sends patient home with other peoples’ health data
A patient who underwent X-ray imaging at West Tallinn Central Hospital (LTKH) was sent home with a USB drive that also contained the personal and health data of other patients, according to ERR News. ERR has received information about a visit to the hospital…
DataBreaches -
DeepLoad Malware Combines ClickFix With AI-Generated Code to Avoid Detection
DeepLoad is a malware campaign that blends ClickFix delivery with AI-generated evasion techniques to steal enterprise user accounts and passwords. The campaign, detailed by ReliaQuest researchers who warned on 30 March 2026 that it represents an immediate…
Infosecurity -
Russian APT Star Blizzard Adopts DarkSword iOS Exploit Kit
A Russian state-sponsored hacking group tracked as Star Blizzard has adopted the DarkSword iOS exploit kit in an ongoing campaign, according to SecurityWeek. The Atlantic Council-themed operation has targeted government, higher education, financial, and…
SecurityWeek -
Alleged Crypto Leads, Android Spyware, Mossad Leak, Binance Data, Nakamura Listing
According to SOCRadar Dark Web Team, several new underground posts this week include a global “crypto leads” dataset advertised for sale, an Android spyware listing, and claims of a Mossad-related database leak. The Alleged Crypto Leads Dataset is said to…
SOCRadar -
The State of Secrets Sprawl 2026: 9 Takeaways for CISOs
Secrets sprawl is accelerating faster than many teams can keep up, with leaked secrets rising 152% since 2021 while GitHub’s public developer base grew 98%, according to GitGuardian's State of Secrets Sprawl 2026 report. The study notes AI services drove 81%…
The Hacker News -
European Commission Reports Cyber Intrusion and Data Theft
The European Commission said it was targeted in a cyberattack that affected its cloud infrastructure hosting the Europa[.]eu platform, though its public websites were not disrupted. Early findings described data being taken from those websites, with the…
SecurityWeek -
South African government agency and Spanish psychological software provider victims of cyberattacks by XP95
Statistics South Africa is described as the latest government entity to fall victim to a ransomware attack by the emerging cybercrime group XP95, which claims to have obtained 453,362 files amounting to 154 GB. XP95 has previously attacked Gauteng Province,…
DataBreaches -
Hacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in Warfare
Hacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in Warfare reports that Iran-linked hacking groups are conducting high-volume, low-impact cyberattacks, with AI boosting capabilities and disinformation spreading as part of…
SecurityWeek -
Telnyx Targeted in Growing TeamPCP Supply Chain Attack
Two malicious versions of the Telnyx Python SDK, 4.87.1 and 4.87.2, were uploaded to the PyPI registry, targeting Windows, macOS and Linux systems. The campaign, described as TeamPCP’s weeks-long supply chain operation, began on 19 March and progressed…
SecurityWeek -
Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
A critical Fortinet FortiClient EMS vulnerability, tracked as CVE-2026-21643 with a CVSS score of 9.1, is being actively exploited and allows remote code execution via SQL injection. The issue is described as an improper neutralisation of special elements…
-
Russian CTRL Toolkit Steals PINs via Fake Private Key Shortcuts
Cybersecurity researchers have identified a remote access toolkit of Russian origin, dubbed the CTRL toolkit, distributed via malicious Windows shortcut (LNK) files masquerading as a private key folder. The toolkit, according to Censys, is built with .NET…
The Hacker News -
ICO Fines UK Nuisance Call Scammers £100,000
A Birmingham-based provider of monitored alarms, TMAC, has been fined £100,000 by the Information Commissioner’s Office after staff used false identities on marketing sales calls. TMAC made over 260,000 nuisance calls to numbers registered on the Telephone…
Infosecurity -
Inside Handala’s Hack on the FBI Director
Handala, a hacktivist group believed to be state-backed by Iran, breached the personal Gmail account of FBI Director Kash Patel, the group announced on 27 March 2026. According to the FBI, the breach was contained in that the compromised data was historical…
SOCRadar -
European Commission Confirms Cloud Data Breach
The European Commission has admitted that hackers may have taken data from the cloud infrastructure hosting its Europa[.]eu platform, with the executive body releasing a statement on 27 March confirming it had discovered the cyber-attack on 24 March and…
Infosecurity -
FBI Confirms Kash Patel Email Hack as US Offers $10M Reward for Hackers
According to the FBI, threat actors gained access to an email account belonging to FBI Director Kash Patel, though no government information is believed to have been compromised and the hacked account is a personal Gmail one. Handala, an Iran-linked hacker…
SecurityWeek
