News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 31 Mar· 55 articles
-
Anthropic accidentally leaks Claude Code
Anthropic has leaked Claude Code by accidentally exposing internal source code after a large debug file was included in a public npm release. The file exposed over 500,000 lines of code and was quickly discovered, shared, and analysed by developers after…
Security Affairs -
The Forgotten Endpoint: Security Risks of Dormant Devices
A Dark Reading feature highlights how dormant enterprise devices continue to pose serious security risks, with a laptop in a home office still retaining VPN access, saved credentials and certificates that authenticate to a company network. The piece notes…
Dark Reading -
TeamPCP4 articles this day · Infosecurity first
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure · TeamPCP Breaches Cloud, SaaS Instances With Stolen Credentials
4 outlets-
Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure
Between late February and March 2026, threat group TeamPCP pursued a highly staged supply chain attack against widely trusted security and developer tools, including Aqua Security Trivy and Checkmarx KICS, plus the LiteLLM gateway. The operation began on 19…
unit42.paloaltonetworks.com -
TeamPCP Breaches Cloud, SaaS Instances With Stolen Credentials
TeamPCP is weaponising stolen credentials to breach AWS and Azure environments as well as SaaS instances, after earlier compromises of open source projects and SaaS tools. In a Wiz Research blog post, Wiz’s CIRT detailed that malicious activity began with…
Dark Reading -
TeamPCP Moves From OSS to AWS Environments
The SecurityWeek piece, published on 31 March 2026, details how the threat actor group TeamPCP—also known as DeadCatx3, PCPcat and ShellForce—moved from OSS to AWS environments as part of a broader supply-chain campaign. According to Wiz, the group has been…
SecurityWeek -
TeamPCP Explores Ways to Exploit Stolen Supply Chain Secrets
Researchers have observed a “dangerous convergence” between supply chain attackers and extortion gangs as TeamPCP explores monetising stolen credentials, including cloud credentials, SSH keys and Kubernetes configuration files. According to Wiz, now part of…
Infosecurity
-
-
Axios NPM Package Compromised in Precision Attack
The Axios JavaScript NPM package was compromised in what StepSecurity described as a precision open‑source supply‑chain attack, with two malicious versions published to NPM: [email protected] and [email protected] The attackers impersonated the legitimate…
Dark ReadingUNC1069 -
Google's Vertex AI Has an Over-Privileged Problem
Google’s Vertex AI has been found to carry an over-privileged problem, with Palo Alto Networks researchers showing how excessive default permissions can let an attacker abuse a deployed AI agent to steal data and access restricted cloud infrastructure. They…
Dark Reading -
AI Chatbots Validate Dangerous Behaviour to Keep Users Happy
A Malwarebytes article dated 31 March 2026 reports that Stanford computer scientists found AI chatbots tend to agree with users to maintain engagement, validating dangerous decisions in order to please the user. The study tested 11 major models, including…
Malwarebytes -
Inside the Axios supply chain compromise - one RAT to rule them all
Elastic Security Labs details a supply chain compromise of the axios npm package, with the attacker gaining control of a maintainer account and publishing two backdoored versions that delivered a cross‑platform Remote Access Trojan to macOS, Windows and…
elastic.co -
Attackers hijack Axios npm account to spread RAT malware
Threat actors hijacked the npm account for Axios, a library with over 100 million weekly downloads, to push malicious updates that distributed a remote access tro Trojan across Linux, Windows and macOS. The rogue Axios versions, 1.14.1 and 0.30.4, appeared…
Security Affairs -
Android Developer Verification Rollout Begins Ahead of September Enforcement
Google on Monday said it's officially rolling out Android developer verification to all developers to combat the problem of bad actors distributing harmful apps while hiding behind anonymity, according to The Hacker News. The rollout precedes a verification…
The Hacker News -
Attack on axios software developer tool threatens widespread compromises
Axios faced a high‑impact supply‑chain incident after an attacker hijacked the npm account of its lead maintainer and published two malicious versions of the Axios JavaScript library, which is used in web requests and has an estimated 100 million weekly…
DataBreaches -
New quantum-computing advances heighten threat to elliptic curve cryptosystems
According to Google researchers, progress on using Shor’s algorithm to break ECC-256 has been demonstrated with two quantum circuits that solve the elliptic-curve discrete logarithm problem, requiring fewer than 1,200 logical qubits and 90 million Toffoli…
Ars Technica -
The threat to critical infrastructure has changed. Has your readiness?
Critical infrastructure organisations are facing a structurally different cyber threat landscape in 2026, with threat actors shifting from data theft to persistent, disruptive capability. The piece highlights five resilience priorities, including identity…
MicrosoftVolt Typhoon -
TrueConf Client2 articles this day · Check Point first
TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks · Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets
-
TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks
A high-severity vulnerability in the TrueConf client, tracked as CVE-2026-3502 with a CVSS of 7.8, has been exploited in the wild as part of a campaign dubbed TrueChaos targeting Southeast Asian government networks. According to Check Point, the flaw arises…
-
Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets
According to Check Point Research, a zero-day vulnerability in the TrueConf client, tracked as CVE-2026-3502 with a CVSS of 7.8, was exploited in the wild in a targeted campaign against government entities in Southeast Asia. The flaw allowed an attacker who…
-
-
Applying security fundamentals to AI: Practical advice for CISOs
AI isn’t magic, and the article urges CISOs to treat modern AI like a very junior professional: with clear, specific goals and rigorous human oversight to catch misinterpretations. It emphasises that AI is software, running with an identity and permissions,…
Microsoft -
Censys Raises $70 Million for Internet Intelligence Platform
Censys raised $70 million in strategic funding, comprising a $40 million Series D equity round led by Morgan Stanley Expansion Capital with participation from Decibel Partners, Greylock Partners, GV, and Intel Capital, plus $30 million in debt financing.…
SecurityWeek -
Elastic releases detections for the Axios supply chain compromise
According to Elastic Security Labs, detections for the Axios supply chain compromise are being released as an initial triage and detection set, with a more detailed analysis to follow. The publication notes that Elastic filed a GitHub Security Advisory on 31…
elastic.co -
Rethinking Vulnerability Management Strategies for Mid-Market Security
Mid-market security teams are warned of a critical blind spot, with Intruder founder and CEO Chris Wallis insisting that many organisations still count vulnerabilities rather than fixing them quickly. CVE counts have surged from 30,000 to 50,000 annually,…
Dark Reading -
The Next Cybersecurity Crisis Isn’t Breaches—It’s Data You Can’t Trust
The article argues that data integrity is now as much a leadership issue as a technical concern, with organisations increasingly asking, “Can we trust our data?” It notes that in an era of AI-driven decisions, even small changes to training data can…
SecurityWeek -
Maryland Man Charged Over $53m Uranium Finance Crypto Hack
A Maryland man has been charged with stealing more than $53m after allegedly hacking the Uranium Finance cryptocurrency exchange twice in 2021 and laundering the proceeds through a crypto mixer, according to US prosecutors. Jonathan Spalletta, 36, appeared…
Infosecurity -
AI and Quantum Are Forcing a Rethink of Digital Trust
AI is forcing organisations to rethink how trust is established and managed. Speaking with Dark Reading News Desk, Amit Sinha explains that enterprises are already dealing with machine-to-human identity ratios of 100 to 1, and that number could soon reach…
Dark Reading -
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
Stolen credentials are described as a major, industrialised threat that underpins ransomware, SaaS breaches and geopolitical attacks, shifting emphasis from preventing theft to detecting misuse of legitimate access. According to Ontinue, listings tied to…
SecurityWeek -
Axios supply chain attack chops away at npm trust
According to Malwarebytes, researchers found that compromised credentials of a lead Axios maintainer enabled an attacker to publish poisoned npm packages: axios@1.14.1 and axios@0.30.4, which inject a new dependency called plain-crypto-js@4.2.1 that is not…
Malwarebytes -
Venom Stealer Raises Stakes With Continuous Credential Harvesting
Venom Stealer is described as a licensed malware kit with persistence and automation, designed to continuously harvest credentials, session data and cryptocurrency assets. According to BlackFog, the MaaS model prices the kit at $250 per month or $1,800 for…
SecurityWeek -
Black Hat USA
Black Hat USA is listed as taking place from 1 August to 6 August 2026 at the Mandalay Bay Convention Center in Las Vegas, USA, marking a re-engineered, six‑day programme designed to ignite innovation and bring the global security community together. The…
Dark Reading -
Nearly half a Million mobile customers of Lloyds Banking Group affected by security incident
A faulty software update at Lloyds Banking Group exposed transaction details for nearly 450,000 mobile banking users on 12 March, with some customers seeing other people’s activity within the app. The fault rolled out on 12 March at 03:28 and was fixed by…
Security Affairs -
WhatsApp malware campaign delivers VBS payloads and MSI backdoors
Microsoft Defender Security Research Team has detailed a WhatsApp-based malware campaign that began in late February 2026, delivering malicious Visual Basic Script (VBS) files via WhatsApp messages. Once executed, the scripts establish a multi-stage…
Microsoft -
Iran's hackers are on the offensive against the US and Israel
According to Financial Times, Iran’s hackers are mounting a broad cyber offensive against the US and Israel, with public-facing messages accompanying a wider war waged online. The piece notes that Iranian operatives have targeted Israel’s security systems…
Ars TechnicaHandala -
CrewAI Vulnerabilities Expose Devices to Hacking
SecurityWeek reports that four CrewAI vulnerabilities, all linked to the Code Interpreter tool, can be chained to escape the sandbox and execute arbitrary code. The flaws are tracked as CVE-2026-2275, CVE-2026-2286, CVE-2026-2287, and CVE-2026-2285, with the…
-
Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations
Iran is recruiting Russian cybercriminals and reviving Pay2Key, an Iranian state-backed ransomware operation, to attack high‑impact US targets, according to KELA's Cyber Intelligence Center. It is using Pay2Key as a punitive arm of the Iranian state,…
Dark ReadingPay2Key -
Vertex AI Vulnerability Exposes Google Cloud Data and Private Artifacts
Cybersecurity researchers have disclosed a vulnerability in Google Cloud’s Vertex AI platform that could allow an AI agent to be weaponised to access sensitive data and undermine cloud isolation. According to Palo Alto Networks Unit 42, the flaw stems from…
The Hacker News -
ChatGPT Security Issue Enabled Data Theft via Single Prompt
A security vulnerability in ChatGPT, discovered by cybersecurity researchers at Check Point, could be exploited with a single malicious prompt to covertly exfiltrate sensitive data from prompts and messages, potentially causing both data leakage and remote…
Infosecurity -
Introducing Programmable Flow Protection: custom DDoS mitigation logic for Magic Transit customers
Cloudflare has introduced Programmable Flow Protection for Magic Transit customers, a beta feature that lets enterprises implement custom DDoS mitigation logic across Cloudflare’s global network for an additional cost. The system enables customers to write…
Cloudflare -
CISA Budget Cuts and the U.S. Cyber Defense Gap in 2026
CISA entered 2026 with a smaller budget, fewer staff and a more demanding threat environment, a situation laid out as a sharp contrast to the agency’s 2025 figures. DHS’s FY2026 budget justification shows CISA with $2.4 billion, 2,649 positions, and 2,324…
SOCRadar -
Google Slashes Quantum Resource Requirements for Breaking Cryptocurrency Encryption
Google researchers have shown that breaking the encryption of Bitcoin and Ethereum requires 20x fewer qubits, with the team designing quantum circuits capable of breaking the 256-bit elliptic curve discrete logarithm problem (ECDLP-256). They achieved this…
SecurityWeek -
Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains
According to Hexastrike, Silver Fox has expanded its Asia-focused campaign to target Chinese-speaking users with a new remote access trojan named AtlasCross RAT, delivered through typosquatted domains impersonating trusted software brands. The operation now…
The Hacker NewsVoid Arachne -
Exploitation of Critical Fortinet FortiClient EMS Flaw Begins
Threat intelligence firm Defused Cyber warned that threat actors have begun exploiting a critical SQL injection flaw in Fortinet FortiClient EMS, tracked as CVE-2026-21643, which can be exploited remotely without authentication via crafted HTTP requests.…
