News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 1 Apr· 47 articles
-
Google Dawn5 articles this day · The Hacker News first
U.S. CISA adds a flaw in Google Dawn to its Known Exploited Vulnerabilities catalog · CISA Adds CVE-2026-5281 to Known Exploited Vulnerabilities Catalogue
-
U.S. CISA adds a flaw in Google Dawn to its Known Exploited Vulnerabilities catalog
The U.S. CISA added a flaw in Google Dawn to its Known Exploited Vulnerabilities catalog, tracking CVE-2026-5281 with a CVSS of 8.8. The flaw is a use-after-free in the Dawn component of Google Chrome prior to 146.0.7680.178, with Dawn described as the…
-
CISA Adds CVE-2026-5281 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE-2026-5281 to its Known Exploited Vulnerabilities (KEV) catalogue. The entry concerns Google Dawn, an open-source WebGPU implementation utilised in Chromium-based browsers. Google Dawn contains a use-after-free vulnerability that could…
-
Google fixes fourth actively exploited Chrome zero-day of 2026
Google has issued updates to Chrome to fix 21 vulnerabilities, including a new actively exploited zero-day tracked as CVE-2026-5281 in the WebGPU Dawn component used for graphics processing. The flaw is a use-after-free bug, and Google notes the exploit…
-
Exploited Zero-Day Among 21 Vulnerabilities Patched in Chrome
Google has issued Chrome 146 to fix 21 vulnerabilities, including a zero-day that has been exploited in the wild, CVE-2026-5281, described as a use-after-free in Dawn, Chrome’s graphics layer. According to Google’s advisory, the update patches 19…
-
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation — Patch Released
Google has released security updates for Chrome to address 21 vulnerabilities, including a zero-day flaw, CVE-2026-5281, that is being exploited in the wild. The flaw concerns a use-after-free in Dawn, the WebGPU implementation, and Google says,…
-
-
Ransomware Will Hit Hospitals. Rehearsals Are Key to Defense
Ransomware will hit hospitals, and rehearsals are key to defence, according to RSAC 2026 Conference. Joseph Izzo, chief medical information officer for San Joaquin General Hospital, described how he trained during a downtime period to practise responding and…
Dark Reading -
Wikipedia’s AI agent row likely just the beginning of the bot-ocalypse
Wikipedia’s AI agent row is described as potentially the start of a broader bot-ocalypse after an AI named Tom-Assistant was banned from creating Wikipedia articles. Its creator, Bryan Jacobs, CTO at AI-powered financial modelling company Covexent, told 404…
Malwarebytes -
Prioritizing Alerts Triage with Higher-Order Detection Rules
According to Elastic Security Labs, Higher-Order Rules are used to prioritise alerts by correlating signals across data sources and time to reduce manual triage effort. The article notes that even when considering only non Building Block Rules, 65 unique…
elastic.co -
Mitigating the Axios npm supply chain compromise
On 31 March 2026, two malicious Axios npm packages, versions 1.14.1 and 0.30.4, were released and connected to a known Sapphire Sleet command-and-control (C2) domain, sfrclak[.]com, to retrieve a second-stage remote access trojan (RAT) payload. According to…
MicrosoftSTARDUST CHOLLIMA -
LatAm's Self-Taught Cyber Talent Overlooked Amid Cyberattack Glut
To hire cybersecurity professionals, companies in Latin America face a mandate to broaden their search and tap into underutilised regional talent, Ekoparty's newly released jobs report suggests. The report, based on a survey of 605 Latin American…
Dark Reading -
Threat Brief: Widespread Impact of the Axios Supply Chain Attack
According to Unit 42, the Axios supply chain attack involved two compromised Axios versions, v1.14.1 and v0.30.4, in which the malicious actor injected a runtime dependency named plain-crypto-js (version 4.2.1) without modifying Axios source code. The…
unit42.paloaltonetworks.comWAVESHAPER -
Cyberattacks Intensify Pressure on Latin American Governments
Government organisations in Latin America and the Caribbean are contending with a surge of attacks on critical agencies that far outpace global trends, including a national health ministry breach in Colombia and a cyber incident in Puerto Rico’s transport…
Dark Reading -
Depthfirst Raises $80 Million in Series B Funding
According to SecurityWeek, software security startup Depthfirst has raised $80 million in Series B funding, bringing total raised to $120 million in less than three months since its Series A in mid-January. The funding round was led by Meritech Capital, with…
SecurityWeek -
CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
According to CERT-UA, the Computer Emergency Response Team of Ukraine, a phishing campaign impersonating CERT-UA distributed a remote access tool known as AGEWHEEZE. The threat actors, tracked as UAC-0255, sent messages on 26 and 27 March 2026, urging…
The Hacker NewsUAC-0255 -
Toy Giant Hasbro Hit by Cyberattack, Weeks of Delays
Hasbro, the toy and game company, disclosed in a filing with the SEC that it was hit by a cyberattack, with unauthorized access detected on 28 March 2026 and several systems taken offline as part of incident response. The company is conducting an…
SecurityWeek -
New DeepLoad Malware Dropped in ClickFix Attacks
New DeepLoad malware has been discovered, capable of stealing credentials, intercepting browser interactions, installing a rogue browser extension, and spreading via USB drives, according to SecurityWeek’s reporting. Dubbed DeepLoad, the threat first emerged…
SecurityWeek -
Google Introduces Android Dev Verification Amid Openness Debate
Google has started the rollout of a new Android developer verification system intended to reduce malicious apps and bolster platform security, with global enforcement planned in the coming years. The scheme requires developers to verify their identity and…
Infosecurity -
Venom Stealer MaaS Platform Commoditizes ClickFix Attacks
Venom Stealer MaaS Platform Commoditizes ClickFix Attacks describes a newly distributed malware-as-a-service platform that automates every step of the social engineering technique behind ClickFix attacks. A developer operating under the name VenomStealer is…
Dark Reading -
Trivy-Linked Cisco Breach & ShinyHunters’ Stolen Data Claim
Cisco’s internal development and build environment breach is being tied to the March 2026 Trivy supply chain compromise, with AWS keys allegedly stolen and more than 300 GitHub repositories cloned, according to Aqua Security. The Trivy fallout has been…
SOCRadarShinyHunters -
WhatsApp on Windows users targeted in new campaign, warns Microsoft
Microsoft researchers found a campaign that abuses WhatsApp attachments to sneak a script onto Windows machines, which will lead to the attacker gaining remote control, according to Microsoft. The attack chain starts with a WhatsApp attachment that looks…
Malwarebytes -
FBI Warns of Data Security Risks From China-Made Mobile Apps
The FBI has warned of data security risks from China-made mobile apps, highlighting that many top-grossing and widely downloaded apps in the US are developed by foreign companies, notably those from China. The alert notes that apps involved in digital…
SecurityWeek -
Google Attributes Axios npm Attack to North Korean UNC1069 Hackers
Google has attributed the Axios npm supply chain compromise to a North Korean threat group tracked as UNC1069. The attribution, according to Google Threat Intelligence Group, notes WAVESHAPER.V2 as an updated version of WAVESHAPER previously used by UNC1069…
Security AffairsUNC1069 -
US Charges Uranium Crypto Exchange Hacker
Jonathan Spalletta, a 36-year-old US national from Rockville, Maryland, has been charged in connection with hacking the Uranium Finance decentralised exchange and causing its shutdown. He allegedly exploited smart contract vulnerabilities at Uranium on two…
SecurityWeek -
New Venom Stealer MaaS Platform Automates Continuous Data Theft
A new malware-as-a-service (MaaS) platform dubbed Venom Stealer that automates credential theft and continuous data exfiltration has been identified by cybersecurity researchers. The platform is being sold on cybercrime networks and is designed to go beyond…
Infosecurity -
Webinar Today: Agentic AI vs. Identity’s Last Mile Problem
Agentic AI is reshaping identity security by autonomously planning, adapting, and executing controls across the enterprise, according to SecurityWeek. But the last mile of identity, tied to disconnected applications and manual processes, remains where…
SecurityWeek -
TeamPCP Supply Chain Campaign: Update 005 - First Confirmed Victim Disclosure, Post-Compromise Cloud Enumeration Documented, and Axios Attribution Narrows, (Wed, Apr 1st)
According to Elastic Security Labs, the axios npm compromise has been attributed to UNC1069, a suspected North Korean threat actor, narrowing the attribution to a DPRK-led operation while the exact token acquisition method remains unconfirmed. Mercor AI…
SANS ISC -
Why we’re still not doing April Fools’ Day
Malwarebytes Labs notes that people lost an estimated $442 billion to scams worldwide last year, according to the Global Anti-Scam Alliance. Their research found that 44% of people say they encounter mobile scams every single day, with two in three finding…
Malwarebytes -
Introducing EmDash — the spiritual successor to WordPress that solves plugin security
EmDash is presented as the spiritual successor to WordPress, written entirely in TypeScript and designed to be serverless while runnable on any hardware or platform. Plugins run in their own isolated sandbox using Dynamic Workers, with capabilities declared…
Cloudflare -
Our ongoing commitment to privacy for the 1.1.1.1 public DNS resolver
Cloudflare marks 1 April 2026 as exactly eight years since launching the 1.1.1[.]1 public DNS resolver and highlights a continued commitment to privacy, reinforced by an independent privacy examination conducted by a Big 4 accounting firm. The examination,…
Cloudflare -
Block the Prompt, Not the Work: The End of "Doctor No"
In Block the Prompt, Not the Work: The End of "Doctor No", The Hacker News argues that security teams are trapped by a habit of blocking tools rather than protecting what users actually do, a pattern the piece calls the “Theatrical Security” approach. It…
The Hacker News -
Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures
A multi-pronged phishing campaign is targeting Spanish-speaking users in organisations across Latin America and Europe to deliver Windows banking trojans like Casbaneiro (aka Metamorfo) via Horabot, an approach attributed to a Brazilian threat actor tracked…
The Hacker NewsAugmented Marauder -
Chinese Hackers Target European Governments in Espionage Campaigns
According to Proofpoint researchers, the Chinese state-backed group TA416 has reemerged after a quiet period, launching a fresh wave of cyber espionage campaigns against European governments with activity detected in mid-2025. The campaigns targeted EU and…
InfosecurityMUSTANG PANDA -
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass
Microsoft is warning of a WhatsApp-delivered malware campaign that uses Visual Basic Script (VBS) files to initiate a multi-stage infection on Windows and establish persistence, beginning in late February 2026. The attackers distribute malicious VBS files…
The Hacker News -
3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)
According to The Hacker News, attackers are shifting from writing malware to abusing what’s already inside organisations, using trusted tools, native binaries and legitimate admin utilities to move laterally, escalate privileges and persist without…
The Hacker News -
Malicious Script That Gets Rid of ADS, (Wed, Apr 1st)
According to Xavier Mertens, the diary explains how some malware uses a Run key to execute a file at boot by placing a copy of itself in %APPDATA%\\Microsoft\\Windows\\Templates\\dwm[.]cmd and then deleting the Zone[.]Identifier ADS via a PowerShell…
SANS ISC -
Are We Training AI Too Late?
Are We Training AI Too Late? argues that intelligence used to train security models is often built on post-incident data, which reflects attacker behaviour only after activity has been confirmed. Nishawn Smagh of GreyNoise notes that detection models rely on…
Dark Reading -
CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCE
CVE-2025-53521 concerns F5 BIG-IP Access Policy Manager (APM), which was initially treated as a denial-of-service issue in 2025 but has been reclassified as a potential unauthenticated remote code execution (RCE) under certain configurations. The…
-
Eight in 10 UK Manufacturers Hit by Cyber Incident in a Year
The Infosecurity Magazine piece reports that 78% of UK manufacturers suffered a serious cyber incident in the past year, according to new data from ESET, with 500 senior decision-makers polled across IT, OT, operations, risk and security roles. Almost all…
Infosecurity -
Hackers Hijack Axios npm Package to Spread RATs
Threat actors targeted an open source maintainer to hijack one of the most popular npm packages and spread remote access Trojans (RATs), with Axios described as a JavaScript library downloaded over 100 million times a week and used as a dependency in…
Infosecurity -
SentinelOne autonomous detection blocks trojaned LiteLLM triggered by Claude Code
SentinelOne’s AI-based security blocked a LiteLLM supply chain attack in seconds, with its macOS agent detecting and stopping a malicious process chain triggered by Claude Code after a compromised LiteLLM package was unknowingly installed. The autonomous…
Security Affairs
