News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 2 Apr· 45 articles
-
CISA Adds CVE-2026-3502 to Known Exploited Vulnerabilities Catalogue
CISA has added CVE-2026-3502 to its Known Exploited Vulnerabilities (KEV) catalogue. The entry affects TrueConf Client and concerns the TrueConf Client Download of Code Without Integrity Check Vulnerability. This flaw allows an attacker who compromises the…
-
Not Toying Around: Hasbro Attack May Take 'Weeks' to Remediate
Hasbro disclosed in an 8-K filing with the Securities and Exchange Commission that on 28 March it detected unauthorized access in its network and has activated business continuity plans to keep taking orders and shipping products while it resolves the…
Dark Reading -
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials
According to Cisco Talos, a large-scale credential harvesting operation exploited CVE-2025-55182 as an initial infection vector to target Next[.]js applications and harvest a wide range of credentials and secrets. The activity has compromised at least 766…
-
Security Bosses Are All-In on AI. Here's Why
Security bosses are all-in on AI, with CISOs bullish on future tools and planning broader rollouts, according to Dark Reading. The April 2, 2026 piece notes that Reddit’s CISO Frederick Lee and analyst Dave Gruber discuss how AI, including LLMs and machine…
Dark Reading -
Hasbro hit by cyberattack, investigates possible data breach
Hasbro reported a cyberattack that disrupted some operations and is investigating the full extent of the incident, including whether any files or sensitive data were compromised. The firm detected unauthorized access on 28 March 2026, quickly activated its…
Security Affairs -
Critical Vulnerability in Claude Code Emerges Days After Source Leak
The article discusses two significant issues regarding Anthropic's Claude Code: a recent source code leak and the discovery of a critical vulnerability. 1. **Claude Code Leak**: On March 31, 2026, a debugging JavaScript sourcemap for Claude Code v2.1.88 was…
SecurityWeek -
Cisco Enterprise NFV Infrastructure Software2 articles this day · The Hacker News first
Cisco fixed critical and high-severity flaws · Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise
-
Cisco fixed critical and high-severity flaws
Cisco has released patches for two critical and six high-severity vulnerabilities, which could allow attackers to bypass authentication, run code, escalate privileges, and access sensitive data. One of the critical flaws, CVE-2026-20093 with a CVSS score of…
-
Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise
Cisco has issued fixes for a critical IMC flaw, CVE-2026-20093, which could allow an unauthenticated, remote attacker to bypass authentication and gain elevated privileges, potentially changing any user password and accessing the system as that user, with a…
-
-
New Rowhammer attacks give complete control of machines running Nvidia GPUs
Two new Rowhammer attacks give complete control of machines running Nvidia GPUs, with demonstrated exploits against two Ampere-generation cards: the RTX 6000 and the RTX 3060. The researchers describe GDDRHammer and GeForge as capable of flipping bits in GPU…
Ars Technica -
Apple Rolls Out DarkSword Exploit Protection to More Devices
Apple is extending protection against the DarkSword exploit by rolling out the latest iOS 18 version (18.7.7) to more devices, as announced on 1 April 2026. The update, which includes the DarkSword patches, addresses two dozen security flaws that could allow…
SecurityWeek -
Threat actor abuse of AI accelerates from tool to cyberattack surface
Threat actors are embedding AI across reconnaissance, malware development and post‑compromise operations, accelerating both the tempo and scale of attacks while keeping the objective of credential theft, financial gain and espionage. Email remains the…
Microsoft -
RSAC 2026: AI Dominates, But Community Remains Key to Security
RSAC 2026 saw AI take centre stage, with experts weighing automation and governance while emphasising the enduring value of human oversight. The event’s official theme was “The Power of Community,” yet attendees noted a conspicuous absence of the US federal…
Dark Reading -
Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments
Threat actors are increasingly abusing HTTP cookies as a control channel for PHP-based webshells on Linux servers, allowing malicious code to gate execution and activate functionality only when attacker-supplied cookie values are present. According to…
Microsoft -
Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208), (Thu, Apr 2nd)
Published on 2 April 2026, the diary notes attempts to exploit CVE-2025-30208 in Vite, a frontend build tool described as a new breed that improves development efficiency. From honeypot activity, attackers are targeting exposed Vite installs on port 5173,…
-
Cybersecurity M&A Roundup: 38 Deals Announced in March 2026
SecurityWeek reports that 38 cybersecurity-related merger and acquisition deals were announced in March 2026, with notable activity from Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7 and OpenAI. The piece notes that Google completed its $32 billion…
SecurityWeek -
Geopolitics, AI, and Cybersecurity: Insights From RSAC 2026
RSAC 2026 highlighted how geopolitics, AI and private-sector innovation are reshaping cybersecurity, with discussions centred on adapting to rapid technological change and geopolitical uncertainty. The interview format with Becky Bracken and colleagues…
Dark Reading -
NCSC Issues Security Alert Over Hackers Targeting WhatsApp and Signal Accounts
The UK’s National Cyber Security Centre (NCSC) has warned of an uptick in targeted attacks against individuals using messaging apps such as WhatsApp, Facebook Messenger and Signal. According to the NCSC, there has been “growing malicious activity from…
InfosecurityAPT31 -
New 'Storm' Infostealer Remotely Decrypts Stolen Credentials
Security researchers at Varonis have uncovered a new information stealer strain called Storm that harvests browser credentials, session cookies and crypto wallets before quietly sending everything to the attacker's server for decryption, enabling remote…
Infosecurity -
Apple expands “DarkSword” patches to iOS 18.7.7
Apple widened its latest iOS 18 security update to cover more devices, specifically to stop DarkSword attacks that can compromise a device from a single website visit. After researchers published findings about DarkSword and an exploit kit appeared on…
Malwarebytes -
Threat actor UAC-0255 impersonate CERT-UA to spread AGEWHEEZE malware via phishing
Threat actor UAC-0255 impersonated CERT-UA in a phishing campaign to spread the AGEWHEEZE remote access tool, sending emails to about 1 million users. Victims were urged to download a password-protected archive from Files[.]fm and install a fake “specialized…
Security AffairsUAC-0255 -
vSphere and BRICKSTORM Malware: A Defender's Guide
This guide discusses the increasing threats posed by BRICKSTORM malware against VMware vSphere environments, particularly targeting the vCenter Server Appliance (VCSA) and ESXi hypervisors. It emphasizes the need for robust security measures due to the…
Google Cloud -
CVE-2026-5281: Chrome WebGPU Zero-Day Exploited In The Wild
Google has patched CVE-2026-5281, a high-severity use-after-free vulnerability in Dawn, Chromium’s WebGPU implementation, with exploitation in the wild confirmed and the bug added to the Known Exploited Vulnerabilities catalog by CISA. Google’s release notes…
-
Apple Expands iOS 18 Security Updates Amid DarkSword Threat
Apple has expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to more devices to protect users from the DarkSword exploit kit, a hacking tool used in targeted cyber-attacks, according to Infosecurity Magazine. The update allows devices still running…
Infosecurity -
Bank Trojan 'Casbaneiro' Worms Through Latin America
Brazilian threat actors are targeting Spanish-speaking countries with highly wormable and elusive infection techniques to steal banking credentials, according to the article. The campaign is linked to Water Saci, also known as Augmented Marauder, which is…
Dark ReadingWater Saci -
First Malwarebytes VPN audit uncovers critical infrastructure flaws
Malwarebytes Labs reports that Malwarebytes Privacy VPN has undergone its first full third‑party audit, released on 2 April 2026. The audit, conducted by the penetration testing firm X41 D-Sec, assessed the infrastructure behind Malwarebytes Privacy VPN and…
Malwarebytes -
Researchers Observe Sub-One-Hour Ransomware Attacks
Security researchers have warned of a rapid acceleration in ransomware velocity, with the Akira group reportedly completing all stages of an attack within an hour. Halcyon’s new report states Akira usually achieves initial access by exploiting…
InfosecurityStorm-1567 -
GitHub Used as Covert Channel in Multi-Stage Malware Campaign
A multi-stage malware campaign targeting users in South Korea has been detected using GitHub as a covert command and control infrastructure, with the attack chain beginning from LNK files that fetch PowerShell commands from GitHub. According to Fortinet,…
Infosecurity -
Why we're rethinking cache for the AI era
Cloudflare reports that 32% of traffic across its network is automated, including AI assistants that perform retrieval-augmented generation to support real-time services and to harvest data for training datasets. AI crawlers account for 80% of…
Cloudflare -
ThreatsDay Bulletin: Pre-Auth Chains, Android Rootkits, CloudTrail Evasion & 10 More Stories
The ThreatsDay Bulletin flags a pre-authenticated remote code execution chain in Progress ShareFile, comprising CVE-2026-2699 and CVE-2026-2701, which could be combined to bypass authentication and upload web shells; Progress released fixes with Storage Zone…
-
BLACKNET-00: The Ransomware-as-a-Service Platform That Weaponizes Mediocrity
Infrastructure Destruction Squad has announced BLACKNET-00, a fully GUI-driven ransomware builder available for $500 via Telegram, designed so zero programming knowledge is required to operate. The platform combines layered encryption (AES-256, RSA,…
SOCRadarInfrastructure Destruction Squad -
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco on Wednesday announced fixes for two critical and six high-severity vulnerabilities that could be exploited for authentication bypass, remote code execution, privilege escalation, and information disclosure. One of the critical bugs, tracked as…
-
250,000 Affected by Data Breach at Nacogdoches Memorial Hospital
Nacogdoches Memorial Hospital disclosed that 250,000 people had personal and health information compromised in a data breach that occurred on 31 January. According to the hospital, a threat actor hacked into its internal network and information systems, with…
SecurityWeek -
Researchers Uncover Mining Operation Using ISO Lures to Spread RATs and Crypto Miners
A financially motivated operation codenamed REF1695 has been observed since November 2023, using fake installers to deploy remote access Trojans and cryptocurrency miners. According to Elastic Security Labs researchers Jia Yu Chan, Cyril François, and Remco…
The Hacker NewsREF1695 -
The State of Trusted Open Source Report
According to Chainguard, December 2025 saw the first-ever The State of Trusted Open Source report, analysing open source usage across its container image projects, versions, images, language libraries and builds, and the vulnerabilities these projects…
The Hacker News -
Mercor Hit by LiteLLM Supply Chain Attack
Mercor, an AI recruiting firm, said it was impacted by the LiteLLM supply chain attack after extortionists claimed the theft of 4TB of Mercor data. The incident occurred on March 27 and is linked to the Trivy supply chain attack that was mounted a week…
SecurityWeek -
Sophisticated CrystalX RAT Emerges
A new malware-as-a-service (MaaS) called CrystalX RAT has been promoted on Telegram, described as combining spyware, a stealer and remote access capabilities. According to SecurityWeek’s coverage, CrystalX emerged in January, initially offered as Webcrystal…
SecurityWeek -
WhatsApp Alerts 200 Users After Fake iOS App Installed Spyware; Italian Firm Faces Action
WhatsApp said it alerted about 200 users who were deceived into installing a bogus iOS version of WhatsApp that was infected with spyware, with most targets located in Italy. According to La Repubblica and ANSA, the operation used social engineering to…
The Hacker NewsAsigint -
Most CNI Firms Face Up to £5m in Downtime from OT Attacks
According to e2e-assure, 80% of critical national infrastructure (CNI) providers in the UK face downtime costs of between £100,000 and £5m from cyber-attacks that disrupt their OT environments. The firm polled 250 cybersecurity decision makers across sectors…
Infosecurity -
Variance Raises $21.5M for Compliance Investigation Platform Powered by AI Agents
Variance has disclosed $21.5 million in new Series A funding, bringing its total raised to $26 million, with the round led by Ten Eleven Ventures and participation from 645 Ventures, Y Combinator, Urban Innovation Fund and Okta Ventures. The funding will be…
SecurityWeek -
Italian spyware vendor creates Fake WhatsApp app, targeting 200 users
WhatsApp has uncovered a malicious fake version of its app developed by Italian firm Asigint, a subsidiary of SIO Spa, targeting roughly 200 users, most of them in Italy. The unofficial client contained spyware and was not available in official stores such…
Security Affairs
