News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 6 Apr· 46 articles
-
Meta React Server Components2 articles this day · Dark Reading first
Kubernetes token theft jumps 282% amid rising IT sector attacks · Automated Credential Harvesting Campaign Exploits React2Shell Flaw
-
Kubernetes token theft jumps 282% amid rising IT sector attacks
Kubernetes is presented as a high‑value target for adversaries, with Unit 42 noting that threat actor operations involving Kubernetes tokens increased by 282% over the last year and that the IT sector accounted for over 78% of observed activity. According to…
-
Automated Credential Harvesting Campaign Exploits React2Shell Flaw
A global cross-industry credential theft campaign is exploiting public-facing Web applications vulnerable to React2Shell and then deploying an automated collection tool to steal credentials and other valuable system data, researchers say. The campaign,…
-
-
Iran MOIS Links Handala, Karma, Justice in Unified Cyber Ops
Published on 6 April 2026, Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment describes a single, coordinated cyber influence ecosystem aligned with Iran’s Ministry of Intelligence and Security (MOIS), not a collection of…
dti.domaintools.comHomeLand Justice -
AI driven GitHub attack hijacks pull requests, exposing NPM tokens
A Wiz analysis shows that the AI-assisted campaign, tracked as prt-scan, targeted repositories configured with GitHub’s pull_request_target workflow trigger, in what appears to be a broad, automated operation. The activity was first spotted on 2 April 2026,…
Dark Reading -
Cloudflare launches Organizations beta for enterprise management
Cloudflare’s latest feature, Organizations, is being introduced in beta to help enterprises manage Cloudflare at scale. The beta rollout is public and will unfold over the next several days for enterprise customers, with the aim of providing a cohesive way…
Cloudflare -
UNC10693 articles this day · SecurityWeek first
North Korean hackers compromise Axios NPM via social engineering · North Korea hackers hijack Axios npm package, push WAVESHAPER.V2
3 outlets-
North Korean hackers compromise Axios NPM via social engineering
The Axios attack has highlighted the sophistication, scalability and industrialisation of social engineering campaigns, with attackers targeting open source maintainers and their networks. Late last month, the NPM package Axios was compromised in a social…
Dark Reading -
North Korea hackers hijack Axios npm package, push WAVESHAPER.V2
In The Hacker News’ weekly recap, Axios’s npm package was compromised by threat actors linked to North Korea, with UNC1069 claiming responsibility for seizing the lead maintainer’s npm account to push WAVESHAPER.V2, a cross‑platform malware, amid a package…
The Hacker News -
North Korean hackers target Node.js maintainers after Axios hack
The North Korean threat actor behind the Axios supply chain attack has been aiming its social engineering campaign at high-profile Node[.]js maintainers, according to Socket reports. The Axios attack occurred on 31 March, when two malicious package versions…
SecurityWeek
-
-
Maine passes bill to boost hospital cybersecurity after attacks
According to Maine House Democrats, on 6 April 2026 the Maine House voted unanimously to advance a bill from Rep. Julie McCabe, D-Lewiston, to help prevent cybersecurity attacks on Maine hospitals and ensure continuity of patient care when future…
DataBreaches -
Microsoft links Medusa ransomware affiliate to zero-day attacks
Microsoft links Medusa ransomware affiliate to zero-day attacks, with Storm-1175 described as a China-based, financially motivated group known for deploying Medusa ransomware payloads. The group is said to be deploying n-day and zero-day exploits in…
DataBreachesStorm-1175 -
Fortinet FortiClient EMS5 articles this day · SecurityWeek first
Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616 · CISA Warns of Fortinet FortiClient EMS Flaw Allowing RCE
-
Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616
Fortinet issued an emergency patch for a FortiClient EMS zero-day that has been exploited in the wild, tracked as CVE-2026-35616. Fortinet describes the flaw as an improper access control vulnerability in FortiClient EMS, noting a pre-authentication API…
-
CISA Warns of Fortinet FortiClient EMS Flaw Allowing RCE
CISA has added CVE‑2026‑35616, the Fortinet FortiClient EMS Improper Access Control Vulnerability, to its Known Exploited Vulnerabilities catalogue. The flaw affects Fortinet’s FortiClient Enterprise Management Server (EMS) and allows an unauthenticated…
-
CISA Adds Fortinet FortiClient EMS Flaw CVE-2026-35616 to KEV
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The vulnerability is CVE-2026-35616, Fortinet FortiClient EMS Improper Access Control Vulnerability. This type of…
-
Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Fortinet disclosed a critical vulnerability in FortiClient EMS (Enterprise Management Server) tracked as CVE-2026-35616, described as an API authentication and authorization bypass that can allow an unauthenticated attacker to execute commands or code.…
-
Fortinet Rushes Emergency Fixes for Exploited Zero-Day
Fortinet rushed emergency fixes over the weekend for a FortiClient EMS vulnerability that has been exploited as a zero-day. The flaw, described as an improper access control issue, is tracked as CVE-2026-35616 with a CVSS of 9.1 and could enable remote code…
-
-
Linux Clipboard Malware Steals Crypto Payments, Researchers Warn
Cybersecurity Reading List for the week of 6 April 2026 highlights a mix of research pieces, threat reports and practical tools. Among the articles, DefenseOne discusses how AI could revive old‑school tradecraft in intelligence, while HivePro reports on…
-
North Korea uses GitHub C2 in South Korea phishing campaign
North Korea-linked threat actors are using phishing LNK files and GitHub as C2 servers to target South Korean organisations, with attacks starting from phishing emails that drop a decoy PDF and a PowerShell script. According to FortiGuard Labs, the…
Security Affairs -
Iran linked hackers hit Israel, UAE with 365 password spray
An Iran-nexus threat actor is suspected to be behind a password-spraying campaign targeting Microsoft 365 environments in Israel and the UAE, according to Check Point. The activity, assessed to be ongoing, unfolded in three waves on 3 March, 13 March and 23…
The Hacker News -
EvilToken fuels AI driven phishing abuse of device code flow
According to Microsoft Defender Security Research Team, a widespread phishing campaign has been observed that leverages the Device Code Authentication flow to compromise organisational accounts at scale. The attack stands out from traditional device code…
Microsoft -
Valley Family Health Care breach exposes 4,300 patient records
Valley Family Health Care (VFHC) notified HHS on 12 January 2026 that the TriZetto Provider Solutions (TPS) breach had affected 4,300 of their patients. The TPS incident began in November 2024 and involved patients’ names, addresses, dates of birth, Social…
DataBreachesInsomnia -
North Korean hackers use GitHub for C2 in South Korea attacks
Threat actors likely associated with the Democratic People’s Republic of Korea have been observed using GitHub as a command-and-control (C2) infrastructure in multi-stage attacks targeting organisations in South Korea. The attack chain, per Fortinet…
The Hacker News -
Storm-1175 hackers use fresh flaws to drop Medusa ransomware
Storm-1175, the financially motivated cybercriminal actor tracked by Microsoft Threat Intelligence, operates high-velocity ransomware campaigns that weaponise recently disclosed vulnerabilities to gain initial access and move rapidly from exploitation to…
-
StepSecurity spots massive axios npm attack before public reveal
StepSecurity’s AI Package Analyst and Harden-Runner detected the axios compromise, identified as the largest npm supply-chain attack by download count, before any public disclosure, triggering a rapid, community‑focused response as a state‑sponsored threat…
StepSecurity -
Google DeepMind Researchers Map Web Attacks Against AI Agents
According to SecurityWeek, Google DeepMind researchers have mapped six types of attacks that can be mounted via web content to manipulate autonomous AI agents. These “agent traps” can inject malicious context and trigger unexpected behaviour, enabling…
SecurityWeek -
BKA names two REvil suspects behind 130 German ransomware attacks
According to the German Federal Criminal Police (BKA), two key REvil ransomware operators have been identified and linked to more than 130 attacks in Germany. The first suspect is Daniil Maksimovich Shchukin, a 31-year-old Russian national known online as…
Security AffairsREvil -
Shadow AI Tools Slip Into Hospitals, Raising Security Concerns
Shadow AI in healthcare is here to stay, as medical professionals increasingly rely on AI tools to manage growing workloads, even as security teams struggle to monitor unsanctioned tools. The piece notes that physicians, doctors and clinicians use…
Dark Reading -
OWASP Refreshes GenAI Security Guide, Adds 21 Risks and New Tools
OWASP GenAI Security Project Gets Update, New Tools Matrix outlines 21 identified risks and splits its tracking into generative AI and agentic AI to reflect rapid adoption and security concerns. The OWASP Foundation published a GenAI Data Security risks…
Dark Reading -
CVE-2026-3098 in WordPress Slider Plugin Drives Dark Web Leaks
SOCRadar’s Dark Web Team identified several new underground posts this week, including an alleged unauthorized access offering tied to TrakCare and InterSystems, a 15,000‑record PowerLab database leak claim, and a dataset described as the U.S. car owner…
-
F5 BIGIP APM Servers Exposed as CVE-2025-53521 Actively Exploited
Over 14,000 F5 BIG-IP APM instances remain exposed online as attackers actively exploit a critical remote code execution flaw, CVE-2025-53521, according to Shadowserver. The vulnerability allows specially crafted malicious traffic to trigger Remote Code…
-
Cross platform triage cuts SOC delay 21 minutes boosts efficiency
Multi-OS cyberattacks are changing how SOCs work, forcing security teams to juggle Windows, macOS, Linux and mobile devices rather than a single operating system. The Hacker News outlines three practical steps to close the resulting risk: make cross‑platform…
The Hacker News -
Iran linked cyber campaign hits finance amid destructive attacks
According to SOCRadar, between 28 February and 6 April 2026 the Iran-linked campaign tracked 1,583 verified incidents, of which 144 targeted financial institutions across 14 countries. Financial services was the second most targeted sector, accounting for…
SOCRadarConquerors Electronic Army -
LiteLLM supply chain attack steals developer credentials globally
The Hacker News reports that in March 2026 the TeamPCP threat actor demonstrated how valuable the developer workstation has become by turning LiteLLM, a popular AI development library downloaded millions of times daily, into a credential harvesting vector.…
The Hacker NewsTeamPCP -
Guardarian Users Targeted With Malicious Strapi NPM Packages
A threat actor has targeted the Strapi ecosystem in a fresh supply chain attack involving 36 malicious NPM packages, according to supply chain security firm SafeDep. The packages were published across four accounts as part of a single campaign, delivering…
SecurityWeek -
Education Data Incidents Surge 72% in 2025, Mostly Human Error
According to the state Education Department’s chief privacy officer, statewide data incident reports rose 72% in 2025, increasing from 384 in 2024 to 662 in 2025. On Long Island, 44 data incidents were reported in 2025, up from 35 the year prior. The…
DataBreaches -
DocketWise breach exposes 116k immigration data bucket leak noted
Two data security incidents affected immigration law firms and their clients, as detailed by DataBreaches[.]Net. DocketWise, an immigration and case management solution, informed the Maine Attorney General’s Office on 3 April that a September 1 2025 breach…
DataBreaches -
German BKA names Russian hacker behind GandCrab, REvil.
According to Brian Krebs, an elusive hacker who went by the handle UNKN and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face: 31-year-old Russian Daniil Maksimovich Shchukin, who headed both cybercrime gangs and helped…
DataBreachesGandCrab -
Trellix roasts cybercriminals with Dark Web Roast campaign
Researchers didn’t want to glamorise cybercrims, so Trellix’s threat intel team decided to take an “almost psyops” approach and roast them instead, giving rise to the Dark Web Roast. During an interview with The Register at the RSA Conference, Trellix VP of…
DataBreaches -
Strava leak exposes UK military locations through fitness data
Fitness tracking is now under scrutiny after a Strava data leak linked to military personnel highlighted how easily workout data can expose sensitive locations. According to Digital Trends, activity logs have been connected to more than 500 UK military…
DataBreaches -
Gritman clinics reopen after cyber attack disrupts care
Moscow, Idaho, clinics reopened on Friday after a cybersecurity incident at Gritman Medical Center disrupted outpatient care earlier in the week, with the hospital and emergency department remaining open throughout, according to DysruptionHub. Gritman first…
DataBreaches -
Qilin and Warlock ransomware abuse drivers to disable defences
Qilin and Warlock ransomware operators have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools on compromised hosts, according to Cisco Talos and Trend Micro. Qilin attacks deploy a malicious DLL named…
The Hacker News
