News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 7 Apr· 55 articles
-
@velora-dex/sdk Compromised on npm: Malicious Version Drops macOS Backdoor via launchctl Persistence
On 7 April 2026, a malicious version of @velora-dex/sdk (v9.4.1) was published to npm, delivering an architecture-aware macOS backdoor that triggers as soon as the package is imported. The injected payload prepends three malicious lines to dist/index[.]js so…
StepSecurity -
AWS Bedrock AgentCore sandbox flaw enables DNS tunnelling theft
Unit 42 details how the AWS Bedrock AgentCore Code Interpreter sandbox could be bypassed, enabling DNS tunnelling to transmit data from inside the sandbox and potentially establish bidirectional C2 communication. The researchers demonstrated that the…
unit42.paloaltonetworks.com -
Cloudflare targets 2029 for full post quantum security suite
Cloudflare is accelerating its post-quantum roadmap and now targets 2029 to be fully post-quantum secure, including post-quantum authentication. The company notes it has already enabled post-quantum encryption for most products since 2022 and aims to upgrade…
Cloudflare -
Flowise2 articles this day · SecurityWeek first
Critical Flowise flaw CVE-2025-59528 exploited, thousands at risk · Flowise CVE-2025-59528 Bug Lets Attackers Execute Code via JS
-
Critical Flowise flaw CVE-2025-59528 exploited, thousands at risk
Attackers are exploiting a critical Flowise flaw, tracked as CVE-2025-59528, that enables remote code execution and file system access by abusing improper validation of user-supplied JavaScript. The vulnerability affects Flowise versions up to 3.0.5 and was…
-
Flowise CVE-2025-59528 Bug Lets Attackers Execute Code via JS
SecurityWeek reports that Flowise’s critical vulnerability CVE-2025-59528 stems from improper validation of user-supplied JavaScript, allowing remote code execution with full Node[.]js privileges and access to the file system. The flaw affects Flowise…
-
-
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Storm-1175 is described by Microsoft Threat Intelligence as a financially motivated group conducting “high velocity ransomware campaigns” that push rapid exploitation of known vulnerabilities, often delivering Medusa ransomware within days or even 24 hours.…
-
Grafana Ghost flaw let attackers steal data via AI prompt trick
Grafana Ghost is an indirect prompt-injection bug that could have enabled attackers to exfiltrate sensitive data by abusing Grafana’s AI components. According to GK Images via Alamy Stock Photo, researchers at Noma Security published findings detailing how…
Dark Reading -
Iran-Linked Hackers Hit US PLCs, Disrupt Critical Infrastructure
According to CISA, Iran-affiliated advanced persistent threat actors are conducting exploitation activity targeting internet-facing operational technology devices, including Rockwell Automation/Allen-Bradley programmable logic controllers. This activity has…
DataBreaches -
Anthropic Unveils ‘Claude Mythos’ — A Cybersecurity Breakthrough That Could Also Supercharge Attacks
Anthropic’s Claude Mythos is described as a new foundational AI model for Project Glasswing, positioned as a step change in performance and placed in a fourth tier named Copybara, ahead of Haiku, Sonnet and Opus. Industry excitement began at the end of March…
SecurityWeek -
Attackers Scan Microsoft Cloud IPs for WordPress Web Shell Probes
Web shells remain a popular method for attackers to maintain persistence on a compromised web server, with attackers often dropping small files via arbitrary file write and remote code execution vulnerabilities for later payload execution. The diary notes an…
SANS ISC -
Russian GRU hijacks routers to steal Microsoft Office OAuth tokens
Hackers linked to Russia’s military intelligence units leveraged known flaws in older Mikrotik and TP-Link SOHO routers to harvest OAuth tokens from Microsoft Office users without deploying malware. At the peak of activity in December 2025, the operation…
Krebs on Security -
TP-Link TL-WR841N2 articles this day · Infosecurity first
APT28 hijacks routers worldwide in DNS based FrostArmada campaign · APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials
-
APT28 hijacks routers worldwide in DNS based FrostArmada campaign
The Russia-linked threat actor APT28 (aka Forest Blizzard) has been linked to a global campaign exploiting insecure MikroTik and TP-Link routers to transform them into malicious infrastructure as part of a FrostArmada operation that began at least in May…
-
APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials
The Infosecurity Magazine report notes that Russian hacking group APT28 has been exploiting vulnerable internet routers to redirect traffic through attacker‑controlled servers and steal credentials from targeted organisations. According to the National Cyber…
-
-
AI-driven hackers weaponise Claude Code for autonomous attacks
AI-enabled cyberwarfare is now here, with attack speed matching machine tempo and defenders urged to adopt architectural, hive-mind approaches. In September 2025, Anthropic reported the first documented large-scale cyberattack driven largely by autonomous…
SecurityWeekGTG-1002 -
UK AI startup Trent AI secures $13M seed round from LocalGlobe
Trent AI today emerged from stealth with $13 million in seed funding, in a round led by LocalGlobe and Cambridge Innovation Capital, with additional support from angel investors, according to SecurityWeek. The London-based startup, founded in 2025 by former…
SecurityWeek -
Docker Engine bug lets attackers bypass AuthZ via padded request
Docker Engine has been disclosed as having a high-severity vulnerability, CVE-2026-34040, with a CVSS of 8.8, that could let an attacker bypass authorization plugins under certain conditions. According to Docker Engine maintainers in an advisory, a specially…
-
GPU Rowhammer GPUBreach Bypasses NVIDIA Driver for Full Access
A new GPU-based Rowhammer attack capable of escalating privileges to a full system compromise has been demonstrated by researchers at the University of Toronto. The technique, called GPUBreach by researchers at the University of Toronto, shows how memory…
Infosecurity -
RSAC 2026: AI Surge Outpaces Defences as Passwords Linger
RSAC 2026 underscored how AI is transforming the cybersecurity landscape at a pace never seen before, with Kelly Jackson Higgins noting the AI wave arrived and accelerated much faster than many organisations were ready for. Dark Reading’s editor-in-chief…
Dark Reading -
1 Billion Microsoft Users Warned As Angry Hacker Drops 0-Day Exploit
According to Forbes, the piece reports that BlueHammer is involved in a zero-day Windows exploit drop, with a security researcher releasing the exploit code rather than a patch appearing. The article states there is no patch available, and the researcher is…
DataBreachesBlueHammer -
RSAC 2026 Spotlights AI Shift, Vendor Hype and Supply Chain Risks
RSAC 2026 was dominated by discussions about artificial intelligence, with CISOs and industry leaders weighing its role from automated threat intelligence to agentic AI that could augment or replace traditional security operations. Alexander Culafi observed…
Dark Reading -
Cybersecurity Leaders Warn Rising Breaches Despite Growing Spend
A panel of five C-suite leaders discussed how cybersecurity success is measured and why it isn’t improving results, in a Dark Reading feature published on 7 April 2026. The discussion highlighted a persistent misalignment between investments and outcomes,…
Dark Reading -
Android patches critical DoS flaw and StrongBox keystore vulnerability
SecurityWeek reports that a critical denial-of-service vulnerability in Android’s Framework component and a separate StrongBox flaw have been patched in the latest Android security update. The DoS issue is tracked as CVE-2026-0049 and can be triggered by a…
-
GrafanaGhost flaw lets hackers silently steal enterprise data
A newly identified critical vulnerability dubbed GrafanaGhost has been used by attackers to silently extract sensitive enterprise data from Grafana environments, according to Noma's Threat Research Team. The exploit bypasses client-side protections and AI…
Infosecurity -
APT283 articles this day · ncsc.gov.uk first
Forest Blizzard hijacks routers to spy via AI enabled DNS attacks · APT28 exploits routers to redirect DNS, stealing credentials
2 outlets-
Forest Blizzard hijacks routers to spy via AI enabled DNS attacks
Executive summary: Forest Blizzard, a threat actor linked to the Russian military, has been compromising insecure home and small-office internet equipment such as routers to hijack DNS and support AI-enabled man-in-the-middle activity, with the aim of spying…
Microsoft -
APT28 exploits routers to redirect DNS, stealing credentials
APT28, a Russian cyber actor, has been exploiting routers to redirect DNS traffic through attacker-controlled servers, facilitating adversary-in-the-middle attacks. This method enables the theft of sensitive credentials such as passwords and OAuth tokens,…
ncsc.gov.uk -
NCSC Warns Russian APT28 Hijacks Routers for DNS Attacks
The National Cyber Security Centre (NCSC) has issued a warning about the Russian cyber group APT28, which is exploiting vulnerable routers to conduct DNS hijacking attacks. This compromises internet traffic, allowing attackers to intercept sensitive…
ncsc.gov.uk
-
-
GrafanaGhost flaw lets attackers leak data via image URL bypass
GrafanaGhost is a vulnerability in how Grafana’s AI components process information that could allow attackers to bypass safeguards and leak enterprise data. Security researchers describe how an attacker can trigger the issue when a user interacts with an…
SecurityWeek -
Russian banks suffer hours long outage due to payment glitch
A major outage hit Russian banking apps and payments, blocking card use, cash withdrawals and mobile access for hours, with a temporary disruption on 3 April 2026 affecting Sberbank and spreading to VTB Bank and T-Bank. Starting around 10 a.m. Moscow time,…
Security Affairs -
China-linked Storm-1175 deploys Medusa ransomware within 24h
Storm-1175, a China‑based actor, conducts fast ransomware operations, exploiting newly disclosed flaws in web‑facing systems to gain initial access and then rapidly moves to deploy Medusa ransomware, sometimes within 24 hours. According to Microsoft, the…
Security AffairsStorm-1175 -
Automated Penetration Testing Alone Isn't Enough, Experts Warn
According to SecurityWeek News, the live diagnostic webinar on Why Automated Pentesting Alone Is Not Enough runs on 7 April 2026 at 1pm ET, inviting participants to move beyond flaky tool-level evaluations. The session argues that if your Automated…
SecurityWeek -
AI Takes Centre Stage at RSAC 2026, Yet Humans Remain Vital
Focusing on the People in Cybersecurity at RSAC 2026 Conference argues that AI dominates the event, but that it’s still humans who matter most in the field. The piece highlights that cybersecurity professionals remain in high demand as organisations grapple…
Dark Reading -
Attackers hijack 1,000+ ComfyUI servers for crypto mining botnet
An active campaign has been observed targeting internet-exposed ComfyUI instances to enlist them into a cryptocurrency mining and proxy botnet. A purpose-built Python scanner sweeps major cloud IP ranges to automatically install malicious nodes via…
The Hacker News -
Webinar tackles AI driven identity gaps before 2026 exploits rise
The Hacker News is hosting an exclusive webinar on closing identity gaps in 2026 before AI exploits enterprise risk, dated 7 April 2026. The session draws on new research from the Ponemon Institute, which notes that hundreds of applications in enterprises…
The Hacker News -
Inside the Rise of MaaS Style Infostealers and Void's Steam C2
The Unknown Stealers: What’s Hidden Below the Radar charts a stealer ecosystem that has evolved into a professionalised criminal economy, with Infostealers now operating as a MaaS-style service that resembles legitimate SaaS, offering payload builders,…
SOCRadar -
US cybercrime losses hit $17.7 billion in 2025, FBI says
According to the FBI’s 2025 Internet Crime Report, cybercrime cost victims over $17.7 billion during 2025, with the Internet Crime Complaint Center receiving over a million complaints about suspected cyber fraud that year—an average of almost 3,000 a day, up…
Infosecurity -
Scammers use QR codes on fake traffic tickets to steal data
Traffic violation scams are evolving to use QR codes embedded in fake notices, with criminals swapping away from text links in favour of images that look official. Victims are instructed to scan a QR code to pay a small fine, but the code redirects to an…
Malwarebytes -
GPU Rowhammer flaw lets users gain root access via memory flips
GPUBreach is a new GPU Rowhammer attack demonstrated by researchers from the University of Toronto that can escalate privileges from a GPU context to a root shell. The technique uses GDDR6 bit flips to corrupt GPU page tables, enabling arbitrary read-write…
SecurityWeek -
Specops Tool Cuts Password Reset Costs, Curbs Helpdesk Overload
According to The Hacker News article published on 7 April 2026, the hidden cost of recurring credential incidents extends beyond breach totals to everyday IT disruption, with account lockouts and credential compromises driving repeated helpdesk tickets and…
The Hacker News -
GPUBreach exploit uses GPU bit flips to gain root shell
GPUBreach is described as an attack technique that uses GPU memory bit-flips to escalate privileges and potentially take full control of a system. The approach targets GPU page tables in memory, using bit flips to gain arbitrary GPU memory read/write and…
Security Affairs -
Medusa Ransomware Hits 300+ Organisations After Zero Day Exploits
The Medusa ransomware group, operating as a ransomware-as-a-service, has been noted for a high tempo of operations, moving from initial access to post‑compromise activity often within days or hours. According to Microsoft, Medusa has hit over 300…
SecurityWeekMedusa
