News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 8 Apr· 54 articles
-
AWS AgentCore Toolkit Flaws Enable 'Agent God Mode' Exploits
Executive Summary notes that the AgentCore starter toolkit’s default deployment creates IAM roles that grant permissions broadly across the AWS account rather than scoped to individual resources, enabling an attack flow we term Agent God Mode. The…
unit42.paloaltonetworks.com -
CISA adds critical Ivanti EPMM flaw to KEV after PoC release
The U.S. Cybersecurity and Infrastructure Security Agency has added a flaw in Ivanti EPMM to its Known Exploited Vulnerabilities (KEV) catalog, tracked as CVE-2026-35616 and CVE-2026-1340, with a CVSS score of 9.8. The critical vulnerability is a code…
-
Iranian Hackers Target US Infrastructure via Rockwell PLCs
Hackers working on behalf of Iran’s Islamic Revolutionary Guard Corps are implicated in disrupting operations at multiple US critical infrastructure sites, according to the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency,…
Ars Technica -
Microsoft Office2 articles this day · The Hacker News first
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics · APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies
-
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
TrendAI attributes the activity to the APT28 group with high confidence, detailing a spear-phishing campaign against Ukraine and its allies that distributes a new PRISMEX malware suite. The campaign, active since September 2025, uses stealth techniques such…
-
APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies
The Russian threat actor known as APT28, also called Forest Blizzard and Pawn Storm, has been linked to a spear‑phishing campaign targeting Ukraine and NATO allies to deploy a previously undocumented malware suite named PRISMEX. According to Trend Micro…
-
-
APT Group Uses Emoji Malware to Control Discord Commands
Emojis are increasingly being used by threat actors to signal, obfuscate, and coordinate across global networks on platforms such as Telegram and Discord, as well as in underground forums. The piece notes a broad shift toward faster, more visual…
Dark ReadingUTA0137 -
HackerOne Halts New Bug Bounty Submissions as AI Fuels Overload
HackerOne has suspended new vulnerability submissions to its crowdsourced Internet Bug Bounty (IBB) program, effective March 27, in response to what it called a worsening imbalance between vulnerability discoveries and open source remediation capacity.…
Dark Reading -
CISA Flags CVE-2026-1340 in Ivanti EPMM, Orders Rapid Patch
CISA has added CVE‑2026‑1340 to its Known Exploited Vulnerabilities catalogue. The entry covers Ivanti Endpoint Manager Mobile (EPMM) and concerns the Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability. This flaw permits unauthenticated…
-
Chaos malware variant exploits misconfigured cloud Hadoop
A new Chaos malware variant has emerged that targets misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices. Darktrace identified the variant last month on its honeypot network, noting a deliberately misconfigured…
The Hacker News -
TeamPCP Supply Chain Campaign: Update 007 - Cisco Source Code Stolen via Trivy-Linked Breach, Google GTIG Tracks TeamPCP as UNC6780, and CISA KEV Deadline Arrives with No Standalone Advisory, (Wed, Apr 8th)
The seventh TeamPCP update confirms Cisco’s internal development environment was breached via the Trivy supply chain compromise, with access to build systems and developer workstations and over 300 private GitHub repositories cloned, including code for AI…
-
Stealthy Masjesu botnet sold on Telegram targets IoT devices
Masjesu is a stealthy DDoS botnet that has been advertised via Telegram as a DDoS-for-hire service since it first surfaced in 2023, and it targets a wide range of IoT devices such as routers and gateways across multiple architectures. It is designed for…
The Hacker News -
Attackers can hijack Discord via Windows Node.js module flaw
The Zero Day Initiative’s Node[.]js Trust Falls report exposes a Windows-specific privilege escalation risk tied to how Node[.]js resolves modules, with CVE-2026-0776 described as a 0-day affecting the Discord desktop app. The analysis explains that…
-
Google API key flaw leaks Gemini AI data from popular Android apps
A flaw in Google's API key system has reportedly exposed mobile applications to unintended access to its Gemini AI platform, according to CloudSEK, with the advisory published on 8 April 2026. The vulnerability stems from Google's long-standing API key…
Infosecurity -
LAPD breach leaks officer files, internal investigations online
Hackers have allegedly stolen a large amount of sensitive internal LAPD documents and leaked them online, according to DataBreaches[.]Net on 8 April 2026. The stolen data reportedly includes police officer personnel files, internal affairs investigations and…
DataBreachesWorld Leaks -
Latin America Mobile Banking Fraud Surges as Android Scams Soar
Fraud across Latin America’s mobile-first digital banking ecosystem has accelerated, with social engineering, account takeovers and mobile-based attacks driving losses ahead of many other regions. Social engineering scams jumped 155% in 2025, while malware,…
Dark Reading -
OpenSSL patches CVE-2026-31790 RSA key exchange data leak
SecurityWeek reports seven vulnerabilities were patched in OpenSSL, including a data leakage flaw tracked as CVE-2026-31790 and rated moderate severity. The issue affects applications using RSASVE key encapsulation to establish a secret key, where OpenSSL…
-
Critical Vulnerability in Ninja Forms Exposes WordPress Sites
A critical arbitrary file upload vulnerability in Ninja Forms – File Upload Plugin has been identified, exposing thousands of WordPress sites to potential compromise, with the issue affecting plugin versions up to 3.3.26 and allowing unauthenticated…
Infosecurity -
Full Sail University launches IBM cyber defence range in April 2026
Full Sail University is set to open the IBM Cyber Defense Range powered by AWS and Cloud Range on campus, with the opening scheduled for April 2026. The facility, housed within the university’s Emerging Tech Wing, will provide live attack-and-defence…
Dark Reading -
Malwarebytes upgrades Browser Guard to stop extension tracking
Did you know you can be profiled based on the browser extensions you use? Advertisers can detect which extensions are installed and use that to build a picture of the kind of user you are, and the more data there is, the more there is for scammers, identity…
Malwarebytes -
RCE Bug Lurked in Apache ActiveMQ Classic for 13 Years
A remote code execution vulnerability embedded in Apache ActiveMQ Classic for 13 years can be triggered by chaining two mechanisms, Horizon3[.]ai reports, potentially bypassing authentication. The flaw, tracked as CVE-2026-34197, allows attackers to invoke…
-
Signature Healthcare hospital diverts ambulances amid cyberattack
Signature Healthcare in Brockton, Massachusetts diverted ambulances and cancelled some services after a cyberattack disrupted hospital operations, with pharmacies unable to fill prescriptions while urgent care and walk-in services remained open. The…
Security Affairs -
Cowrie Honeypot Tricks Attackers by Faking Successful Logins
More Honeypot Fingerprinting Scans discusses how attackers can discern they are connected to a honeypot by the way installations appear to succeed, with Cowrie acting as the SSH and Telnet emulation. According to Johannes Ullrich, one attacker connected from…
SANS ISC -
Niobium private cloud runs AI on fully encrypted data
Niobium has unveiled The Fog, a private cloud infrastructure platform designed to run applications and AI workloads while data remains encrypted at all times, with decryption keys kept solely by the data owner and Niobium having no access to customer data…
Dark Reading -
Pluralsight launches SecureReady to boost security team skills
Pluralsight has announced the launch of SecureReady, an end-to-end security skill development solution designed to help CISOs and IT leaders quickly close skills gaps in their organisations. The programme combines a library of up-to-date on-demand content…
Dark Reading -
Iranian Hackers Disrupt US Infrastructure via Exposed PLCs
Iran-affiliated threat actors are disrupting US critical infrastructure by attacking Internet-facing operational technology devices, with the impact including file and display manipulation, operational disruption, and financial losses across multiple…
Dark Reading -
FBI Reports $20.9B Cybercrime Losses in 2025, Led by Crypto Fraud
FBI: Cybercrime Losses Neared $21 Billion in 2025 reports that the FBI received 1,008,597 complaints of malicious activity in 2025, with losses totalling $20.877 billion. According to the FBI’s Internet Crime Complaint Center (IC3) report, investments crimes…
SecurityWeek -
APT282 articles this day · DataBreaches first
UK warns Russian hackers hijack home routers for spying · APT28 hijacks routers worldwide to steal passwords via DNS attack
2 outlets-
UK warns Russian hackers hijack home routers for spying
British security officials found that a group linked to the Russian military is spying on users of compromised Small Office/Home Office routers in a broad cyber espionage campaign, with the activity described in a Malwarebytes article dated 8 April 2026. The…
Malwarebytes -
APT28 hijacks routers worldwide to steal passwords via DNS attack
In a new advisory, according to NCSC, APT28, a cyber group linked to Russia’s GRU Military Unit 26165, has been exploiting vulnerabilities in edge network devices to conduct DNS hijacking operations. The group, also known as Fancy Bear and Forest Blizzard,…
DataBreaches
-
-
Iowa Sues Change Healthcare Over Breach Affecting 2.2M Residents
Iowa Attorney General Brenna Bird has filed a lawsuit against Change Healthcare, alleging the company violated state consumer protection and data security laws in connection with a 2024 data breach that affected nearly 2.2 million Iowa residents, according…
DataBreaches -
Firms recheck cyber insurance as war related clauses stay vague
Geopolitical conflicts from Europe to the Middle East are prompting companies to reread the fine print on insurance policies that deny coverage for wartime cyberattacks, according to DataBreaches[.]Net summarising Angus Loten. Act-of-war exclusions—found in…
DataBreaches -
Ambulances diverted as Signature Healthcare faces cyberattack
Signature Healthcare in Brockton, Massachusetts, has diverted ambulances after a cyberattack caused significant disruptions. The organisation runs Brockton Hospital, a 200-bed community hospital, and the Signature Medical Group, which employs more than 150…
SecurityWeek -
VPN providers mask real server locations in US/UK data centres
According to Codamail, Steve Gielda has updated his research on VPN infrastructure and its privacy implications, summarising a study that traced VPN providers to hosting companies and datacentres. The analysis covered 50 VPN providers and identified 6,429…
DataBreaches -
Radio hijacks reveal broadcast gear flaws after FCC warning
DataBreaches[.]Net reports that a string of radio hijacks is highlighting what appears to be a persistent weakness in the broadcast chain. Posted on 8 April 2026, the piece notes that the FCC warned in November about intrusions tied to exposed broadcast…
DataBreaches -
ChipSoft site hit by ransomware; Dutch hospitals still running
A Dutch healthcare software vendor has been knocked offline after a ransomware attack, with ChipSoft’s website going down on 7 April 2026 and remaining unreachable at the time of writing, according to DataBreaches[.]Net. ChipSoft provides hospitals with…
DataBreaches -
Darktrace calls for unified AI security beyond point fixes
Darktrace’s 8 April 2026 blog argues that securing AI requires more than adding point solutions; it calls for lifecycle-based governance and a platform approach that unifies prevention, detection, investigation and remediation across identities, SaaS, cloud,…
-
Hospital Authority worker arrested for leaking 56k patient data
Police said they have arrested a man working for a contractor commissioned by the Hospital Authority for allegedly stealing the personal data of tens of thousands of patients. The data breach resulted in details of more than 56,000 patients from the Kowloon…
DataBreaches -
Masjesu botnet uses router exploits to power global DDoS attacks
Masjesu is a DDoS-focused botnet that has infected a variety of IoT devices and has been active since at least 2023, according to Trellix. The operators advertise it on Telegram, claiming it can launch DDoS attacks of hundreds of gigabytes, with posts in…
SecurityWeek -
Orchid Warns 46% of Enterprise Identities Lurk in Dark Matter
Enterprise IAM is described as reaching a breaking point, with identity becoming fragmented across thousands of apps, machine identities and autonomous systems, creating what Orchid Security calls Identity Dark Matter—identity activity hidden from…
The Hacker News -
Anthropic AI finds 27 year old OpenBSD bug and many zero days
Anthropic has launched Project Glasswing, an initiative that uses AI to identify and remediate undiscovered cybersecurity vulnerabilities in critical software, according to Infosecurity Magazine. The project is based on Claude Mythos Preview, a powerful but…
Infosecurity -
Hackers Targeting Ninja Forms Bug That Exposes WordPress Sites to Takeover
According to Wordfence, a critical-severity vulnerability in the Ninja Forms WordPress plugin’s File Uploads addon could allow attackers to take over vulnerable sites by uploading arbitrary files and achieving remote code execution. The defect,…
