News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 13 Apr· 54 articles
-
Adobe Acrobat and Reader5 articles this day · SOCRadar first
Adobe Acrobat Bug CVE-2026-34621 Allows Arbitrary Code Execution · Adobe patches CVE-2026-34621 in Acrobat after wild exploitation
-
Adobe Acrobat Bug CVE-2026-34621 Allows Arbitrary Code Execution
On 13 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑34621, known as the Adobe Acrobat and Reader Prototype Pollution Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Adobe…
-
Adobe patches CVE-2026-34621 in Acrobat after wild exploitation
Adobe patched an arbitrary code execution vulnerability in the latest versions of its Acrobat and Reader for Windows and macOS, nearly four months after an attacker first appeared to have begun exploiting it. The high-severity flaw, assigned as…
-
Alleged Police Tipline Data Sale, iOS and Adobe Exploits, RDWeb Access Listings, and Gunra Recruitment
SOCRadar’s Dark Web Team published on 13 April 2026 a post detailing several new underground posts this week, including an alleged sale of United States and Canada tipline database records, claims of high-end exploitation tooling for iOS and Adobe Reader,…
-
Adobe Reader zero day exploited via malicious PDF to steal files
Opening a malicious PDF could trigger a zero‑day in Adobe Acrobat Reader, enabling attackers to read local files and even pull in extra code from a remote server, potentially bypassing sandbox protections. The vulnerability, tracked as CVE-2026-34621, is…
-
Adobe patches Acrobat after CVE‑2026‑34621 exploited in the wild
Adobe has issued an emergency update for Adobe Acrobat and Adobe Acrobat Reader on Windows and macOS to address CVE-2026-34621, a vulnerability Adobe says can be exploited to achieve arbitrary code execution when a crafted PDF is opened, with exploitation…
-
-
CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
CISA has added CVE‑2026-21643 to its Known Exploited Vulnerabilities catalogue. The entry concerns Fortinet FortiClient EMS, which contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via…
-
CISA Flags Adobe Acrobat CVE-2020-9715 Flaw, Urges Patch
CISA has added CVE‑2020‑9715 to its Known Exploited Vulnerabilities catalogue, affecting Adobe Acrobat. The entry tracks the Adobe Acrobat Use‑After‑Free Vulnerability, which allows an attacker to execute arbitrary code on a compromised system. The flaw is a…
-
CSA Warns CISOs to Brace for AI Driven Mythos Vulnerability Storm
CSA: CISOs Should Prepare for Post-Mythos Exploit Storm reports that security experts fear an “AI vulnerability storm” triggered by Anthropic’s Mythos, a new version of Claude Mythos that can discover and exploit complex, high-severity vulnerabilities across…
Dark Reading -
CISA Adds Windows Privilege Flaw CVE-2023-36424 to KEV Catalog
CISA has added CVE‑2023-36424 to its Known Exploited Vulnerabilities catalogue, affecting Microsoft Windows. The vulnerability, named Microsoft Windows Out-of-Bounds Read Vulnerability, resides in the Common Log File System Driver and could allow a threat…
-
CISA adds Microsoft Exchange flaw CVE-2023-21529 to KEV list
On 13 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2023‑21529 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft Exchange Server and is named the Microsoft Exchange Server Deserialization…
-
CISA flags Windows link flaw CVE-2025-60710 as actively exploited
CISA has added CVE‑2025-60710, the Microsoft Windows Link Following Vulnerability, to its Known Exploited Vulnerabilities catalogue. The entry concerns Microsoft’s Windows operating system, which contains a link following flaw that permits privilege…
-
CISA warns of exploited VBA flaw CVE-2012-1854, urges patch
CISA has added CVE‑2012-1854 to its Known Exploited Vulnerabilities catalogue. The entry concerns Microsoft’s Visual Basic for Applications (VBA) and relates to the Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability, which could…
-
Darktrace Warns of AI Agent Risks in Model Context Protocol
Darktrace’s blog on MCP risks explains that Model Context Protocol has become the control plane for autonomous AI agents, expanding the attack surface across development pipelines, operational systems and customer workflows. It notes that MCP is a standard…
darktrace.com -
Booking.com confirms user data breach, payment details untouched
Hackers accessed Booking[.]com user data, with the company saying unauthorized third parties may have been able to access certain booking information linked to reservations. The exposed details could include names, email addresses, phone numbers, and…
Security Affairs -
OT firms face quantum readiness attestations without proper tools
OT asset owners are being asked to attest to their post-quantum cryptographic readiness, but regulators have not provided the tooling to make those attestations meaningful, resulting in paperwork that can look like security. The piece argues that the…
Dark ReadingVolt Typhoon -
City of Anthony, NM, public records have been suspiciously disappeared, locked, or wiped
There are insider breaches, and then there are fourth-degree felonies and other possible charges if public records are destroyed improperly or without a lawful purpose, according to the article. KVIA in New Mexico reports that the City of Anthony released a…
DataBreaches -
Obsidian plugin abuse spreads PhantomPulse RAT via LinkedIn
According to Elastic Security Labs, a novel social engineering campaign tracked as REF6598 abuses Obsidian’s community plugin ecosystem to gain initial access, targeting financial and cryptocurrency sector individuals via LinkedIn and Telegram. The attackers…
elastic.co -
JanelaRAT Uses MSI Installers to Hit Latin American Banks
JanelaRAT is a malware family that targets banks and financial institutions in Latin America, with a modified BX RAT capable of stealing financial and cryptocurrency data, tracking mouse inputs, logging keystrokes, taking screenshots, and collecting system…
The Hacker News -
Silent Ransom Group targets US law firms, leaks data from 38+
According to the FBI Private Industry Notice issued in May 2025, the Silent Ransom Group (SRG) has targeted law firms, and DataBreaches notes that SRG has publicly listed around 38 U.S. law firms on its leak site where non‑payment of ransoms leads to data…
DataBreachesLuna Moth -
APT41 uses Linux cloud backdoor to steal credentials via SMTP
APR41 is described as delivering a so‑called zero‑detection backdoor designed to harvest cloud credentials from Linux-based cloud workloads across AWS, Google Cloud Platform, Microsoft Azure, and Alibaba Cloud environments, with the backdoor written as a…
Dark ReadingAPT41 -
Attackers hijack Microsoft 365 mailbox rules to steal data
Security researchers have identified a surge in the misuse of mailbox rules within Microsoft 365 environments, with attackers increasingly relying on native email features to maintain access, exfiltrate data and manipulate communications after account…
Infosecurity -
FBI and Indonesian Police Shut Down Global W3LL Phishing Network
The FBI, in partnership with the Indonesian National Police, has dismantled the infrastructure behind a global phishing operation that used the off‑the‑shelf W3LL toolkit to steal thousands of victims’ credentials and attempt more than $20 million in fraud.…
The Hacker News -
Mirax Android Trojan Turns Devices Into Residential Proxy Nodes
Mirax is an Android banking trojan that combines remote access features with residential proxy capabilities, turning infected devices into proxy nodes to broaden its impact. According to an advisory published by Cleafy, the malware has been observed…
Infosecurity -
Cloudflare rolls Wrangler CLI preview with Local Explorer beta
Cloudflare is expanding Wrangler into a cloud-wide CLI, with an early technical preview released publicly to let developers try commands that span multiple products.
Cloudflare -
Booking.com Says Guest Data Exposed, PINs Reset After Leak
Booking[.]com said hackers may have accessed information related to some travel reservations, though the company has not disclosed how many customers were affected. According to Booking[.]com, the incident involved an unauthorized third party and some of its…
SecurityWeek -
AI Driven Cyberattack Hits Mexican Govt Exposes Millions Records
According to Gambit Security’s technical report, a cyberattack spanning nine Mexican government organisations used Claude Code and ChatGPT to accelerate exploitation, reconnaissance, and privilege escalation across federal, state, and municipal environments,…
SOCRadar -
LinkedIn extension checks raise privacy concerns in BrowserGate
BrowserGate has sparked debate over LinkedIn’s browser activity, with proponents claiming it fingerprinted and profiled users while researchers question the scale and intent. The piece notes that BrowserGate describes a process in which LinkedIn’s JavaScript…
SecurityWeek -
Cloudflare makes Sandboxes generally available for agentic dev
Cloudflare has announced that Sandboxes and Cloudflare Containers are both generally available, marking a major milestone for agentic development environments. Since its launch last June, Sandboxes have evolved into a persistent, isolated development…
Cloudflare -
Durable Objects in Dynamic Workers: Give each AI-generated app its own database
Durable Objects in Dynamic Workers lets you give each AI-generated app its own database by dynamically loading and instantiating a Durable Object class, with a SQLite database attached that lives on local disk. The system pairs a normal Durable Object…
Cloudflare -
FreePBX hit by EncystPHP shell creating hidden admin accounts
Researchers are observing scans for the EncystPHP web shell, a tool Fortinet reported back in January as a weaponised web shell that is now appearing in attempts to compromise vulnerable FreePBX systems. The observed requests include a GET to…
SANS ISC -
RegPhantom Rootkit Lets Attackers Gain Kernel Access on Windows
The Hacker News’ weekly recap dated 13 April 2026 flags a busy security week, including a critical zero-day quietly living in PDFs for months and aggressive state‑sponsored meddling in infrastructure coming to light. It notes that fibre optic cables can be…
The Hacker NewsAPT28 -
Cloudflare introduces outbound Worker based sandbox authentication
Published on 13 April 2026, Cloudflare’s post describes dynamic, identity-aware, and secure Sandbox authentication via outbound Workers. It explains that Sandboxes can route egress through programmatic proxies to connect to services, add observability, and…
Cloudflare -
OpenAI Hit by Axios Supply Chain Attack Tied to North Korea
OpenAI revealed on Friday that it is among the organisations affected by the Axios supply chain attack, which cybersecurity experts have attributed to North Korean hackers. Axios is a widely used open source JavaScript HTTP client library, with over 100…
SecurityWeek -
AI cuts SOC alert to response time, reshaping key metrics
Detection has improved markedly, with security products now pushing MTTD close to zero for known techniques, but the article argues the post-alert window remains the real battleground. According to CrowdStrike's 2026 Global Threat Report, the average eCrime…
The Hacker News -
International Operation Targets Multimillion-Dollar Crypto Theft Schemes
An international operation involving law enforcement agencies from the United States, the United Kingdom and Canada has targeted multimillion-dollar cryptocurrency theft schemes. The initiative identified over $45 million in stolen funds and successfully…
SecurityWeek -
Signal Messages Found on iPhone After Uninstall via Notifications
In a Texas FBI case, iPhone forensics revealed that Signal messages could be recovered even after the app was removed, via system artifacts rather than by breaking Signal’s encryption. The claim, reported by 404 Media and discussed by security researchers,…
Security Affairs -
Booking.com alerts Australian customers to possible data breach
Booking[.]com has warned customers that their personal information, including booking details and names, may have been accessed by an unauthorised third party. The notice follows emails sent to some Australian customers early this morning describing…
DataBreaches -
Rockstar Games hit by second hack in three years, ransom demanded
Rockstar Games, the GTA-maker, has been hacked again, according to DataBreaches[.]Net. The breach was claimed by a group of hackers who said they gained access to Rockstar’s servers managed by a third-party cloud provider and would publish stolen material…
DataBreaches -
Spring Lake Park Schools Shut After Suspected Ransomware Attack
According to Spring Lake Park Today, Spring Lake Park Schools in Minnesota were forced to close on 13 April 2026 due to a suspected ransomware attack that disrupted the district’s computer systems. The report notes that local authorities are investigating…
DataBreaches -
Attackers hijack CPU Z installers on CPUID site to spread STX RAT
SecurityWeek reports that the CPUID website was hacked to deliver Trojanized downloads of CPU-Z, HWMonitor and PerfMonitor, with malicious installers hosted by a Russian-speaking threat actor during a supply-chain and watering-hole style campaign. The…
SecurityWeek
