News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 21 Apr· 55 articles
-
Mozilla’s AI Tool Mythos Finds 271 Firefox Bugs Before Release
On 21 April 2026, Mozilla said that Mythos Preview had helped pre-identify 271 security vulnerabilities in Firefox 150, the week’s release of the browser. In its blog post, Mozilla noted that the vulnerabilities were detected by analysing unreleased source…
Ars Technica -
BlackCat/ALPHV2 articles this day · SecurityWeek first
Former negotiator pleads guilty in BlackCat ransomware plot · Florida consultant admits aiding BlackCat ransomware negotiations
2 outlets-
Former negotiator pleads guilty in BlackCat ransomware plot
A former ransomware negotiator pleaded guilty this week to conspiring with the ransomware actor BlackCat/ALPHV to commit attacks against US companies in 2023, according to a statement from the Department of Justice. Angelo Martino, 41, of Land O'Lakes,…
Dark Reading -
Florida consultant admits aiding BlackCat ransomware negotiations
Angelo Martino of Florida, the third US security expert to admit involvement, has pleaded guilty to participating in ransomware attacks while working for a cybersecurity company hired to negotiate with hackers. Martino, who served as a ransomware negotiator…
SecurityWeek
-
-
Former ransomware negotiator pleads guilty in BlackCat scheme
Angelo Martino pleaded guilty to conspiracy linked to extortion in ransomware operations, after admitting that he helped the BlackCat ransomware group while employed as a ransomware negotiator at a U.S.-based incident response firm. The Florida man, 41, from…
Security Affairs -
Exploits Turn Windows Defender into Attacker Tool
Three publicly available proof-of-concept exploits are being used to attack Microsoft Defender and turn its protective functions against organisations, with two of the exploits unpatched. BlueHammer is a TOCTOU flaw in Defender’s signature update workflow…
-
Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit
North Korea’s Lazarus APT stole $290M from Kelp DAO by abusing LayerZero, according to Security Affairs. Attackers manipulated LayerZero infrastructure, forcing systems to rely on compromised nodes and then drained funds from the rsETH bridge, with around…
Security Affairs -
The Gentlemen2 articles this day · Infosecurity first
Check Point links Gentlemen to SystemBC botnet of 1.5k victims · The Gentlemen ransomware hits 320 victims amid affiliate boom
2 outlets-
Check Point links Gentlemen to SystemBC botnet of 1.5k victims
According to Check Point, the C2 server linked to SystemBC has helped uncover a botnet of more than 1,570 victims tied to The Gentlemen ransomware operation. The SystemBC component establishes SOCKS5 network tunnels within the victim’s environment and…
The Hacker News -
The Gentlemen ransomware hits 320 victims amid affiliate boom
The Gentlemen Ransomware Expands With Rapid Affiliate Growth reports that the operation has claimed more than 320 victims, with the majority of attacks occurring in early 2026, according to Check Point. The group, known as The Gentlemen, has gained traction…
Infosecurity
-
-
North Korea linked Jasper Sleet uses fake IT hires to breach firms
Detection strategies across cloud and identities against infiltrating IT workers, published on 21 April 2026, outlines how remote and hybrid work has expanded hiring and onboarding, increasing reliance on online identity verification and remote access. The…
MicrosoftJasper Sleet -
NGate Malware Uses Trojanised Android App to Steal Card Data
A new variant of the NGate malware family has been identified, using a trojanized Android application to capture payment card data and PINs. According to ESET, the campaign has replaced earlier tooling with a modified version of HandyPay, a legitimate…
Infosecurity -
BRIDGE:BREAK Flaws Put Thousands of Serial to IP Devices at Risk
Cybersecurity researchers have identified BRIDGE:BREAK, a set of 22 vulnerabilities across Lantronix and Silex serial-to-IP converters, which could allow attackers to hijack devices and tamper with data exchanged by them. The flaws affect as many as eight…
-
Bomgar CVE-2026-1731 Exploited in Supply Chain, LockBit Deployed
A fresh wave of cyberattacks has exploited Bomgar RMM instances across organisations and their customers over the past two weeks, underscoring the rapid downstream risk to unpatched supply chains. According to Huntress Security Operations Center, there has…
-
Google fixes Antigravity IDE prompt injection flaw enabling RCE
Google has fixed a critical prompt-injection flaw in its agentic integrated development environment Antigravity that allowed sandbox escape and remote code execution through a PoC, researchers reported this week. The vulnerability centres on how Antigravity…
Dark Reading -
British Scattered Spider Member Admits Guilt in Crypto SMS Scheme
A 24-year-old British national, a senior member of the cybercrime group Scattered Spider, has pleaded guilty to wire fraud conspiracy and aggravated identity theft, according to the U.S. Justice Department. Tyler Robert Buchanan, who used the hacker handle…
Krebs on SecurityScattered Spider -
BlackCat2 articles this day · DataBreaches first
Florida man pleads guilty to aiding BlackCat ransomware gang · Insider at cyber firm aided BlackCat ransomware extortion scheme
2 outlets-
Florida man pleads guilty to aiding BlackCat ransomware gang
Angelo Martino, 41, of Land O’Lakes, Florida, has pleaded guilty to aiding ransomware attackers by working as a negotiator for the BlackCat operators from April 2023. He admitted to providing confidential information about negotiating positions and the…
The Hacker News -
Insider at cyber firm aided BlackCat ransomware extortion scheme
A Florida man, Angelo Martino, 41, of Land O’Lakes, Florida, pleaded guilty to conspiring to deploy BlackCat ransomware and extort U.S. victims, having worked as a ransomware negotiator for five different victims. According to the Justice Department’s…
DataBreaches
-
-
Apple removes fake crypto wallet apps stealing iOS seed phrases
According to Kaspersky, over two dozen fake cryptocurrency applications targeting iOS have been published to the Apple App Store, in a campaign dubbed FakeWallet that has been ongoing since at least the fall of 2025. The 26 phishing apps mimicked major…
SecurityWeekSparkKitty -
Fake Google Antigravity downloads are stealing accounts in minutes
Malwarebytes reports a campaign built around a trojanised Google Antigravity installer, where users download a file named Antigravity_v1.22.2.0[.]exe from a hyphenated lookalike domain at google-antigravity[.]com after searching for the real tool, which…
Malwarebytes -
Reporter sneaks $5 Bluetooth tracker onto Dutch warship via mail
Posted on 21 April 2026, Dutch warship compromised with $5 tracker and a postcard reports that Just Vervaart, working for Omroep Gelderland, hid a $5 Bluetooth tracker inside an envelope with a postcard via the military postal service. According to Omroep…
DataBreaches -
Vercel Confirms Cyber Incident After Sophisticated Attacker Exploits Third‑Party Tool
On 21 April 2026, Vercel confirmed a cyber-incident described as highly sophisticated, arising after a third‑party tool was used by an employee. According to InfoSecurity Magazine, the attacker used that access to take over the employee’s Vercel Google…
DataBreaches -
Two thirds of firms hit by AI agent cyber incidents, CSA warns
Two thirds of organisations have suffered a cybersecurity incident related to the deployment of AI agents in the last year, according to the Cloud Security Alliance research conducted with Token Security. The CSA paper notes that 68% of respondents claim to…
Infosecurity -
How ANY[.]RUN Feeds Cut SOC Response Times with Real Time Intel
Mature SOCs cut MTTR by embedding threat intelligence directly into daily workflows, not by speeding up people. In detection, they move upstream by ingesting real‑world indicators with ANY[.]RUN Threat Intelligence Feeds to flag suspicious infrastructure…
The Hacker News -
Cloudflare calls for privacy first signals as AI blurs bot line
Cloudflare’s post, dated 21 April 2026, argues that the traditional bots vs. humans distinction is increasingly unhelpful as the line between different clients fades, with human interaction and AI-assisted automation both driving web traffic and requiring…
Cloudflare -
Scammers hijack Apple notifications to push fake tech support calls
Real Apple notifications are being used to drive tech support scams, with scammers abusing legitimate Apple account emails to lure victims into calling fake numbers, according to a report from BleepingComputer. They create an Apple ID they control and insert…
Malwarebytes -
CVE-2026-38526: Critical RCE Bug in Krayin CRM TinyMCE Upload
According to SOCRadar, CVE-2026-38526 is a critical authenticated remote code execution vulnerability affecting Webkul Krayin CRM / Krayin Laravel CRM v2.2.x, located in the admin-side TinyMCE media upload feature and enabling a logged-in user to upload a…
-
Perforce P4 Servers Leak Source Code via Default Accounts
A SecurityWeek report details that researchers analysed internet-facing Perforce P4 servers and found 6,122 instances in spring 2025, with 2,826 still active at their original IP addresses as of the findings being shared. Of the active servers, 1,525 (about…
SecurityWeek -
AES 128 Holds Up Against Quantum Threats, Experts Argue
Contrary to popular mythology, AES 128 is perfectly fine in a post-quantum world, according to the debate spurred by cryptography engineer Filippo Valsorda. The piece explains that AES 128 remains widely used and, with Grover’s algorithm, would not simply…
Ars Technica -
Progress patches MOVEit WAF, LoadMaster command injection flaws
Progress Software has issued patches for multiple MOVEit WAF and LoadMaster vulnerabilities that could allow remote code execution and OS command injection. The fixes address CVE-2026-3517 and CVE-2026-3519 in APIs used by Progress ADC products, which could…
-
eScan Update Hijacked, Blockchain Based Malware Hits EMEA
According to Darktrace, a compromised eScan software update in January 2026 triggered a supply chain attack that deployed multi‑stage loader malware and used blockchain‑based domains for C2 communications. The incident involved a two‑hour window on January…
darktrace.com -
Mustang Panda hits Indian banks with LotusLite backdoor
Mustang Panda, also known as TA416, Bronze President, or Stately Taurus, is now suspected of directing a campaign that targets India’s banking sector, beyond its traditional geopolitics focus. According to Acronis Threat Research Unit (TRU), researchers…
Dark ReadingMUSTANG PANDA -
Analysts use satellites to track dark ships and shadow fleet
Maritime OSINT: Tracking Dark Ships & Shadow Fleets explains that thousands of oil tankers traverse the world’s oceans daily, but some go quiet and broadcast nothing, labelled as “Dark Ships”, while the broader “shadow fleet” comprises vessels owned through…
SOCRadar -
AI Fuels Rise in Identity Based Credential Stuffing Attacks
Identity-based attacks remain the most reliable entry point for breaches, with attackers obtaining valid credentials through credential stuffing from breach databases, password spraying against exposed services, or phishing campaigns. They then use those…
The Hacker News -
Cisco Catalyst SD-WAN Manager2 articles this day · Security Affairs first
CISA Adds Cisco SD WAN, Zimbra XSS Flaws to KEV Catalog · CISA adds weaponised PaperCut, TeamCity flaws to KEV catalog
-
CISA Adds Cisco SD WAN, Zimbra XSS Flaws to KEV Catalog
According to CISA, the Known Exploited Vulnerabilities (KEV) catalog was expanded to include eight more flaws, three of which had not previously been flagged as exploited. The most recent addition is CVE-2026-20133, a high-severity information disclosure bug…
-
CISA adds weaponised PaperCut, TeamCity flaws to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Cisco Catalyst, Kentico Xperience, PaperCut NG/MF, Synacor ZCS, Quest KACE SMA, and JetBrains TeamCity flaws to its Known Exploited Vulnerabilities (KEV) catalog, listing eight CVEs…
-
-
Nearly 600k patients hit in three US healthcare breaches
According to the data breach tracker operated by the US Department of Health and Human Services (HHS), three US healthcare organisations disclosed breaches affecting a total of nearly 600,000 individuals, two in Illinois and one in Texas. The North Texas…
SecurityWeek -
AI crafted HandyPay Trojan steals NFC data, PINs in Brazil
Researchers have identified a new NGate campaign that targets Brazil, Trojanising HandyPay to steal NFC data and PINs. The latest variant, also known as NFSkate, patches HandyPay with malicious, allegedly AI-generated code to relay NFC data from a victim’s…
The Hacker News -
NSA uses Claude Mythos despite DoD supply chain worries
The US National Security Agency is reportedly using Anthropic’s Claude Mythos, despite the Department of Defense viewing the vendor as a supply-chain risk. According to Axios, the NSA is already using Mythos Preview even as DoD officials push to cut ties…
Security Affairs -
Google fixes Antigravity AI IDE flaw that lets hackers run code
Cybersecurity researchers uncovered a vulnerability in Google’s agentic IDE Antigravity that could be exploited to achieve code execution, a flaw Google subsequently patched. The issue combined Antigravity’s permitted file-creation capabilities with…
The Hacker News -
Android 17 rolls out Contact Picker to restrict app contact access
Android 17 introduces a Contact Picker that lets users grant apps access to specific contacts rather than the entire list, a change Google is implementing to curb broad data access. Previously, apps needing a single phone number could request the…
Malwarebytes -
North Korea linked hackers steal $290M from Kelp DAO DeFi
The $290 million Kelp DAO crypto heist has been attributed to North Korea, with the Lazarus Group named as the likely actor and described as a claim by SecurityWeek. The attack occurred at 17:35 UTC on Sunday, draining 116,500 rsETH (restaked ether) valued…
SecurityWeekLazarus Group
