News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 24 Apr· 42 articles
-
Experts Call for Empathy First Response to Romance Scam Victims
Helping Romance Scam Victims Require a Proactive, Empathic Approach highlights how victims often face disbelief and blame from institutions that should support them, prompting experts to push for a coordinated, empathy-first response from law enforcement,…
Dark Reading -
Shai Hulud worm hijacks npm via fake Bitwarden CLI
The npm threat landscape reached a critical inflection point in September 2025 with the Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious packages. Since then, Unit 42 has tracked an acceleration in…
unit42.paloaltonetworks.comTeamPCP -
TGR-STA-1030: New Activity in Central and South America
TGR-STA-1030 remains an active threat, with ongoing activity tracked by Unit 42. Since February, widespread activity from this group has been observed across multiple countries. Most recently, their efforts appear to be heavily focused on regions within…
unit42.paloaltonetworks.comUNC6619 -
Elastic OpenTelemetry Setup for Claude AI Agent Monitoring
Monitoring Claude Code and Cowork at scale through OpenTelemetry and Elastic’s ingestion stack shows Elastic Security Labs’ hands-on approach to real-time observability for AI agents.
elastic.co -
PackageKit flaw CVE-2026-41651 lets Linux users gain root
The Pack2TheRoot flaw, tracked as CVE-2026-41651, lets unprivileged local Linux users install or remove system packages without authorisation, potentially gaining full root access. It affects multiple Linux distributions in their default installations and…
-
Hackers hijack university subdomains via dangling DNS
Hundreds of subdomains from dozens of universities have been hijacked by scammers, with at least 34 universities affected, according to the researcher. The sites berkeley[.]edu, columbia[.]edu, and washu[.]edu are among those implicated, with subdomains such…
Ars TechnicaHazy Hawk -
CISA flags SimpleHelp bug letting techs become admins
CISA has added CVE‑2024‑57726 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects SimpleHelp, the remote‑support platform also named SimpleHelp, and is tracked as the SimpleHelp Missing Authorization Vulnerability. It allows a…
-
CISA warns of active SimpleHelp ZIP traversal flaw CVE-2024-57728
CISA has added CVE-2024-57728, the SimpleHelp Path Traversal Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects the SimpleHelp remote support software produced by SimpleHelp. It allows an authenticated administrator to…
-
Samsung MagicINFO 9 Server2 articles this day · CISA first
Samsung MagicINFO 9 Server CVE-2024-7399 allows arbitrary writes · CISA Adds Four New KEV Flaws, Urges Immediate Patching
-
Samsung MagicINFO 9 Server CVE-2024-7399 allows arbitrary writes
CISA has added CVE‑2024‑7399 to its Known Exploited Vulnerabilities catalogue, affecting Samsung’s MagicINFO 9 Server. The vulnerability is a path traversal flaw that could allow an attacker to write arbitrary files with system authority. The flaw is…
-
CISA Adds Four New KEV Flaws, Urges Immediate Patching
According to CISA, four new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation, in a release dated 24 April 2026. The newly listed CVEs are CVE-2024-7399 (Samsung MagicINFO 9 Server…
-
-
CISA Adds D Link Router Flaw to KEV, Urges Immediate Action
CISA has added CVE‑2025-29635 to its Known Exploited Vulnerabilities catalogue, affecting D‑Link’s DIR‑823X router. The vulnerability is a command injection flaw that allows an authorised attacker to execute arbitrary commands on the device by sending a…
-
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense2 articles this day · SecurityWeek first
Cisco ASA Backdoor FIRESTARTER Persists After Patches, NCSC Warns · US Agency Hit by Firestarter Backdoor on Cisco Firepower Gear
-
Cisco ASA Backdoor FIRESTARTER Persists After Patches, NCSC Warns
According to the advisory, FIRESTARTER is a backdoor discovered on a federal Cisco Firepower device running ASA software, compromised in September 2025 to enable remote access and control. The backdoor is believed to be part of a “widespread” campaign by an…
-
US Agency Hit by Firestarter Backdoor on Cisco Firepower Gear
According to CISA, at least one US federal agency was infected with the Firestarter backdoor through a vulnerable Cisco Firepower device, with the backdoor providing remote access and control and persisting beyond remediation. The campaign linked to…
-
-
US Charges 29 Over Myanmar Scam, Seizes 500 Fake Sites
US authorities have charged 29 people in a Myanmar-based scam network, including a Cambodian senator, and seized more than 500 Web domains tied to fake investment sites. The actions form part of a broader crackdown that has included coordinated government…
Dark Reading -
Five Million Fuzzer Tests Miss FFmpeg Flaw, Glasswing Steps In
Glasswing is credited with securing the code, while the rest of the stack remains the responsibility of others, according to the piece. It notes that five million automated fuzzer testing passes hit a vulnerable line of code in FFmpeg, yet none of them…
Dark Reading -
Fast16 Lua Malware Targeted Engineering Software Before Stuxnet
SentinelOne has discovered a Lua-based sabotage malware called Fast16, created years before Stuxnet and used in an attack in 2005. The analysis notes that Fast16 was referenced in the ShadowBrokers’ leak of NSA offensive tools, and that it may have been…
SecurityWeekThe Shadow Brokers -
Unauthorised Access to Claude Mythos Prompts AI Security Concerns
In Other News: Unauthorized Mythos Access reports that Anthropic’s Claude Mythos was reportedly accessed by unauthorized users through a third‑party vendor environment, with Bloomberg News stating the interface was discovered and access subsequently…
SecurityWeek -
Chinese national masqueraded as researcher to steal NASA secrets
According to the Office of Inspector General (OIG) of the U.S. National Aeronautics and Space Administration (NASA), a Chinese national posed as a U.S. researcher as part of a spear-phishing campaign to obtain sensitive information from NASA, other…
The Hacker News -
Bundestag President Targeted in Signal Phishing via Fake CDU Chat
Signal phishing targeted Germany’s Bundestag President Julia Klöckner via a fake CDU group chat in a campaign that did not require breaking Signal’s encryption, according to Der Spiegel. The attack aimed at Klöckner’s phone through a Signal group chat linked…
Security Affairs -
AI Phishing Is No. 1 With a Bullet for Cyberattackers
AI phishing is No. 1 for cyberattackers, with Cisco Talos' IR Trends Q1 2026 report showing that phishing became the top initial-access vector in the first quarter, overtaking the exploitation of external vulnerabilities. According to Cisco Talos, more than…
Dark Reading -
UK Biobank Data Breach: Health Data of 500,000 Listed for Sale in China
The personal health data of more than half a million UK Biobank volunteers has been put up for sale on e-commerce platforms in China following a data breach. In a statement to the House of Commons, according to Ian Murry, the Minister for Digital Government…
Infosecurity -
Lazarus Group targets macOS users with ClickFix fake meeting scam
North Korea's Lazarus Group is using ClickFix attacks to target macOS users, expanding their reach to Mac-centric organisations and high-value leaders, according to Any[.]Run. The research published on April 21 describes a new nation-state campaign that…
Dark ReadingLazarus Group -
AI Agents Take Centre Stage at RSA 2026 as Threats Multiply
On 24 April 2026, SecurityWeek reports from the RSA Conference in San Francisco where Agentic AI dominated the discourse, highlighting AI as an actor rather than just a tool. The piece notes developments like Mythos, a next‑generation AI framework said to…
SecurityWeek -
UK Biobank data found for sale on Alibaba, prompting probe
Medical data belonging to 500,000 UK volunteers were reported for sale on Alibaba, according to Malwarebytes, in a case involving UK Biobank. The UK Biobank charity alerted the government after listings appeared on the Chinese e‑commerce site, with officials…
Malwarebytes -
NATO’s Locked Shields 2026 Tests Cyber Defence Amid AI Threats
Locked Shields 2026 was described as the world’s largest live-fire cyber defence exercise, bringing together more than 4,000 participants from 41 nations and concluding on Friday. Organised by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE)…
SecurityWeek -
A CISOs Perspective on Security Awareness Training
A former CISO, Karim Benslimane, argues that even with tight security tech, humans remain a weak link in email-driven threats, with credential abuse and phishing accounting for around 60% of all breaches according to Verizon. He describes three pressing SAT…
darktrace.com -
AI deployment rush revives old security flaws, Mandiant warns
According to Infosecurity Magazine, the rush to deploy AI in enterprise environments is not only creating new security vulnerabilities but reviving old security failures, with Jurgen Kutscher, VP of Mandiant Consulting, part of Google Cloud, warning of…
Infosecurity -
HHS settles four HIPAA ransomware cases, fines top $1.16m
According to U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), the four settlements conclude separate ransomware investigations under HIPAA’s Security Rule, with OCR monitoring for two years and a total of $1,165,000 paid.…
DataBreaches -
AI agents highlight delegation gap, identity dark matter risk
On 24 April 2026, The Hacker News outlined how AI agents expose a delegation gap in enterprise security, since agents are started and empowered by existing identities rather than possessing independent authority. The piece argues that the real governance…
The Hacker News -
Kaspersky uncovers 26 fake crypto wallet apps on Apple App Store
Cybersecurity researchers have uncovered 26 malicious apps on the Apple App Store that impersonate popular crypto wallets to harvest recovery phrases and private keys, with activity dating back to at least fall 2025. The FakeWallet family mimics wallets such…
The Hacker NewsSparkKitty -
Trump administration vows crackdown on Chinese AI model theft
According to Associated Press, on 24 April 2026 the Trump administration vowed to crack down on foreign tech companies exploiting U.S. artificial intelligence models, singling out China. In a memo, Michael Kratsios, the president’s chief science and…
SecurityWeek -
Critical Path Traversal Flaw Found in CrowdStrike LogScale SIEM
According to CrowdStrike, the advisory for CVE-2026-40050 describes a critical unauthenticated path traversal flaw in LogScale that could allow a remote attacker to read arbitrary files from the server filesystem; Next-Gen SIEM customers are not affected,…
-
Bitwarden CLI Supply Chain Attack Exposes Malicious npm Package
According to Bitwarden, the incident was caused by a compromised npm distribution path in the Checkmarx supply chain campaign, briefly exposing the malicious @bitwarden/cli package version 2026.4.0 between 5:57 PM and 7:30 PM (ET) on 22 April 2026. The…
Security Affairs -
Tropic Trooper hijacks SumatraPDF to drop AdaptixC2 via GitHub
Tropic Trooper is behind a campaign that uses a trojanized SumatraPDF reader to deploy the AdaptixC2 Beacon post‑exploitation agent and to enable VS Code tunnels for remote access. The loader, codenamed TOSHIS, is a variant of Xiangoop and is used to fetch…
The Hacker NewsAPT23 -
NPM supply chain malware spreads via stolen dev credentials
Npm supply chain malware attack targets developers with worm-like propagation, with Infosecurity Magazine reporting the activity on 24 April 2026. According to Socket, the new research describes worm-style techniques that mirror earlier attacks using…
Infosecurity -
Bitwarden CLI NPM package breached, stealing user credentials
SecurityWeek reports that the Bitwarden CLI NPM package was compromised in a supply chain attack, with version 2026.4.0 containing a malicious loader that fetched a JavaScript payload to steal credentials and secrets from victim machines. The article notes…
SecurityWeek -
Windows RPC flaw enables privilege rise to SYSTEM via impersonation
PhantomRPC describes a privilege escalation technique in Windows RPC that enables a process with impersonation privileges to elevate to SYSTEM across all Windows versions. The research demonstrates five exploitation paths, including coercing the Group Policy…
securelist.com -
Israeli Copperhelm raises $7M seed for AI driven cloud security
According to SecurityWeek, Israel-based Copperhelm has raised $7 million in seed funding for its agentic cloud security platform, emerging from stealth mode. The funding round was led by TLV Partners, with participation from ToDay Ventures, Icon, SaaS…
SecurityWeek -
LMDeploy SSRF flaw used hours after CVE-2026-33626 release
LMDeploy’s high-severity vulnerability CVE-2026-33626 was exploited within 13 hours of its public disclosure, exposing a Server-Side Request Forgery flaw in the project’s vision-language module. According to Sysdig, the advisory notes that the load_image()…
-
UK NCSC Alerts on China Linked Botnet Using Hijacked Devices
The UK National Cyber Security Centre (NCSC) and partners warn that China-linked threat actors are now using large proxy networks built from hijacked consumer devices to route attacks and mask their identity, replacing smaller infrastructure with vast…
Security Affairs
