News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 27 Apr· 37 articles
-
Massachusetts Regulator Fines Fidelity $1.25M Over 2024 Data Breach
William Galvin, Massachusetts’ top securities regulator, ordered Fidelity Brokerage Services to pay $1.25 million for failing to enforce cybersecurity controls that led to a data breach affecting about 77,000 customers.
DataBreaches -
HAFNIUM2 articles this day · Security Affairs first
Chinese hacker extradited from Italy to US for cyber espionage · Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage
2 outlets-
Chinese hacker extradited from Italy to US for cyber espionage
A Chinese national has been extradited from Italy to the United States to face criminal charges, according to a DOJ announcement. Xu Zewei is alleged to be a contract hacker for China’s Ministry of State Security who conducted breaches between February 2020…
DataBreaches -
Italy to Extradite Chinese Hacker Xu Zewei to US Over COVID‑19 Cyber Espionage
Italy plans to extradite Xu Zewei to the United States over cyber-espionage charges, according to Bloomberg. The Chinese national—arrested in 2025 at Milan’s Malpensa Airport on a U.S. warrant—has been linked by Italian authorities to a China state-backed…
Security Affairs
-
-
Attackers exploit dev account flaw to push malicious element-data
Open source software with more than 1 million monthly downloads was compromised after a threat actor exploited a vulnerability in the developers’ account workflow that gave access to its signing keys and other sensitive information. On Friday, unknown…
Ars Technica -
UNC66923 articles this day · SecurityWeek first
UNC6692 hijacks Microsoft Teams and AWS to deploy Snowbelt malware · Researchers Say Decades Old Lua Malware fast16 Predated Stuxnet
3 outlets-
UNC6692 hijacks Microsoft Teams and AWS to deploy Snowbelt malware
A new threat actor, UNC6692, is described as combining social engineering, abuse of legitimate cloud infrastructure and custom malware in a multistage campaign, according to Google Threat Intelligence Group (GTIG) and Mandiant. The campaign reportedly uses…
Dark Reading -
Researchers Say Decades Old Lua Malware fast16 Predated Stuxnet
In this week’s recap, The Hacker News highlights a Lua-based malware named fast16 developed years before Stuxnet and designed to tamper with high-precision calculation software, with analysis suggesting activity five years before Stuxnet and origins linked…
The Hacker News -
UNC6692 Fake IT Support Phishing Delivers Snow Malware Extension
According to Google Threat Intelligence Group (GTIG), the threat actor UNC6692 has been observed bombarding victims with emails and impersonating IT support to persuade them to run malicious code, a technique that aimed to deliver the Snow malware family. In…
SecurityWeek
-
-
Medtronic breach confirmed after ShinyHunters claims 9M records
Medtronic confirmed a breach of its IT systems after ShinyHunters claimed to have stolen over 9 million records, according to the company's press release and subsequent reporting. The firm said an unauthorized party accessed data in certain Medtronic…
Security AffairsShinyHunters -
PhantomRPC Flaw Enables Low Privilege Windows SYSTEM Escalation
Unpatched PhantomRPC flaw in Windows enables privilege escalation by exploiting an architectural weakness in how Windows’ Remote Procedure Call handles connections to unavailable services. A researcher, Haidar Kabibo, a middle application security specialist…
Dark Reading -
US sanctions Cambodian crypto fraud network after $10bn scam toll
According to the Office of Foreign Assets Control (OFAC), a Cambodian network accused of orchestrating large-scale cryptocurrency fraud has been hit with US sanctions targeting senior figures and associated entities. The sanctions name Senator Kok An among…
Infosecurity -
Ransomware gang behind half of cyber claims via SonicWall
A single ransomware crew exploiting a single brand of firewall is now driving nearly half of all cyber insurance claims, according to At-Bay’s 2026 InsurSec Report, which analysed more than 6,500 claims and 100,000 policy years. The report says attackers are…
DataBreachesStorm-1567 -
Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
According to Checkmarx, the ongoing investigation into its supply chain security incident has found that a cybercriminal group published data related to the company on the dark web. The firm says, based on current evidence, that this data originated from…
The Hacker NewsLAPSUS -
TeamPCP resumes with npm worm, PyPI, Docker Hub breaches
The 26‑day pause in TeamPCP’s supply chain activity ended with three concurrent compromises across npm, PyPI and Docker Hub, occurring between April 21 and 22. The Docker Hub compromise hit the official checkmarx/kics repository on April 22, with the…
SANS ISCTeamPCP -
Itron confirms cyber breach, says impact limited and ops normal
Itron disclosed it suffered a cybersecurity breach, according to an 8-K form filed to the US Securities and Exchange Commission (SEC). The US‑based firm revealed its IT systems were breached by an unauthorized third‑party actor and activated its…
Infosecurity -
Song Wu’s spear phishing campaign duped NASA staff for years
A Chinese national ran a spear-phishing campaign by posing as a U.S. researcher and tricked NASA staff into sharing sensitive information, with the NASA Office of Inspector General and federal partners uncovering the scheme that also targeted government…
Security Affairs -
BrowserGate: LinkedIn Accused of Massive Fingerprinting
BrowserGate is an investigation described by Security Affairs as one of the largest data breach and corporate espionage scandals in digital history, centred on LinkedIn secretly fingerprinting users via browser extensions and device data and transmitting…
Security Affairs -
Popular browser extensions secretly sell user data, study reveals
According to LayerX Security, dozens of widely used browser extensions have been collecting and selling user data with explicit disclosure in their privacy policies. The study identified more than 80 extensions that reserve the right to sell user data,…
Infosecurity -
Fast16 Lua worm predates Stuxnet, targets engineering software
Researchers have uncovered a malware framework dubbed fast16 that predates Stuxnet by five years, with components dating back to 2005. According to SentinelOne researchers, fast16 quietly corrupts the outputs of high-precision engineering and scientific…
Dark Reading -
APT28 exploits Windows SmartScreen gap for zero click LNK attacks
SecurityWeek reports that an incomplete patch for a Windows SmartScreen and Windows Shell security prompts bypass opened the door to zero-click attacks, with researchers tracing the issue to CVE-2026-21510, which was patched in February and could enable…
-
AI Accelerated Exploits Cut Bug to Attack Time to Hours
According to Dark Reading, the piece examines fears that frontier large language models such as Anthropic's Mythos and OpenAI's GPT-5.5 could drive an era of industrialised, autonomous exploitation across platforms, a notion described as a potential…
Dark Reading -
OpenSSH flaw grants root via comma in certificate principal
OpenSSH versions released over the past 15 years are affected by a vulnerability leading to full root shell access, and attacks cannot be spotted via log-based detection, according to Cyera. Tracked as CVE-2026-35414 (CVSS 8.1), the flaw is a mishandling of…
-
Google sees 32% rise in indirect prompt injection attacks
SecurityWeek reports that Google’s analysis of indirect prompt injection attempts on public-web sites shows an upward trend in malicious activity, even though overall sophistication remains relatively low. The researchers identified two malicious classes:…
SecurityWeek -
Finding flaws faster than fixes PlexTrac aims to close the gap
Mythos’s rapid vulnerability discovery is overshadowed by a quieter problem: the remediation workflow. According to The Hacker News, the gap between finding a vulnerability and fixing it will determine whether organisations survive this shift, since faster…
The Hacker News -
ProUkrainian Hackers Exploit TrueConf Flaw to Hit Russian Servers
PhantomCore, a pro‑Ukrainian hacktivist group, has been attributed to attacks on Russian servers running TrueConf video conferencing software since September 2025, according to Positive Technologies. The firm reports that the threat actors leveraged an…
The Hacker NewsPhantomCore -
Cybersecurity Workers Miss Pay Rises, Many Look for New Roles
Over three quarters of cybersecurity professionals were not granted a pay rise last year, contributing to feelings of being undervalued among half of the workforce and prompting many to consider seeking a new role in the near future. A Harvey Nash Global…
Infosecurity -
Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware
Cybersecurity researchers have flagged 73 cloned Visual Studio Code extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm, with six confirmed as malicious and the rest acting as sleeper packages…
The Hacker News -
Itron detects unauthorised April 2026 breach, says impact minimal
Itron, a US-based energy and water management solutions provider serving utilities and cities, said it detected unauthorized access to some of its systems on 13 April 2026, with operations continuing in all material respects. The firm noted in an SEC filing…
SecurityWeek -
Mozilla Firefox2 articles this day · SecurityWeek first
Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting · CVE-2026-6770 lets sites track Firefox, Tor users via IndexedDB
-
Firefox bug CVE-2026-6770 enabled cross-site tracking and Tor fingerprinting
Firefox bug CVE-2026-6770 allowed attackers to fingerprint Firefox users and Tor Browser, even in Private Browsing, by exploiting the IndexedDB data in Firefox and Thunderbird. The flaw works through a deterministic, process-scoped identifier derived from…
-
CVE-2026-6770 lets sites track Firefox, Tor users via IndexedDB
A security issue tracked as CVE-2026-6770 could allow fingerprinting of Firefox users, including those using Private Browsing and the Tor anonymity browser based on Firefox, by exploiting the IndexedDB API and how Firefox stores database names. The…
-
-
Linux PackageKit flaw lets users gain root via race condition
A race condition in the PackageKit cross-distro package management abstraction layer has been described as easily exploitable, allowing unprivileged users to install packages with root privileges. The flaw, tracked as CVE-2026-41651 with a CVSS of 8.1, is a…
-
US targets Cambodian senator, freezes millions in scam crackdown
According to Associated Press, US officials have announced a sweeping crackdown on Southeast Asian cyberscam operations, led by a Scam Center Strike Force and described as a “new theatre of war” by US officials. The action includes sanctions by the Treasury…
SecurityWeek -
2005 Lua worm predated Stuxnet, aimed at Iran's nuclear sites
Security researchers have identified malware dating back to 2005 that appears to have been designed to disrupt Iran’s nuclear program years before the Stuxnet campaign, according to SentinelOne's researchers. They found a service binary “svcmgmt[.]exe”…
Infosecurity -
Fast16 Lua malware sabotaged precision software before Stuxnet
Fast16 is described by SentinelOne as a sabotage malware uncovered in 2005 that tampered with precision software and spread itself, predating Stuxnet by at least five years. The malware is written in Lua and targeted high-precision calculation software,…
Security Affairs -
Retail firms face vishing led extortion with seven figure demands
Security researchers have revealed details of a new extortion group that has been actively targeting retail and hospitality businesses since February 2026. According to Palo Alto Networks’ Unit 42 teamed up with the Retail and Hospitality Information…
InfosecurityBlackFile -
UK Biobank data of 500k volunteers listed for sale on Alibaba
According to Malwarebytes Labs, the week of 20–26 April 2026 featured a slate of notable cybersecurity stories, including an entry about medical data from 500,000 UK Biobank volunteers being listed for sale on Alibaba (April 24, 2026). The roundup also…
Malwarebytes -
Itron detects unauthorised access, triggers cyber response
Itron, a U.S.-based utility technology provider, disclosed a cyber incident involving unauthorised access to part of its internal IT systems detected on 13 April 2026, with the company activating its incident response plan and notifying law enforcement.…
Security Affairs -
Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive Global SMS, Crypto Fraud
The article discusses a widespread SMS and cryptocurrency fraud linked to a fake CAPTCHA IRSF scam, alongside 120 campaigns involving the Keitaro platform. It emphasizes the rise in social engineering tactics used to deceive individuals and collect sensitive…
The Hacker News
