News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 28 Apr· 54 articles
-
North Korea’s BlueNoroff uses fake Zoom to steal crypto exec data
North Korea’s BlueNoroff state-sponsored group is running a financially motivated campaign that targets cryptocurrency executives by using stolen victim videos, AI-generated avatars, and fake Zoom meetings to induce malware infections, according to Arctic…
Dark ReadingLazarus Group -
GitHub Enterprise Server2 articles this day · The Hacker News first
CVE-2026-3854 flaw lets attackers run code via simple git push · GitHub flaw (CVE-2026-3854) lets attackers run code via one push
-
CVE-2026-3854 flaw lets attackers run code via simple git push
CVE-2026-3854 is a critical GitHub flaw that enables remote code execution with a simple git push, affecting GitHub Enterprise Cloud variants and GitHub Enterprise Server. The vulnerability stems from a command injection flaw where user-supplied push option…
-
GitHub flaw (CVE-2026-3854) lets attackers run code via one push
Cybersecurity researchers disclosed a critical vulnerability in GitHub[.]com and GitHub Enterprise Server, tracked as CVE-2026-3854, which could allow remote code execution with a single git push command. The flaw involves command injection where…
-
-
NSA’s former chief urges firms to learn from Snowden fallout
Chris Inglis, the head civilian in charge at the NSA when Edward Snowden’s leaks exploded, reflects 13 years on about the episode and what enterprises can learn from it. He notes that Snowden alleged abuses of privilege, but, according to the investigations…
Dark Reading -
Moldova health database hit in cyber attack, 30% data lost
Moldova’s Cybersecurity Agency has reported a large-scale attack on the country’s main medical database, damaging around 30% of the information. The agency’s deputy director said the attackers had been targeting the platform over the past month. The database…
DataBreaches -
Elastic Labs releases CI tool to stop pipeline secret leaks
Elastic Security Labs outlines how an open-source, drop-in CI template called cicd-abuse-detector can help catch abuse across GitHub Actions, GitLab CI, and Azure DevOps pipelines. Published on 29 April 2026 by Mika Ayenson, PhD, the piece explains that…
elastic.co -
Microsoft Windows Shell flaw allows network spoofing; patch urged
On 28 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑32202 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft Windows and is named the Microsoft Windows Protection Mechanism Failure…
-
0APT2 articles this day · Infosecurity first
0APT vs KryBit ransomware feud leaks data, helps defenders · Ransomware rivals leak each other's data, then rebuild
2 outlets-
0APT vs KryBit ransomware feud leaks data, helps defenders
Feuding ransomware groups have leaked data from each other, with 0APT and KryBit exposing infrastructure and operational data that defenders can study. According to Halcyon Ransomware Research Center, 0APT emerged in late January and posted a list of nearly…
Dark Reading -
Ransomware rivals leak each other's data, then rebuild
Two ransomware groups are licking their wounds and rebuilding after leaking each other’s data online, according to Halcyon. The set-to began when 0APT claimed the scalps of KryBit and established players RansomHouse and Everest Group, exposing KryBit’s…
Infosecurity
-
-
CISA Flags Critical ScreenConnect Flaw CVE‑2024‑1708 as Exploited
On 28 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2024‑1708 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects ConnectWise ScreenConnect and is a path traversal vulnerability that could allow an…
-
Scattered Spider2 articles this day · DataBreaches first
Vidar malware surges to top after law enforcement takedowns of rivals · Scattered Spider member arrested in Finland, US seeks extradition
2 outlets-
Vidar malware surges to top after law enforcement takedowns of rivals
Vidar, a credential-stealing malware lurking in the cybercriminal ecosystem since 2018, has risen to the top of the chaotic infostealer market following this year’s law‑enforcement takedowns of Lumma and Rhadamanthys. According to Intrinsec, Vidar’s author…
Dark Reading -
Scattered Spider member arrested in Finland, US seeks extradition
An alleged member of Scattered Spider has been arrested in Finland as the U.S. seeks extradition, with federal authorities naming Peter Stokes as the individual behind the online moniker “Bouquet.” Stokes, a dual citizen of the U.S. and Estonia, was arrested…
DataBreaches
-
-
MFA misconfig fuels biggest ransomware loss in manufacturing
According to Resilience, security leaders can translate technical risk into financial terms by using insurance data that links specific cyber events to losses. The latest analysis focuses on ransomware in manufacturing, noting that in 2025 manufacturing was…
SecurityWeekBlackCat -
Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign
According to The Hacker News, a Brazilian-origin cybercrime group has resurfaced after more than three years with a Minecraft-focused campaign, deploying a new infostealer named LofyStealer (aka GrabBot). The malware masquerades as a Minecraft hack called…
The Hacker NewsLofyGang -
ShinyHunters2 articles this day · Infosecurity first
Vimeo breach hits Anodot, emails exposed by ShinyHunters · Medtronic investigates breach after ShinyHunters data claim
2 outlets-
Vimeo breach hits Anodot, emails exposed by ShinyHunters
Vimeo has confirmed a data breach affecting user and customer data after an attack involving a third-party vendor, with ShinyHunters claiming credit for the intrusion. According to Vimeo, hackers accessed databases containing technical data, video titles and…
SecurityWeek -
Medtronic investigates breach after ShinyHunters data claim
Medtronic has confirmed a data security incident affecting its corporate IT systems, reporting that an unauthorized party accessed certain internal environments. The disclosure comes after ShinyHunters claimed to have exfiltrated more than nine million…
Infosecurity
-
-
The Mythos Moment: Enterprises Must Fight Agents with Agents
The Mythos Moment: Enterprises Must Fight Agents with Agents argues that the rapid adoption of agentic AI, such as Claude Mythos, could enable attacks to be discovered and executed at scale with minimal human intervention, prompting a shift to autonomous,…
SecurityWeek -
Webinar tackles Shadow AI with practical governance roadmap
Live webinar co-hosted by Airia and SecurityWeek explores a practical, multi-layered roadmap to move from fragmented AI usage to a governed, scalable ecosystem, addressing the rise of Shadow AI where employees adopt generative and agentic tools without IT…
SecurityWeek -
Malicious VS Code Extensions Spread via Open VSX Marketplace
A fresh wave of GlassWorm extensions for Visual Studio Code is spreading self-propagating malware via the Open VSX marketplace, an open source alternative to Microsoft's Visual Studio Marketplace. Researchers from Socket discovered a cluster of 73 so‑called…
Dark Reading -
Robinhood says attackers abused signup flow for phishing emails
Robinhood has confirmed that cybercriminals exploited a vulnerability in its account creation flow to send out legitimate-looking phishing emails, rather than a breach of its systems or customer accounts. The emails came from a Robinhood address and carried…
SecurityWeek -
Handala group threatens US troops in Bahrain with missile warnings
On 28 April 2026, U.S. service members in Bahrain began receiving WhatsApp messages signed by a group calling itself Handala, claiming that missiles and drones were already aimed at them and that their identities were under surveillance, with the messages…
SOCRadarHandala -
VECT 2.0 Ransomware Functions as Wiper, Destroys Large Files
Threat hunters say that the cybercrime operation known as VECT 2.0 behaves more like a wiper than a ransomware due to a flaw in its encryption across Windows, Linux and ESXi that makes recovery impossible even for the attackers. The locker permanently…
The Hacker News -
German officials hit by Signal phishing tied to Russian actors
A phishing campaign targeting German officials, suspected to be orchestrated by Russian actors, has been uncovered. The operation exploited the Signal messaging platform to vitiate trust, prompting high-profile targets, including politicians and diplomats,…
Security Affairs -
Senators Demand Answers on BlueLeaks 2.0 Education Data Breach
DataBreaches[.]net casts the BlueLeaks 2.0 incident as potentially the worst privacy breach seen in education sector reporting in two decades, with questions surrounding P3 Global Intel and Navigate360's disclosures. The piece notes that U.S. Senators Maggie…
DataBreaches -
US extradites Chinese national over Typhoon university hacks
A Chinese national accused of belonging to the Silk Typhoon state-sponsored threat group was extradited from Italy to the US over the weekend, according to the Department of Justice. Xu Zewei, 34, was arrested in July 2025 after being charged in the US for…
SecurityWeek -
Vercel bypass header probed via open proxy to lower security
This entry discusses the observation of HTTP requests containing the 'X-Vercel-Set-Bypass-Cookie' header directed at a honeypot. The header is associated with Vercel's testing features that allow for disabling certain security protections. The article…
SANS ISC -
VECT ransomware flaw destroys large files, researchers warn
Check Point Research has analysed VECT 2.0, a ransomware-as-a-service that targets Windows, Linux and ESXi with a shared codebase, but presents itself with a professional facade that belies a flawed implementation. The study finds that VECT uses…
Check Point -
Sentinel UEBA adds behavioural tables to AWS CloudTrail logs
Microsoft Sentinel UEBA now extends AWS analysis by enriching CloudTrail logs with behavioural context across hybrid environments, surfacing in two tables: BehaviorAnalytics and Anomalies. The approach moves away from heavy baselining and thresholds, instead…
Microsoft -
Internet outages rise amid govt shutdowns, power cuts and strikes
The first quarter of 2026 saw an unusually high number of prolonged Internet disruptions driven by government-directed shutdowns, power outages and military action, with Uganda, Iran and the Republic of Congo among the most affected. Uganda’s nationwide…
Cloudflare -
GlassWorm malware hides in 73 cloned Open VSX extensions
Over 70 Open VSX extensions published in April are likely sleeper extensions linked to the GlassWorm malware, with Socket later identifying 73 suspicious clones that mirror popular listings. GlassWorm first appeared in the Open VSX registry in October 2025…
SecurityWeek -
US extradites Chinese hacker over COVID 19 mail server hack
A suspected state-linked hacker has been extradited to the US, according to the Department of Justice, after being charged over a series of intrusions carried out between February 2020 and June 2021, some linked to the Silk Typhoon campaign. Xu Zewei, a…
InfosecurityHAFNIUM -
Explaining the Five Stages of the Threat Intelligence Lifecycle
The 5 Stages of The Threat Intelligence Lifecycle describe a structured, continuous process security teams use to transform raw security data into actionable intelligence. The lifecycle begins with Planning & Direction, where intelligence needs are defined…
SOCRadar -
Sevii launches Cyber Swarm Defense, $50 per asset per year
Sevii has unveiled a Cyber Swarm Defense (CSD) mode within its autonomous defence and remediation platform, launched on 28 April 2026. The new mode avoids charging by AI token usage and instead bills per asset protected, with an example price of $50 a year…
SecurityWeek -
Security Leaders Caution Manual Data Transfers Amplify Cyber Risks
According to Cyber360: Defending the Digital Battlespace, a survey of 500 security leaders in government, defence and critical services across the US and UK found that 84% agree that sharing sensitive data across networks heightens cyber risk, while 53%…
The Hacker NewsCl0p -
Zero, Yadea EVs hit by Bluetooth flaws allowing remote hijack
Electric motorcycles from Zero Motorcycles and electric scooters from Yadea are affected by vulnerabilities that, if exploited, could have a physical security and safety impact, according to CISA advisories cited by SecurityWeek. The Zero Motorcycles flaw,…
-
PhantomRPC Windows RPC flaw lets attackers gain SYSTEM privileges
According to Kaspersky, a vulnerability in the Windows Remote Procedure Call (RPC) mechanism allows attackers to elevate privileges to System by impersonating the target service with a fake RPC server. The flaw, named PhantomRPC by Haidar Kabibo, could…
SecurityWeek -
Microsoft fixes Entra ID flaw enabling service principal hijack
Microsoft has fixed a flaw in Microsoft Entra ID that could let attackers hijack service accounts via the Agent ID Administrator role, which manages AI agent identities and access. Researchers found that accounts with only this role could take over arbitrary…
Security Affairs -
Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
Cybersecurity researchers have disclosed details of a critical vulnerability, CVE-2026-25874, affecting Hugging Face’s LeRobot platform, which could allow unauthenticated remote code execution via unsafe deserialization of pickle data. The flaw stems from…
-
German prosecutors probe fake Signal chatbot attacks on officials
Germany’s federal prosecutors have been conducting a preliminary investigation since mid-February 2026 into alleged cyberattacks on Signal accounts, with the government saying the attacks targeted high‑ranking officials, including two government ministers,…
SecurityWeek -
Fake CAPTCHA Scheme Sends Users Costly International SMS Bills
A recent scam utilizing fake CAPTCHA pages has been uncovered, tricking mobile users into unintentionally sending multiple international SMS messages. This scheme, classified as International Revenue Share Fraud (IRSF), exploits the telecom billing systems…
Malwarebytes
