News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 29 Apr· 47 articles
-
AI agents can now buy domains and deploy on Cloudflare via Stripe
Cloudflare has announced that coding agents can provision Cloudflare accounts, purchase domains, and deploy applications on production without human intervention, using a new protocol co-designed with Stripe as part of Stripe Projects. Starting today, agents…
Cloudflare -
Talkie AI Model Trained on Before 1931 Texts Explores History
The article discusses a newly developed chatbot named Talkie, created by researchers led by David Duvenaud, which is designed to only have knowledge of the world prior to 1931, reflecting texts published before that year. This 13-billion-parameter language…
Malwarebytes -
BerriAI LiteLLM2 articles this day · SecurityWeek first
LiteLLM flaw CVE-2026-42208 exploited within hours of disclosure · LiteLLM SQL injection flaw (CVE-2026-42208) exposes API keys
-
LiteLLM flaw CVE-2026-42208 exploited within hours of disclosure
Attackers rapidly weaponised a critical flaw in LiteLLM, CVE-2026-42208, to access and potentially modify database data via SQL injection just days after disclosure, according to the article. The vulnerability resides in LiteLLM’s proxy API key verification,…
-
LiteLLM SQL injection flaw (CVE-2026-42208) exposes API keys
A critical-severity vulnerability in the open source AI gateway LiteLLM was exploited days after public disclosure to access database tables containing sensitive information, according to Sysdig. The flaw is described as an SQL injection during the proxy API…
-
-
AI Tools Uncover Critical GitHub RCE Bug CVE-2026-3854
A high-severity vulnerability, CVE-2026-3854 (8.7 CVSS), disclosed yesterday by GitHub affects GitHub Enterprise Server and would allow a repository with push access to achieve remote code execution, according to GitHub. GitHub said the flaw also affected…
-
Critical cPanel Flaw Lets Hackers Hijack Admin Access Remotely
On April 28, 2026, cPanel issued a security update to fix a critical vulnerability affecting the cPanel & WHM and WP Squared products. CVE-2026-41940, which was assigned on April 29, 2026, has a CVSS score of 9.8 and enables unauthenticated remote attackers…
-
openemr2 articles this day · SecurityWeek first
AI audit finds 38 OpenEMR flaws, CVE-2026-24908 leaks PHI · OpenEMR bugs risk patient data leak and remote code execution
-
AI audit finds 38 OpenEMR flaws, CVE-2026-24908 leaks PHI
An AI-powered analysis of the OpenEMR codebase uncovered 38 previously undisclosed vulnerabilities in the open source electronic health record platform used by more than 100,000 healthcare providers worldwide. The flaws, all patched now, range in severity…
-
OpenEMR bugs risk patient data leak and remote code execution
Dozens of vulnerabilities were found in the open source OpenEMR medical records platform, with a security firm identifying 39 issues, 38 of which have CVE identifiers. OpenEMR is used worldwide by more than 100,000 healthcare providers to store data on over…
-
-
TeamPCP2 articles this day · SecurityWeek first
SAP npm Packages Hijacked to Deliver Credential Stealing Bun Loader · Checkmarx Confirms Data Theft After Trivy Supply Chain Breach
2 outlets-
SAP npm Packages Hijacked to Deliver Credential Stealing Bun Loader
Cybersecurity researchers warn of a credential-stealing supply‑chain attack targeting SAP‑related npm packages, including mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2 and @cap-js/sqlite@2.2.2, after malicious releases published on 29 April…
The Hacker News -
Checkmarx Confirms Data Theft After Trivy Supply Chain Breach
Checkmarx confirmed that data theft occurred in its supply chain attack, with exfiltration from its GitHub environment on 30 March 2026, about a week after malicious code was first published. The breach was linked to the Trivy supply chain incident, which…
SecurityWeek
-
-
VECT malware wipes data despite ransom note, researchers warn
VECT Ransomware is a Wiper, Not Ransomware — Don’t Bother Paying, Says Check Point Research reports that researchers examined all three versions of VECT and found a flaw that causes the malware to discard the information needed to reverse encryption, meaning…
DataBreaches -
Microsoft outlines eight point risk review framework for CISOs
According to Microsoft Security Blog, eight points shape a practical risk-review framework for CISOs: Assets, Applications, Good quality authentication, Good quality authorization, Network isolation, Detections, Auditing, and Things not to miss. The piece…
Microsoft -
Sandhills Medical breach leaks 169k records via INC Ransom
Sandhills Medical Foundation in South Carolina notified the Maine Attorney General’s Office on 28 April 2026 that 169,017 people were affected by a data breach, with only eight being Maine residents. According to their notification to those affected, on 8…
DataBreachesINC Ransom -
Vect 2.0 ransomware flaw turns it into a data wiper for big files
The latest Vect 2.0 ransomware variant acts as a wiper due to a design error, destroying large files instead of encrypting them and undermining the possibility of recovering data even if a decryptor is paid for. According to Check Point Software, the flaw is…
Dark Reading -
Cursor extension flaw exposes API keys via SQLite database
A high-severity vulnerability in the AI-powered development tool Cursor allows installed extensions to access sensitive credentials, exposing API keys and session tokens without any user interaction. According to LayerX, the issue stems from how Cursor…
Infosecurity -
WageMole2 articles this day · Infosecurity first
North Korean Hackers Use Supply Chain npm SDK to Steal Secrets · Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets
2 outlets-
North Korean Hackers Use Supply Chain npm SDK to Steal Secrets
Cybersecurity researchers have uncovered a DPRK-linked, AI‑generated malware chain embedded in npm packages, with a tainted dependency designed to exfiltrate secrets from victims’ environments. The campaign, codenamed PromptMink by ReversingLabs, is linked…
The Hacker News -
Malicious npm Dependency Linked to AI Assisted Commit Targets Crypto Wallets
A malicious npm dependency linked to an AI-assisted code commit has been found stealing sensitive data and exposing crypto wallets, with researchers identifying the package @validate-sdk/v2 as the act that enabled exfiltration of secrets from infected…
Infosecurity
-
-
SOCRadar reveals AI driven security tools reshaping SOCs in 2026
SOCRadar’s 25 Best SOC Tools: AI-Powered & Automated Security Guide, published on 29 April 2026, surveys the current landscape of AI-native and automated solutions designed to strengthen security operations centres. The guide groups tools by function—from…
SOCRadar -
Russia leads censorship, blocking media, apps, LGBTQ+ content
The Global Internet Censorship Index 2026 finds that Russia sits at the top of the censorship ranking, blocking a wide range of content including independent media, messaging apps, LGBTQ+ resources, and anti-censorship tools. Researchers tested 74 popular…
Security Affairs -
cPanel patches critical auth flaw, urges admins to update
cPanel has fixed a critical authentication vulnerability that could have allowed attackers to access the control panel, affecting all currently supported versions. The company released security updates and urges administrators to apply them immediately to…
Security Affairs -
Over 200 Japanese firms have paid ransomware attackers; 60% fail to recover data
Data from Japanese firms indicates that paying ransom is unlikely to enable full recovery of encrypted data. According to Japan Today, at least 222 Japanese companies have paid ransomware attackers in the past, yet about 60 percent of them still failed to…
DataBreaches -
AFC hack exposes 150,000 players’ data, Ronaldo among those hit
According to Nogo Mania, a large-scale cyberattack targeted the Asian Football Confederation, exposing sensitive data linked to more than 150,000 players and staff. The breach is described as one of the most serious incidents in football history, with leaked…
DataBreaches -
Pine Bluff School District loses £3.2m to BEC scam
According to THV11 News, Pine Bluff School District is reporting that a cyberattack cost the district millions after a December 17 incident. Officials said a wire transfer of more than $3.2 million was processed for what staff believed was a legitimate…
DataBreaches -
PhantomRPC flaw lets attackers hijack Windows RPC to gain SYSTEM
A vulnerability named PhantomRPC has been identified in Windows Remote Procedure Call (RPC), allowing attackers to escalate privileges to SYSTEM by impersonating legitimate clients via a fake RPC server. Despite the discovery, Microsoft classified it as a…
Malwarebytes -
Honeypots Spot Recon Scans on Broadcom Gateways and ESP32
Two different “new” requests hit the honeypots, and both appear to be recon attempts rather than exploits of specific vulnerabilities. The first targets a Broadcom API Gateway with a GET request to /bam/restart/if/required, from a redacted host on port 8080,…
SANS ISC -
Lotus Wiper wiper deployed in Venezuela energy sector attack
An analysis of a destructive cyberattack targeting the energy and utilities sector in Venezuela, published last week, shows the Lotus Wiper attack used sophisticated living-off-the-land techniques and had no ransomware component, being focused on deleting…
Dark Reading -
Researchers Track 2.9 Billion Compromised Credentials
The threat landscape in 2025 was characterised by a surge in compromised credentials, extortion and vulnerability exploitation, according to a new report from KELA. The threat intelligence firm tracked nearly 2.9 billion compromised credentials last year…
Infosecurity -
Bitdefender uncovers Operation Road Trap smishing in 12 nations
According to Bitdefender Labs, a new mass smishing campaign is spreading fraudulent toll and parking texts to drivers across 12 countries, impersonating DMVs, toll operators and parking authorities. Since December 2025 through April 2026, researchers have…
bitdefender.com -
Exposed VNC servers expose ICS/OT to cyber threats worldwide
Hundreds of Internet-facing VNC servers expose ICS/OT, with Forescout identifying tens of thousands of exposed RDP and VNC servers that can be mapped to specific industries. A Shodan search shows roughly 1.8 million RDP and 1.6 million VNC servers exposed on…
SecurityWeekInfrastructure Destruction Squad -
AI driven attackers seize Domain Admin in Active Directory
According to The Hacker News, a February 2026 shift saw threat actors using custom AI setups to automate attacks directly into the kill chain, with autonomous agents mapping Active Directory and seizing Domain Admin credentials in minutes. The piece notes…
The Hacker News -
Mini Shai-Hulud npm Attack Compromises SAP Packages, Steals Data
According to StepSecurity, a new npm supply chain attack dubbed “Mini Shai-Hulud” has emerged, using preinstall hooks to download the Bun JavaScript runtime and execute an 11 MB obfuscated payload. The campaign has compromised SAP-related npm packages, with…
StepSecurity -
What to Look for in an Exposure Management Platform (And What Most of Them Get Wrong)
The piece argues that exposure management platforms fall into four architectures: stitched portfolio platforms that bundle acquired point products; data aggregation platforms that normalise findings from existing scanners; single-domain specialist platforms…
The Hacker News -
Trivy Supply Chain Attack Hits Checkmarx, Bitwarden via TeamPCP
The article details a continued supply-chain compromise tied to the Trivy vulnerability scanner, which began with a March breach of the Trivy GitHub account on 19 March and extended to Checkmarx when its GitHub account was compromised four days later.…
Ars TechnicaLapsu$ -
Malwarebytes boosts Claude AI with real time scam checking
Malwarebytes has integrated its threat intelligence into the Claude AI platform, making it easier for users to identify online scams. Users can access this feature without an account, simply by linking Malwarebytes to Claude. The integration allows users to…
Malwarebytes -
Vect 2.0 ransomware flaw turns it into unstoppable data wiper
Vect 2.0 ransomware has been found to wipe large, compromised files instead of merely encrypting them, making recovery impossible for victims, according to Check Point researchers. The flaw in the encryption implementation discards three of four decryption…
Infosecurity -
Iran linked Handala warns US troops Bahrain on WhatsApp
Handala, an Iran-linked cyber group, carried out an influence campaign targeting US troops in Bahrain via WhatsApp messages signed with the group’s name, claiming service members were under surveillance and would soon face drones and missiles. The messages…
SecurityWeekHandala -
Darktrace sees Jenkins honeypot used to build game server DDoS bot
Darktrace’s Jenkins honeypot analysis reveals a new DDoS botnet that leverages scriptText abuse in Jenkins to deploy a multi-platform payload and target online game servers. The campaign was first observed on 18 March 2026, with attackers using a Jenkins…
darktrace.com -
One in Four Healthcare Firms Hit by Medical Device Cyber Attacks
A quarter of healthcare organisations report medical device cyber-attacks, with 24% experiencing incidents over the past year that disrupted patient care, according to RunSafe Security. The security vendor polled 551 healthcare professionals across the US,…
Infosecurity -
Namecheap Blocks cPanel Ports After Auth Flaw Disclosed
cPanel has released security updates to address a vulnerability affecting various authentication paths that could allow unauthorized access to the control panel, according to an alert from cPanel. The issue affects all currently supported versions, and fixes…
The Hacker News -
Chrome 147 and Firefox 150 patch critical memory safety flaws
Chrome 147 and Firefox 150 security updates are rolling out, with Google and Mozilla addressing multiple memory-safety vulnerabilities. The Chrome 147 update, now shipping as version 147.0.7727.137/138 for Windows and macOS and 147.0.7727.137 for Linux,…
