News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 30 Apr· 53 articles
-
Two US cyber pros jailed for BlackCat ransomware extortion scheme
According to the DOJ’s press release, two American cybersecurity professionals, Ryan Goldberg and Kevin Martin, were sentenced today to four years in prison each for their role in a conspiracy to extort through ransomware in 2023. The court documents state…
DataBreachesBlackCat -
US Extradites German Over Dark Web Marketplace Versus Project
The article reports that a German national living in Colombia has been extradited to the United States on charges of owning and operating “The Versus Project,” a dark web marketplace. According to the Department of Justice, Versus Project operated from about…
DataBreaches -
WebPros cPanel & WHM and WP2 (WordPress Squared)3 articles this day · SecurityWeek first
“to recover your files, kindly send 0.1 BTC to…” ransom note appears on websites · CISA flags critical cPanel WHM auth flaw allowing remote takeover
-
“to recover your files, kindly send 0.1 BTC to…” ransom note appears on websites
A ransom note demanding 0.1 BTC appeared on Naturalsciences[.]org, with the site briefly down for construction and later returning online. The attack is described as linked to the CPanel/WHM vulnerability identified as CVE-2026-41940, though not all victims…
-
CISA flags critical cPanel WHM auth flaw allowing remote takeover
On 30 April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑41940 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects WebPros’ cPanel & WHM and WP2 (WordPress Squared) platforms. It is tracked as the…
-
Critical cPanel Auth Bypass (CVE-2026-41940) Exposes 1.5M Servers
SecurityWeek reports that hackers have been exploiting a critical authentication bypass in cPanel & WHM, tracked as CVE-2026-41940, with a CVSS score of 9.8, since February 23, 2026, according to KnownHost via a Reddit post and other industry observers. The…
-
-
Fake AI Browser Extensions Steal Data and Deploy RATs
Unit 42’s analysis identifies 18 AI browser extensions marketed as productivity tools that are not as they seem, including ones that surveil emails, intercept prompts and exfiltrate passwords. The report shows these high‑risk extensions can deliver remote…
unit42.paloaltonetworks.com -
SAP npm Packages Compromised to Steal Cloud Secrets
TeamPCP’s latest supply chain campaign targets SAP’s cloud development ecosystem by compromising four SAP npm packages within the Cloud Application Programming Model (CAP) and Cloud MTA Build Tool (MBT). The four packages—@cap-js/sqlite v2.2.2,…
Dark ReadingTeamPCP -
Linux Kernel3 articles this day · Security Affairs first
Nine year old Linux bug CVE-2026-31431 lets users gain root · CopyFail Exploit Goes Public, Puts Linux Systems at Root Risk
-
Nine year old Linux bug CVE-2026-31431 lets users gain root
Researchers have identified a nine-year-old Linux root-escalation bug, dubbed Copy Fail, designated CVE-2026-31431, after an hour of AI-assisted scanning. The flaw lets any local user write four specific bytes to the in-memory copy of a readable file,…
-
CopyFail Exploit Goes Public, Puts Linux Systems at Root Risk
Publicly released exploit code for CopyFail, a local privilege escalation tracked as CVE-2026-31431, has left defenders scrambling as it threatens virtually all Linux releases with root access. The exploit was released by researchers from Theori on Wednesday…
-
Linux Kernel Bug CVE-2026-31431 Lets Users Gain Root
Copy Fail, a Linux kernel flaw tracked as CVE-2026-31431, is described as a logic bug that lets any local unprivileged user write four controlled bytes into the page cache of a readable file, enabling escalation to root on major distributions. According to…
-
-
Scammers hijack PayPal emails to push fake tech support calls
Scammers are exploiting PayPal's email system to deliver tech support scams. They manipulate the subject lines of legitimate PayPal notifications to mislead users into believing a significant charge is pending, prompting them to call the number listed, which…
Malwarebytes -
Claude Mythos AI can find zero day bugs, experts warn
On 7 April, Anthropic announced that its latest large language model, Claude Mythos, could identify and exploit software vulnerabilities at machine speed, raising alarms about an AI red teamer accessible to potential threat actors. According to Anthropic,…
Dark Reading -
Anthropic launches Claude Security to speed AI flaw detection
Anthropic has introduced Claude Security to counter the rapid rise of AI-powered exploitation, with the company stating Mythos means attackers could reach exploit times in minutes. The product is now available in public beta to Claude Enterprise customers,…
SecurityWeek -
AI driven cybercrime cuts exploit time to 48h, warns study
Industrialized cybercrime is accelerating attacks through AI, automation and rapid data sharing, with defenders urged to match pace using similarly swift defensive tools. FortiGuard’s Global Threat Landscape Report notes that time-to-exploit has collapsed…
SecurityWeek -
North Korean IT Worker Fraud Becomes a Growing Insider Threat
Posted on 30 April 2026, this piece notes that last month, our research on DPRK IT worker fraud made headlines on NBC News. It emphasises that this is not a traditional cyber threat but a human one, and that these operations will continue to evolve, scale,…
DataBreaches -
Teenager Held Over Leak of 19 Million French ID Records
A 15-year-old has been arrested following a cyberattack on France’s National Agency for Secure Titles (ANTS). The breach, reported to have occurred on 13 April 2026, exposed approximately 19 million ID records containing passport, national ID card, and…
DataBreaches -
BIS Agent Claims WhatsApp Encryption Is Fake, Launches Probe
A BIS special agent claimed in early 2026 that Meta’s WhatsApp encryption is fake and that the company can access and store all user messages in an unencrypted form, a claim that prompted an internal probe nicknamed “Operation Sourced Encryption.” After…
Security Affairs -
Lightning PyPI Package Hijacked for Credential Stealing Attack
The Hacker News reports that the Python package Lightning on PyPI was compromised to push two malicious versions, 2.6.2 and 2.6.3, both published on 30 April 2026, in an extended supply chain campaign aimed at credential theft. According to security…
The Hacker News -
Shai Hulud worm hijacks Intercom SDK to steal cloud credentials
According to StepSecurity, the Shai-Hulud worm has pivoted to a multi-cloud credential sweep with intercom-client@7.0.4, the official Intercom Node[.]js SDK, boasting 361,510 weekly downloads. The malicious version was published today at 14:41 UTC via a…
StepSecurity -
Ukraine Trio Arrested for Roblox Phishing Scheme That Stole $225k
Three people have been arrested in Ukraine over suspected involvement in a phishing and malware scheme that targeted Roblox, with the Prosecutor General’s Office of Ukraine saying a 19-year-old from Drohobych and two others aged 21 and 22 were taken into…
Infosecurity -
Microsoft adds agent threat detection to Defender, links GitHub
According to Microsoft Security, the latest updates spotlight new capabilities in the Agent 365 tooling gateway, with Defender features now available in preview to detect, block and investigate anomalous behaviour of AI agents in near real time. The…
Microsoft -
Ukrainian police arrest trio behind Roblox account theft ring
Hackers stole over 610,000 Roblox accounts, including valuable 'elite' accounts, generating around $225,000 from their sale. The Ukrainian authorities arrested three suspects involved in distributing malware disguised as game enhancements to steal login…
Malwarebytes -
Lightning PyPI package compromised, steals secrets via JS payload
On 30 April 2026, a supply chain compromise was identified in the lightning PyPI package, affecting versions 2.6.2 and 2.6.3. On import, a daemon thread silently downloads the Bun JavaScript runtime from GitHub and executes router_runtime.js, an 11 MB…
StepSecurity -
Stealthy Python backdoor Deep#Door targets Windows for spying
Deep#Door is a stealthy Python-based backdoor framework identified as targeting Windows systems, capable of long-term surveillance and credential theft. According to Securonix, the malware, dubbed Deep#Door, uses an obfuscated batch script to deploy a…
Infosecurity -
Email threat landscape: Q1 2026 trends and insights
In Q1 2026, Microsoft Threat Intelligence detected 8.3 billion email-based phishing threats, with a decrease in volume from January to March. Notably, QR code phishing saw a 146% increase, becoming the fastest-growing attack vector. Credential phishing…
Microsoft -
SonicWall Urges Immediate Patching of Firewall Vulnerabilities
SonicWall on Wednesday rolled out fixes for three SonicOS vulnerabilities, urging customers to immediately patch their Gen 6, Gen 7, and Gen 8 firewalls, with one high-severity and two medium-severity flaws. According to SonicWall advisory, the high-severity…
-
Malicious Code Infects SAP NPM Packages in Mini Shai Hulud Attack
Four SAP NPM packages were found injected with malicious code in a supply chain attack dubbed Mini Shai-Hulud. On April 29, four package versions were flagged as malicious: npm mbt 1.2.48, npm @cap-js/db-service 2.10.1, npm @cap-js/postgres 2.2.2, and npm…
SecurityWeek -
Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
According to Krebs on Security, a Brazilian tech firm that specialises in network protection has been linked to enabling a botnet used in an extended campaign of massive DDoS attacks against Brazilian ISPs. The exposed file archive allegedly contained…
-
New zero trust guide helps secure OT in critical infrastructure
According to Infosecurity Magazine, a new joint guide detailing how to apply zero-trust principles in operational technology environments has been released by US government agencies, led by the US Cybersecurity and Infrastructure Security Agency (CISA)…
Infosecurity -
SMS blaster bust, OpenEMR flaws, 600K Roblox accounts hacked
ThreatsDay Bulletin: SMS Blaster Busts, OpenEMR Flaws, 600K Roblox Hacks and 25 More Stories provides a snapshot of a busy week in cybersecurity, noting the bulletin covers 25 stories in total. Canadian authorities have arrested three men for operating an…
-
Oracle Red Bull Racing Uses 1Password to Speed Wind Tunnel Reset
Oracle Red Bull Racing has recently accelerated security automation by implementing 1Password tools for automation, credential access, governed access and SaaS management, with the partnership kicking off in February 2025. The system acts as a central…
Dark Reading -
Cloudflare rolls out post-quantum IPsec supports Cisco & Fortinet
Post-quantum encryption for Cloudflare IPsec is generally available, with Cloudflare using hybrid ML-KEM to protect IPsec traffic and stop harvest-now-decrypt-later attacks. According to the article, ML-KEM is specified in the draft-ietf-ipsecme-ikev2-mlkem…
Cloudflare -
UK education sees rise in cyber breaches as phishing dominates
The British public education sector has faced a significant increase in cyber breaches over the past year, despite stable threat levels recorded in the UK. According to Cyber Security Breaches Survey 2025/2026, released on 30 April 2026 by DSIT and the Home…
Infosecurity -
Stealthy Python backdoor DEEP#DOOR harvests data via Rust tunnel
Cybersecurity researchers have detailed a stealthy Python-based backdoor framework named DEEP#DOOR that promises persistent access and the harvesting of a wide range of sensitive information from compromised hosts, disclosed in a report published on 30 April…
The Hacker News -
Critical Gemini CLI flaw lets attackers run arbitrary host code
SecurityWeek reports a critical remote code execution flaw in Gemini CLI, an open source AI agent that provides lightweight access to Gemini from a terminal, which could allow an attacker to run commands on the host by planting a malicious configuration in…
SecurityWeek -
AI speeds up flaw hunting, leaving defenders chasing shadows
In Darktrace’s Mythos vs Ethos piece, Andrew Hollister explains that AI systems such as Mythos are accelerating vulnerability discovery to the point where attackers may exploit flaws before public disclosure, undermining the traditional CVE-driven model. The…
darktrace.com -
ABB PCM600 flaw lets attackers execute code via crafted messages
The ABB PCM600 ICS Advisory ICSA-26-120-02 was released on 30 April 2026. According to CISA, the advisory states that successful exploitation of this vulnerability could allow an attacker to send specially crafted messages to the system node, resulting in…
-
ABB Symphony Plus PostgreSQL bug enables remote code execution
According to ABB PSIRT 7PAA017341, the ABB Ability Symphony Plus Engineering product lines are affected by vulnerabilities in PostgreSQL version 13.11 and earlier, which could allow an authenticated PostgreSQL user to execute arbitrary code if they gain…
-
Remote flaws in EnOcean SmartServer expose buildings to hacking
EnOcean SmartServer Flaws Expose Buildings to Remote Hacking reports that two vulnerabilities, tracked as CVE-2026-22885 and CVE-2026-20761, were uncovered by Claroty researchers in EnOcean’s SmartServer IoT platform. According to Claroty, these flaws can be…
-
Lazarus linked EtherRAT spreads via GitHub facades, Ethereum C2
The EtherRAT distribution campaign described by The Hacker News in April 2026 uses a multi-layered GitHub facade approach to deliver malicious MSI installers impersonating common administrative tools, aided by aggressive SEO poisoning across search engines…
The Hacker News
