News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 6 May· 48 articles
-
Student tricks rail system, halts Taiwan high speed trains
A 23-year-old university student spoofed signals and triggered an emergency alarm that stopped four Taiwan High-Speed Rail trains for nearly an hour, disrupting services during the Qingming Festival holiday. Authorities say the attacker used a…
Security Affairs -
Young hacker jailed 6.5 years for $250M crypto scam nationwide
GothFerrari, real name Marlon Ferro, was sentenced to 78 months in prison in connection with a sprawling social engineering conspiracy that stole well over $250 million in cryptocurrency from victims across the United States. According to the U.S. Attorney’s…
DataBreaches -
VoidStealer Finds New Way to Break Chrome AppBound Encryption
Authors of the VoidStealer Trojan have uncovered a new method to bypass Google Chrome’s App-Bound Encryption (ABE), enabling infostealers to harvest cookie data and other secrets from Chrome. The bypass marks another successful sidestep of Chrome’s ABE,…
Dark Reading -
ShinyHunters3 articles this day · DataBreaches first
Instructure Canvas breach leaks data of 275M users · Instructure Canvas breach exposes 275 million education records
3 outlets-
Instructure Canvas breach leaks data of 275M users
Instructure, the maker of the Canvas learning management system, disclosed on May 1 a data breach in which a threat actor stole identifying information of users at affected institutions. The attack, claimed by ShinyHunters, involved exfiltrating about 3.65TB…
Dark Reading -
Instructure Canvas breach exposes 275 million education records
According to Malwarebytes, Instructure, the company behind the Canvas learning management system, confirmed a cyber incident and subsequent data breach affecting its cloud-hosted environment. The ShinyHunters ransomware group claims it is behind the attack…
Malwarebytes -
ShinyHunters Leaks 119k Vimeo Users' Emails After April Hack
According to Have I Been Pwned, the ShinyHunters extortion gang stole personal information belonging to over 119,000 people after hacking the Vimeo online video platform in April. Vimeo is a video hosting and streaming platform publicly traded on the Nasdaq…
DataBreaches
-
-
Romanian hacker extradited to US over 17 year old vishing fraud
Romanian national Gavril Sandu, aged 53, has been extradited to the United States nearly 17 years after a hacking scheme. Indicted in 2017, Sandu was arrested in Romania on 9 January 2026 and transferred to U.S. custody on 30 April 2026. He faces one count…
Security Affairs -
New Mirai style botnet hijacks Android ADB for DDoS for hire
According to Hunt[.]io, researchers have exposed a Mirai-derived botnet that self-identifies as xlabs_v1 and targets devices with an exposed Android Debug Bridge, enlisting them into a DDoS-for-hire network. The malware hunts for Android devices running ADB…
The Hacker News -
Palo Alto Networks PAN-OS3 articles this day · Security Affairs first
CVE-2026-0300 flaw in Palo Alto firewalls grants root access · Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)
-
CVE-2026-0300 flaw in Palo Alto firewalls grants root access
CISA has added CVE-2026-0300 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Palo Alto Networks PAN-OS, specifically the User‑ID Authentication Portal (Captive Portal) service on PA‑Series and VM‑Series firewalls. The vulnerability,…
-
Critical Buffer Overflow in Palo Alto Networks PAN-OS User-ID Authentication Portal (CVE-2026-0300)
On May 6, 2026, Palo Alto Networks published a security advisory for CVE-2026-0300, a critical unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal that affects PA-Series and VM-Series firewalls, with Prisma Access, Cloud NGFW, and…
-
Critical PAN-OS flaw CVE-2026-0300 under attack, patch due May
Palo Alto Networks has warned of a critical PAN-OS flaw, tracked as CVE-2026-0300, that is being actively exploited in the wild and carries a CVSS score of 9.3. The advisory describes a buffer overflow in the User-ID Authentication Portal (the Captive…
-
-
DENIC .de DNSSEC slip triggers SERVFAIL, Cloudflare intervenes
On May 5, 2026, at roughly 19:30 UTC, DENIC, the operator for the .de TLD, began publishing incorrect DNSSEC signatures for the .de zone, causing any validating resolver to reject them and return SERVFAIL, including 1.1.1[.]1, Cloudflare’s public resolver.…
Cloudflare -
Missouri Regulators Seek Answers From Conduent Over 2024 Breach
Missouri regulators are escalating their response to a cybersecurity breach at Conduent Business Services that could affect millions of consumers. The investigation has centred on Conduent, a vendor that handles insurance documents, processes insurance claim…
DataBreaches -
Banks Sue Over Vendor Breach Despite External Data Leak
A recent high-profile incident shows how vendor-driven data breaches can trigger litigation against financial institutions, with at least two putative class actions filed within weeks of a bank confirming a third-party breach, even though the alleged conduct…
DataBreaches -
Chrome Silently Installs 4GB AI Model Without User Consent
Google Chrome has been quietly downloading a 4GB AI model onto users’ devices without asking first, revealing a file called weights[.]bin stored in the OptGuideOnDeviceModel directory within Chrome profiles. The 4GB download occurs automatically when the…
Malwarebytes -
Microsoft Tops KuppingerCole 2026 AI SOC Leader Report
Microsoft has been named an Overall Leader and the Market Leader in KuppingerCole Analysts’ 2026 Emerging AI Security Operations Center (SOC) report, published as part of a shift toward intelligence‑driven security operations. The analysis notes that…
Microsoft -
ClickFix campaign uses fake macOS utilities lures to deliver infostealers
Microsoft researchers describe a shift in the ClickFix infostealer campaign, which uses fake macOS utilities and seeks to lure users via blog posts and other content platforms to install malware such as Macsync, Shub Stealer, and AMOS. In this iteration,…
Microsoft -
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
According to Elastic Security Labs, TCLBANKER is a Brazilian banking Trojan spreading via WhatsApp and Outlook, and is tracked as REF3076, a major update of MAVERICK/SORVEPOTEL family. The campaign features a loader with anti-analysis and two embedded…
elastic.co -
Malware hijacks Phone Link to steal SMS OTPs from Windows PCs
CloudZ Malware Abuses Phone Link to Steal SMS OTPs, a Windows malware toolkit observed to hijack Microsoft’s Phone Link to harvest SMS messages and one-time passwords from victim machines. The activity has been ongoing since at least January 2026, according…
Infosecurity -
XBOW secures $35M Series C extension, pushing valuation past $1B
According to SecurityWeek News, autonomous offensive security firm XBOW has announced raising $35 million in an extension to its Series C funding round, bringing total funding to more than $270 million and valuing the company at over $1 billion after the…
SecurityWeek -
MuddyWater3 articles this day · SecurityWeek first
Iranian spies fake Chaos ransomware to steal data via Teams · Iran-linked MuddyWater fakes Chaos ransomware in 2026 breach
3 outlets-
Iranian spies fake Chaos ransomware to steal data via Teams
Iranian cyber espionage was found to be disguising itself as a Chaos Ransomware attack, with Rapid7 reporting that the campaign blended social engineering, credential theft, data exfiltration, and extortion under a ransomware veneer but showed no evidence of…
Security Affairs -
Iran-linked MuddyWater fakes Chaos ransomware in 2026 breach
According to SecurityWeek, the Iran-linked APT group MuddyWater conducted an intrusion in early 2026 that masqueraded as a Chaos ransomware attack, using social engineering, persistence, credential harvesting and data theft without deploying file-encrypting…
SecurityWeek -
MuddyWater hijacks Teams to spread Chaos ransomware false flag
MuddyWater, the Iranian state‑sponsored group also known as Mango Sandstorm, Seedworm and Static Kitten, has been attributed to a ransomware operation described as a false flag by Rapid7. The attack, observed in early 2026, leveraged social engineering via…
The Hacker News
-
-
Herd Security raises $3M to boost AI security training
Herd Security today announced raising $3 million in a funding round led by Aspiron Ventures, with additional support from ForwardSlash VC, Forum Ventures, Rightside Capital, Team Ignite and YPO. Founded in 2025, the San Francisco-based company has built an…
SecurityWeek -
CISA launches CI Fortify to protect critical infrastructure
CISA has urged critical infrastructure operators to plan for remaining operational or recovering quickly if hit by a cyber-attack, launching the CI Fortify initiative on 6 May 2026 as a planning framework for sectors such as water, energy, transportation and…
Infosecurity -
OceanLotus behind ZiChatBot malware in PyPI wheel packages
Kaspersky’s GReAT researchers say OceanLotus is suspected of distributing ZiChatBot malware via malicious wheel packages uploaded to PyPI from July 2025, with three packages designed to imitate legitimate libraries. The packages, uuid32-utils, colorinal and…
securelist.comAPT32 -
Iran linked APT fakes ransomware gang in Teams espionage
An APT group linked to the Iranian government pretended to be a Chaos ransomware affiliate to provide plausible deniability for geopolitical espionage, according to Rapid7 in a report published on 6 May 2026. The intrusion, which Rapid7 says began with…
Infosecurity -
Bun JavaScript runtime abused to deliver NWHStealer infostealer
Attackers are increasingly using a JavaScript runtime called Bun to help spread the Windows infostealer NWHStealer, with Bun distributed bundles embedded in ZIP archives that also contain loaders such as a self-injection loader named dw[.]exe. Bun is…
Malwarebytes -
Hacker News opens submissions for Cybersecurity Stars Awards 2026
According to The Hacker News, the Cybersecurity Stars Awards 2026 is a global program that recognises excellence across the cybersecurity industry and highlights outstanding work that often goes unnoticed. Submissions are now open, with applicants able to…
The Hacker News -
Dark Reading marks 20 years: from Stuxnet to Volt Typhoon
Dark Reading’s feature marks its 20th anniversary by revisiting two decades of cyber events that have shaped risk for security teams, from early Internet worms to modern AI-enabled threats. It spans episodes such as Stuxnet’s sabotage of Iranian centrifuges…
Dark ReadingAnonymous Sudan -
Romanian Extradited for 2009 to 2010 VoIP Vishing, Faces 30 Years
Gavril Sandu, 53, was extradited to the United States for his role in a cybercrime scheme carried out 17 years ago. According to the DOJ, he was indicted by a federal grand jury in 2017, arrested in Romania in January 2026, and extradited to the US in late…
SecurityWeek -
Investors flee DeFi after $14B exit amid North Korean hacks
According to PYMNTS, cryptocurrency investors are exiting the decentralised finance (DeFi) space after two high-profile hacks, with close to $14 billion pulled from DeFi projects in recent weeks, the Financial Times reported, citing data firm DefiLlama. The…
DataBreaches -
Apache fixes HTTP/2 double‑free bug that could lead to RCE
Apache has released updates to fix multiple vulnerabilities in its HTTP Server, including CVE-2026-23918, a double-free flaw in HTTP/2 that could enable remote code execution. The CVSS score is listed as 8.8, and the issue affects version 2.4.66, with a fix…
-
AI agents outrun identity controls, leaving hidden risk
Analysts say AI agents are being deployed faster than enterprises can govern them, with Gartner noting that enterprise adoption of AI agents is accelerating and outpacing governance policy maturity in its Market Guide for Guardian Agents. According to Orchid…
The Hacker News -
CISA Tells Critical Firms to Hone Isolation, Recovery Skills
CISA: Critical Infrastructure Must Master Isolation, Recovery outlines new guidance to help US critical infrastructure operators withstand cyberattacks by foreign threat actors. The agency launched CI Fortify, an initiative designed to ensure essential…
SecurityWeek -
Sophisticated Quasar Linux RAT Targets Software Developers
According to Trend Micro, a recently identified Linux backdoor dubbed Quasar Linux (QLNX) targets software developers with a modular, in-memory RAT designed for remote access, surveillance, and credential exfiltration. The implant focuses on stealing…
SecurityWeek -
Kaspersky Adds Filter to Block Fake Stores and Crypto Scams
Securelist’s 06 May 2026 article explains that a “suspicious website” is not strictly phishing but engages in unsafe activities, such as fake online stores, dubious crypto exchanges, or subscription traps, with the overarching category described as sites…
securelist.com -
Google's Android Apps Get Public Verification to Stop Supply Chain Attacks
Google has announced expanded Binary Transparency for Android to counter binary supply chain attacks, with production Android applications released after 1 May 2026 carrying a cryptographic entry confirming their authenticity. The public ledger is intended…
The Hacker News -
UK staff confess selling work logins as insider threat grows
A large share of UK employees have sold their corporate credentials over the past year, according to Cifas. The non-profit fraud prevention service’s Workplace Fraud Trends report is based on responses from 2,000 UK employees in companies with 1,000+ staff…
Infosecurity -
Attackers exploit Phone Link via CloudZ RAT to steal OTPs
According to the Cisco Talos researchers Alex Karkins and Chetan Raghuprasad, the intrusion used a CloudZ remote access tool (RAT) together with a previously undocumented Pheno plugin to facilitate credential theft and potentially capture one-time passwords…
The Hacker News
