News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 7 May· 54 articles
-
Ivanti Endpoint Manager Mobile (EPMM)3 articles this day · The Hacker News first
Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotely · CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patch
-
Ivanti EPMM flaw CVE-2026-6973 lets admins execute code remotely
CISA has added CVE‑2026‑6973 to its Known Exploited Vulnerabilities catalogue, affecting Ivanti’s Endpoint Manager Mobile (EPMM). The vulnerability, named Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability, allows a remotely…
-
CISA flags Ivanti EPMM zero day CVE‑2026‑6973, urges May 10 patch
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in Ivanti Endpoint Manager Mobile (EPMM), tracked as CVE-2026-6973 with a CVSS score of 7.1, to its Known Exploited Vulnerabilities catalog. Ivanti warns the high-severity…
-
Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation Grants Admin-Level Access
Ivanti says a new security flaw affecting Endpoint Manager Mobile (EPMM) has been seen in limited, real-world attacks. The high-severity CVE-2026-6973 (CVSS 7.2) involves improper input validation and affects EPMM versions prior to 12.6.1[.]1, 12.7.0[.]1,…
-
-
ShinyHunters Hit Instructure Canvas Again, Threaten School Data Leak
According to DataBreaches[.]Net, ShinyHunters hacked Instructure again after Instructure failed to contact them to negotiate payment following a previous breach in April, with the threat actors posting a notice to schools about contacting them to negotiate a…
DataBreachesShinyHunters -
DomainTools Investigations | Cybersecurity Reading List - Week of 2026-05-04
The Cybersecurity Reading List for the week of 2026-05-04 gathers a mix of official alerts, research and industry notes, including a report from FBI/IC3 that notes a 26% increase in known losses from 2024. It highlights the UK NCSC’s guidance on defending…
-
Fake Google Authenticator Chrome Extension Hits 260k Users
DTI’s latest edition breaks down how state-backed actors are shifting from one-off attacks to parallel pipelines of espionage and disruption, notably detailing DPRK’s modular malware portfolio and a burn-and-replace approach that enables simultaneous…
dti.domaintools.comLazarus Group -
Palo Alto Networks PAN-OS3 articles this day · The Hacker News first
Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks · Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking
-
Nation-state actors exploit Palo Alto PAN-OS zero-day for weeks
Nation-state actors have been exploiting the PAN-OS zero-day CVE-2026-0300 for weeks, gaining unauthenticated remote code execution and root access on exposed PAN-OS firewalls. According to Palo Alto Networks, after exploitation attackers used tunneling…
-
Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking
SecurityWeek reports that Palo Alto Networks has disclosed exploitation of the recently disclosed zero-day affecting its PA and VM series firewalls, tracked as CVE-2026-0300, with unauthenticated remote code execution and root privileges. The firm said…
-
Palo Alto Networks Warns of Exploits in CVE-2026-0300 PANOS
Palo Alto Networks has disclosed that threat actors may have attempted to exploit a recently disclosed critical flaw as early as 9 April 2026. The vulnerability, CVE-2026-0300, is a buffer overflow in the PAN-OS User-ID Authentication Portal that could allow…
-
-
New PCPJack cloud worm steals secrets via parquet files
After replacing TeamPCP malware, PCPJack is described as a modular cloud worm that steals secrets from multiple cloud environments, including cloud services, wallets and keys, and email and other popular cloud applications. According to SentinelLabs, PCPJack…
Dark Reading -
When prompts become shells: RCE vulnerabilities in AI agent frameworks
According to Microsoft Defender Security Research Team, the article outlines two critical vulnerabilities in Microsoft’s Semantic Kernel, CVE-2026-26030 and CVE-2026-25592, which could allow a prompt injection to escalate to host-level remote code execution.…
-
Cloudflare cuts 1,100 jobs as AI usage soars, reshapes workforce
This afternoon, Cloudflare announced in an internal email that it has decided to reduce its global workforce by more than 1,100 employees. The message explains that the way the company works has fundamentally changed, with AI usage rising by more than 600%…
Cloudflare -
Mozilla’s AI tool Mythos uncovers 271 Firefox flaws in two months
Mozilla says Mythos identified 271 Firefox vulnerabilities over two months, with engineers reporting “almost no false positives” thanks to a harness that guides the AI through testing and verification. Of the 271 bugs, 180 were sec-high, 80 were…
Ars Technica -
Musk vs OpenAI trial spotlights AGI control and safety fears
At the heart of the case is a dispute between Elon Musk and OpenAI’s leaders over how to safeguard humanity from artificial intelligence, with the trial focusing on OpenAI’s origins as a nonprofit and Musk’s bid for greater control. The proceedings have kept…
SecurityWeek -
Stop Traefik fuzzing with Elastic and Cloudflare auto block
On 8 May 2026, Erik-Jan de Kruijf details how to detect web server probing and fuzzing in Traefik using an out-of-the-box Elastic Security ES|QL detection rule to spot repeated 403/404 errors from a single source IP, signalling directory fuzzing or…
elastic.co -
PCPJack worm spreads across cloud, stealing credentials via CVEs
PCPJack is a new credential theft framework that targets exposed cloud infrastructure and spreads worm-like across cloud environments, according to The Hacker News report dated 7 May 2026. Security researchers say the toolset harvests credentials from cloud,…
-
British cybersecurity expert Tom Parker considered for CISA chief
According to Dark Reading, Tom Parker, a British-born cybersecurity expert, has emerged as a possible contender to lead the Cybersecurity and Infrastructure Security Agency (CISA) after a brutal 16 months without a Senate-confirmed director. Parker is…
Dark Reading -
Microsoft backs passwordless push as passkeys hit billions
World Passkey Day marks a push to cut reliance on passwords and phishable authentication by accelerating passkey adoption, as cyberattacks become more automated and AI-powered. Passwords remain a major risk, with phishing still a concern; Microsoft says it…
Microsoft -
Boost Security Raises $4 Million for SDLC Defense Platform
Boost Security has announced raising $4 million in funding to expand its SDLC defence platform, alongside the acquisitions of SecureIQx and Korbit[.]ai to broaden its capabilities. Bringing total funding to $16 million, the round comprises investments from…
SecurityWeek -
Capital One study finds legacy tools block data protection
Legacy Security Tools Are Failing Data Protection, Capital One Software Report Finds, a study released on 7 May 2026 shows that traditional network and perimeter security tools are hindering adequate data protection even as data security becomes more…
Infosecurity -
Keitaro cloaking powers AI themed investment scam with deepfakes
Researchers tracked a large AI‑themed investment scam campaign that spans 15,500 domains, using cloaking and deepfakes to hide from security tools while targeting ordinary users, according to Infoblox. Criminals abused the Keitaro ad‑tracking platform as…
Malwarebytes -
Attackers hijack Claude Code to steal OAuth tokens via MCP proxy
SecurityWeek reports that Mitiga researchers say attackers can silently redirect Claude Code MCP traffic to intercept OAuth tokens, giving them persistent access to connected SaaS platforms. The token theft hinges on a crafted npm post-install hook that…
SecurityWeek -
Cline Kanban server flaw lets sites steal dev data via WebSocket
A critical vulnerability in the Cline Kanban server has been disclosed that allows any website a developer visits to silently exfiltrate workspace data, inject commands into the AI agent's terminal or kill active agent sessions. The flaw, given a CVSS score…
Infosecurity -
Cisco Unity Connection2 articles this day · SecurityWeek first
Cisco patches Unity Connection flaws tracked as CVE-2026-20034/35 · Cisco patches five high severity flaws across enterprise products
-
Cisco patches Unity Connection flaws tracked as CVE-2026-20034/35
Cisco has released patches for several high-severity vulnerabilities in its enterprise products, including two in Unity Connection that could enable code execution or service disruption. The flaws, CVE-2026-20034 and CVE-2026-20035, could allow a remote…
-
Cisco patches five high severity flaws across enterprise products
Cisco says it has patched multiple high-severity flaws across its enterprise product line, addressing five high-severity bugs in total. Two high-severity issues, CVE-2026-20034 and CVE-2026-20035, could enable server-side request forgery in Cisco Unity…
-
-
Chrome 148 Update Fixes 127 Flaws, Including Three Critical Bugs
Chrome 148 has been promoted to the stable channel with 127 security fixes, including three for critical-severity vulnerabilities. The first critical flaw is an integer overflow issue in Blink, tracked as CVE-2026-7896, which could allow remote attackers to…
-
AI models helped hackers target Mexico water utility, report says
Commercial large language models were used as part of a cyber-attack which targeted a municipal water and drainage utility provider in Mexico, according to Dragos. A “significant compromise” of the water infrastructure providers’ IT environment escalated…
Infosecurity -
How AI Powered Phishing Starts Breaches From One Click
According to The Hacker News, the webinar titled The Patient Zero Playbook is pitched as a technical deep dive into how modern breaches start, emphasising that one employee and one click can initiate a stealth breach. The article explains that in 2026…
The Hacker News -
AI vision models fooled by hidden commands in images
Cisco’s AI Threat Intelligence and Security Research team has published the second installment of a study on how vision-language models (VLMs) can be manipulated with bounded pixel-level perturbations to images that already fail as attacks. The researchers…
SecurityWeek -
Disc Soft confirms supply chain hack hit free Daemon Tools Lite
SecurityWeek reports that Disc Soft, the Daemon Tools developer, says a intrusion led to a targeted supply chain attack but that the impact was limited to the free version of Daemon Tools Lite. According to Kaspersky, Chinese-speaking threat actors injected…
SecurityWeek -
Fake Claude site delivers Beagle backdoor via sideloaded updater
A fraudulent imitation of Anthropic's Claude website has been used to distribute a backdoor named Beagle, deployed through a Dynamic Link Library sideloading chain that abuses a signed antivirus updater binary, according to Sophos X-Ops. The malicious domain…
Infosecurity -
AI guided hackers breach Mexico govt, stall on OT leap
A small, unknown band of hackers pulled off what is described as history’s first recorded, AI-directed cyberattack, stealing data from the government of Mexico before failing to bridge IT to OT systems. Between December 2025 and February 2026, the group…
Dark Reading -
One click RCE via Claude Code threatens developer supply chains
SecurityWeek reports that AI coding agents could threaten supply chains, with researchers from Adversa[.]AI finding a way to abuse Claude Code’s automation to enable a one-click remote code execution and potentially trigger a supply chain attack. Adversa…
SecurityWeek -
One‑click TrustFall exploit hijacks Claude Code via bad repo
TrustFall, a one-click exploit demonstrated by Adversa AI, can trigger code execution in Claude Code with minimal or no user interaction, exposing developers to running attacker-controlled code from a malicious repository. According to Adversa AI, this…
-
Cloudflare Blocks Copy‑Fail Linux Flaw Using bpf‑LSM
Cloudflare describes its response to the Copy Fail Linux vulnerability (CVE-2026-31431) as rapid and methodical, beginning assessments within minutes of the public disclosure on 29 April 2026 and confirming that existing behavioural detections could identify…
Cloudflare -
SecurityWeek Webinar Addresses Identity Risks in AI Era
The SecurityWeek webinar titled Webinar Today: Securing Identity Across Humans, Machines and AI examines how identity is evolving as organisations adopt cloud services, automation, machine identities and AI-driven processes. It explains that identity sprawl…
SecurityWeek -
MOVEit Automation flaw CVE-2026-4670 forces rapid patch push
ThreatsDay’s ThreatsDay Bulletin for 07 May 2026 surveys a week of cybercrime and security stories, noting that attackers continue to rely on low-effort methods such as shady packages, fake apps and compromised logins, with AI speeding up exploit hunting and…
-
ChipSoft says ransomware data deleted, but experts seek proof
ChipSoft has provided an update on its ransomware incident, and DigitalShield reports that the company has not disclosed whether it paid the attackers’ ransom, while noting that some negotiations took place. According to DigitalShield, one of the most…
DataBreaches -
Operation HookedWing phishing campaign steals 2,000+ credentials
According to SOCRadar, Operation HookedWing is a four-year, multi-sector phishing campaign active from 2022 to the present that has compromised more than 2,000 credentials from users at over 500 organisations, with logs indicating more than 2,500 unique…
SOCRadar -
Incident Response Needs More Than Just a Retainer Today
Day Zero Readiness argues that having an incident response retainer or an pre-approved external firm is not the same as being prepared to act the moment an incident is declared. Operational readiness is about what responders can do in the first hours, with…
The Hacker News
