News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 8 May· 36 articles
-
RansomHouse2 articles this day · SecurityWeek first
RansomHouse claims it breached Trellix, leaks data on Tor · RansomHouse claims Trellix breach, posts service screenshots
2 outlets-
RansomHouse claims it breached Trellix, leaks data on Tor
RansomHouse, a ransomware group, claimed responsibility for breaching cybersecurity firm Trellix, exposing its internal systems. They published screenshots to support their claims. Trellix confirmed unauthorized access to part of its source code repository…
Security Affairs -
RansomHouse claims Trellix breach, posts service screenshots
RansomHouse has taken credit for the recent attack on the Trellix cybersecurity firm, publishing screenshots to demonstrate access to internal Trellix services. The Trellix source code repository breach was disclosed by the company on its website, with…
SecurityWeek
-
-
ShinyHunters6 articles this day · SecurityWeek first
ShinyHunters claims second Canvas breach, 275m records at risk · Canvas outage hits US school finals, ShinyHunters claims breach
6 outlets-
ShinyHunters claims second Canvas breach, 275m records at risk
ShinyHunters has claimed a second breach of Instructure, the vendor behind the Canvas LMS, hours after Instructure said the incident was over. The group says it breached on 25 April by exploiting exposed cloud infrastructure at a large, well-connected…
Dark Reading -
Canvas outage hits US school finals, ShinyHunters claims breach
Chaos erupted at schools and colleges across the US on Thursday as a cyberattack disrupted Canvas just as students were due to take final exams, with Instructure saying the platform was back online by Friday morning. The company reported that it briefly took…
Ars Technica -
Zara Data Breach: 197,000 Customers Exposed in Third-Party Security Incident
Nearly 197,000 Zara customers have been affected by a third-party security incident connected to Inditex, with exposed data including unique emails, order IDs, product SKUs, geographic locations, purchase history and customer support tickets. Inditex said…
Security Affairs -
Canvas Restored Sparks Debate Over Paying Ransomware Demands
In a DataBreaches[.]Net opinion piece posted on 8 May 2026, the author notes that Canvas was restored and the Instructure leak site listing was removed from the threat actors’ leak site, suggesting that ShinyHunters’ practices usually indicate the victim has…
DataBreaches -
ShinyHunters hijack Canvas logins, threaten schools with leak
ShinyHunters escalates Canvas attacks with school login defacements, Malwarebytes reports on 8 May 2026. Days after confirming a major data breach, Instructure’s cloud‑hosted Canvas environment was breached again, with the group allegedly stealing hundreds…
Malwarebytes -
Canvas outage hits schools as hackers threaten data leak
A system thousands of schools and universities use went offline on Thursday due to a cyberattack, disrupting study as finals approached. According to Associated Press, the hacking group ShinyHunters claimed responsibility for the breach at Canvas, which is…
SecurityWeek
-
-
Polish water plants breached by Russian APT via weak passwords
According to ABW, Poland’s Internal Security Agency, hackers breached ICS at five water treatment plants in 2025, marking one of Europe’s clearest state-linked incursions into industrial control systems managing public water supplies. The affected sites were…
Security AffairsAPT28 -
TCLBANKER trojan uses WhatsApp worm to hit 59 banks
Threat researchers have flagged TCLBANKER, a Brazilian banking trojan described as capable of targeting 59 banking, fintech and cryptocurrency platforms, with Elastic Security Labs tracking it under the moniker REF3076. The malware package combines a loader…
The Hacker News -
BerriAI LiteLLM2 articles this day · CISA first
BerriAI LiteLLM Flaw Exposes Proxy Data, CISA Adds KEV Entry · CISA Adds One Known Exploited Vulnerability to Catalog
-
BerriAI LiteLLM Flaw Exposes Proxy Data, CISA Adds KEV Entry
On 8 May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑42208 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects BerriAI’s LiteLLM product and is named the BerriAI LiteLLM SQL Injection…
-
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The affected CVE is CVE-2026-42208, described as a BerriAI LiteLLM SQL Injection Vulnerability. This vulnerability is…
-
-
Dirty Frag Linux flaw (CVE-2026-43284) lets users gain root
A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking and memory-fragment handling components, including esp4, esp6 (CVE-2026-43284),…
-
Fake call history apps hit Google Play, 7.3M downloads
Cybersecurity researchers have detected fraudulent Android apps on the official Google Play Store that claim to provide access to call histories for any number, only to push users into a subscription that delivers fake data. The 28 apps have collectively…
The Hacker News -
SOCRadar Recognized in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies
SOCRadar Recognized in the 2026 Gartner® Magic Quadrant™ for Cyberthreat Intelligence Technologies confirms the company’s position in the inaugural report for Threat Intelligence, published on 8 May 2026. SOCRadar is positioned as a Visionary, with Gartner…
SOCRadar -
darkworm2 articles this day · The Hacker News first
Student arrested for rail hack amid PamDOORa backdoor $900 sale · New Linux PAM backdoor PamDOORa sold on Russian forum for $1,600
2 outlets-
Student arrested for rail hack amid PamDOORa backdoor $900 sale
SecurityWeek reports the emergence of PamDOORa, a Linux backdoor marketed by a threat actor known as ‘darkworm’ that targets the Linux Pluggable Authentication Module (PAM) stack. The post-exploitation tool is designed to provide persistent SSH access while…
SecurityWeek -
New Linux PAM backdoor PamDOORa sold on Russian forum for $1,600
The Hacker News reports a new Linux backdoor named PamDOORa, advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor calling themselves “darkworm.” The backdoor is PAM-based and designed as a post-exploitation toolkit that enables…
The Hacker News
-
-
Edge loads all passwords into plaintext memory on launch
Microsoft says Edge’s plaintext password behaviour is “by design,” according to Microsoft. A security researcher tested major Chromium-based browsers and found Edge loads the entire password vault into plaintext process memory at startup, where it remains…
Malwarebytes -
AI Agent Identity Budgets Highlight Funding Gaps, Survey Finds
According to Omdia, AI agent projects are triggering markedly different budget dynamics from traditional IAM efforts, with AI agent identities demanding new governance and security measures as they move into production. The research found that 45% of IT…
Dark Reading -
Polish Water Plants Targeted in Cyberattacks on Control Systems
According to ABW, Poland’s Internal Security Agency, there was a significant escalation in cyberattacks on industrial control systems and other OT infrastructure targeting the water sector during 2024 and 2025, with attackers sometimes gaining access to ICS…
SecurityWeek -
Linux Kernel Flaw Lets Local Users Gain Root Access
Security researchers have disclosed a new unpatched Linux kernel vulnerability, codenamed Dirty Frag, which allows an unprivileged local user to gain full root access on most major distributions, including Ubuntu, RHEL, Fedora, AlmaLinux and CentOS Stream.…
Security Affairs -
Braintrust breach exposes AI provider keys for major tech firms
Braintrust, an AI evaluation and observability platform, says hackers accessed an AWS account used by its systems and likely obtained AI provider secrets stored in Braintrust. The incident was discovered on 4 May and customers were informed by email on 5…
SecurityWeek -
ACSC alerts ClickFix Vidar Stealer via hijacked WordPress sites
The Australian Cyber Security Centre (ACSC) has issued a warning about a malicious campaign that exploits the ClickFix social engineering technique to deliver Vidar Stealer, a password‑stealing malware, in a campaign that has targeted infrastructure and…
Infosecurity -
Stealthy Quasar Linux RAT siphons dev credentials in supply chain
A new Linux implant named Quasar Linux RAT (QLNX) is targeting developers’ systems to establish a silent foothold and support a broad post‑compromise capability, including credential harvesting, keylogging, file manipulation, clipboard monitoring, and…
The Hacker News -
Ivanti Endpoint Manager Mobile (EPMM)2 articles this day · SecurityWeek first
CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM · Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks
-
CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM
CVE-2026-6973 is a high-severity remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) on-prem deployments that becomes accessible only after remote authentication with administrative privileges. Ivanti has patched the vulnerability and public…
-
Ivanti patches EPMM zero day CVE-2026-6973 after targeted attacks
Ivanti published its May 2026 security updates for Endpoint Manager Mobile (EPMM) to address five vulnerabilities, including a zero-day that has been exploited in targeted attacks. The exploited flaw, tracked as CVE-2026-6973, is a high-severity improper…
-
-
Study reveals hidden threats in low‑severity security alerts
A new analysis of more than 25 million security alerts across live enterprise environments shows defenders have been quietly avoiding low‑severity information. The dataset includes 10 million monitored endpoints and identities, 82,000 forensic endpoint…
The Hacker News -
PCPJack hijacks cloud, steals credentials after erasing TeamPCP
Security researchers have uncovered PCPJack, a credential theft framework that “worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP,” according to SentinelOne senior threat researcher, Alex Delamotte. The campaign targets…
InfosecurityTeamPCP -
PCPJack worm targets cloud credentials while wiping TeamPCP infections
According to SecurityWeek, a threat actor has launched PCPJack, a worm designed to evict TeamPCP infections and steal credentials, active since late April and targeting credentials across cloud environments such as AWS, Kubernetes and Docker. SentinelOne…
SecurityWeek -
CVE-2025-68670 Flaw in xrdp Allows Attackers to Run Code Remotely
Kaspersky researchers describe CVE-2025-68670 as a remote code execution flaw in the xrdp server that is exploitable before authentication. The bug lies in xrdp_wm_parse_domain_information, which can overflow a 256-byte resultBuffer when processing a domain…
-
Linux Kernel2 articles this day · The Hacker News first
Linux Kernel Flaw Lets Users Gain Root via Page Cache Corruption · Dirty Frag kernel bug enables local root via chained exploits
-
Linux Kernel Flaw Lets Users Gain Root via Page Cache Corruption
Less than two weeks after Copy Fail’s public disclosure (CVE-2026-31431), SANS ISC reports a new Linux local privilege escalation vulnerability, dubbed Dirty Frag, discovered by Hyunwoo Kim (@v4bel). The flaw comprises two sub-vulnerabilities in the xfrm ESP…
-
Dirty Frag kernel bug enables local root via chained exploits
A new unpatched local privilege escalation in the Linux kernel, dubbed Dirty Frag, has been described as a successor to Copy Fail (CVE-2026-31431, CVSS 7.8) and was reported to Linux kernel maintainers on 30 April 2026. According to security researcher…
-
-
Pentagon teams with OpenAI, Google to fuse AI into US forces
May 2026 marks a turning point in the evolution of modern warfare as the Pentagon integrates AI into military operations, transforming cybersecurity, targeting and command systems into a unified warfare architecture. The Pentagon has signed agreements with…
Security Affairs -
Attackers Exploit Claude Extension Bug to Steal Data via AI Agent
A vulnerability in the Claude extension for Chrome could let attackers takeover the AI agent and abuse it for information theft, according to LayerX. The flaw, dubbed ClaudeBleed, combines lax permissions, where any Chrome extension can run commands in…
SecurityWeek -
Canvas Breach Disrupts Schools & Colleges Nationwide
An ongoing data extortion attack against the Canvas platform disrupted classes across the United States on 7 May 2026, after a cybercrime group defaced the login page with a ransom demand. The extortion message claimed data from 275 million students and…
Krebs on Security -
ISC Stormcast May 8 2026: Green Level, Podcast & SANS Training
ISC Stormcast for Friday, 8 May 2026 is published, with the Threat Level listed as green. The page notes a podcast detail, 9924, and includes a reminder to click links to learn more about Johannes Ulrich’s SANS classes. The handler on duty is listed as Guy…
SANS ISC
