News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 14 May· 57 articles
-
SecurityScorecard Acquires UK Threat Intel Startup Driftnet
SecurityScorecard has acquired Driftnet, LTD., adding another layer of threat intelligence to its third-party risk management platform. Driftnet is a UK-based internet scanning and search engine startup that aims to provide organisations with real time…
Dark Reading -
Cisco Catalyst SD-WAN4 articles this day · The Hacker News first
Cisco SD WAN flaw lets attackers seize control, patch urged · U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog
-
Cisco SD WAN flaw lets attackers seize control, patch urged
A highly sophisticated threat actor is exploiting a critical vulnerability in Cisco Catalyst SD-WAN Controllers, with Rapid7 disclosing CVE-2026-20182, an authentication bypass that allows unauthenticated attackers control over a key network management tool.…
-
U.S. CISA adds a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a flaw in Cisco Catalyst SD-WAN to its Known Exploited Vulnerabilities catalog. The vulnerability, tracked as CVE-2026-20182, carries a CVSS score of 10.0 and affects the SD-WAN…
-
Cisco SD WAN authentication bypass lets attackers gain admin access
CISA has added CVE‑2026-20182 to its Known Exploited Vulnerabilities catalogue, affecting Cisco Catalyst SD‑WAN Controller and Manager products. The vulnerability, named the Cisco Catalyst SD‑WAN Controller Authentication Bypass Vulnerability, allows an…
-
Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
Cisco has released updates to fix a maximum-severity authentication bypass in the Catalyst SD-WAN Controller, which has been exploited in limited attacks. According to Rapid7, which discovered CVE-2026-20182, the flaw stems from a malfunction in the peering…
-
-
CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS
CVE-2026-0265 is an authentication bypass in Palo Alto Networks PAN-OS, with Palo Alto Networks publishing a security advisory on 13 May 2026. The flaw allows a remote unauthenticated attacker with network access to bypass authentication when Cloud…
-
Zero day YellowKey exploit rapidly bypasses Windows 11 BitLocker
A zero-day exploit circulating online allows people with physical access to a Windows 11 system to bypass default BitLocker protections and gain complete access to an encrypted drive within seconds, a threat described in Ars Technica as YellowKey. The…
Ars Technica -
Linux3 articles this day · Infosecurity first
Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root · Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access
-
Fragnesia Flaw CVE-2026-46300 Allows Local Users to Gain Root
Researchers have disclosed a new Linux kernel privilege-escalation flaw, Fragnesia, tracked as CVE-2026-46300, which could let local attackers gain root by corrupting the kernel page cache. The bug affects the XFRM ESP-in-TCP subsystem and enables arbitrary…
-
Linux Kernel Flaw Fragnesia Lets Local Users Gain Root Access
SecurityWeek reports a new Linux kernel vulnerability, Fragnesia, tracked as CVE-2026-46300, which resides in the kernel’s XFRM ESP-in-TCP subsystem and could allow a local attacker to escalate privileges to root by overwriting sensitive system files. A PoC…
-
New Fragnesia Flaw Hands Linux Local Users Root Access
A new variant in the Dirty Frag family of Linux local privilege escalation flaws has surfaced, described as Fragnesia and tracked as CVE-2026-46300, according to new analysis from cloud security firm Wiz. The vulnerability, discovered by William Bowling of…
-
-
Malicious node ipc npm packages steal secrets via HTTPS and DNS
Cybersecurity researchers have flagged malicious activity in three published versions of the node-ipc npm package, specifically node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1, with early analysis from Socket and StepSecurity describing obfuscated…
The Hacker News -
FrostyNeighbour Uses Spear Phish PDFs to Hit EU Govt Targets
A Belarussian cyberespionage group, FrostyNeighbor, is back with a threat campaign aimed at Eastern European government and military organisations in Poland and Ukraine, according to ESET research. The campaign began in March and continues to evolve its…
Dark ReadingFrostyNeighbor -
Malicious node ipc npm release exfiltrates cloud secrets
StepSecurity has detected multiple malicious releases of the widely used node-ipc npm package, with three confirmed compromised versions: node-ipc@9.1.6, node-ipc@9.2.3, and node-ipc@12.0.1. The obfuscated payload is designed to fire when the package is…
StepSecurity -
Palo Alto fixes critical PAN OS bug after EarthWorm exploits
According to The Hacker News, Palo Alto Networks has released the first round of fixes for CVE-2026-0300, a critical PAN-OS flaw in the User-ID Authentication Portal that could let an unauthenticated attacker execute arbitrary code with root privileges; the…
-
Securing Autonomous AI Agents by Bounding the Application Layer
Defence in depth for autonomous AI agents emphasises that security decisions must be made across multiple layers, with the application layer being the decisive one for safe production use. The article outlines four mutually reinforcing patterns: design…
Microsoft -
Broadcom releases VMware Fusion security update for root access bug
Broadcom has released a security update for VMware Fusion to fix a high-severity flaw, tracked as CVE-2026-41702, which could allow local attackers to escalate privileges to root on affected systems. The vulnerability is a time-of-check time-of-use (TOCTOU)…
-
Secret Blizzard’s Kazuar malware hits govts with P2P botnet
Kazuar is a sophisticated malware family attributed to the Russian state actor Secret Blizzard and described as a modular peer-to-peer botnet designed to provide persistent, covert access for espionage purposes. The threat group has historically targeted…
MicrosoftTurla -
FDMTP backdoor v3.2 update tied to Mustang Panda espionage
An updated variant of the FDMTP backdoor has been observed in a months-long espionage campaign aimed at networks in the Asia-Pacific and Japan, with researchers claims that the activity is linked to the China-aligned group Mustang Panda. According to…
InfosecurityMUSTANG PANDA -
When configuration becomes a vulnerability: Exploitable misconfigurations in AI apps
AI and agentic deployments across cloud-native platforms are increasingly prioritising speed over secure configuration, leading to exploitable misconfigurations when public exposure pairs with weak or missing authentication. According to Microsoft Defender…
Microsoft -
Belarus aligned Ghostwriter hits Ukraine via Ukrtelecom phishing
The Ghostwriter group, described as Belarus-aligned, has been attributed with a fresh wave of attacks against Ukrainian government organisations, according to The Hacker News. Since March 2026, the latest activity seen involves spear-phishing PDFs that drop…
The Hacker NewsGhostwriter -
Broadcom patches ESXi zero day, urges DPU security for AI DCs
In March 2025, Broadcom patched a series of VMware ESXi zero-day vulnerabilities that could escape the VM sandbox entirely, highlighting how a single compromise can disable or encrypt dozens of virtual machines at once. In 2023, the ESXiArgs campaign…
SecurityWeek -
F5 NGINX Plus2 articles this day · SecurityWeek first
NGINX Rift flaw lets attackers run code with one HTTP request · F5 fixes NGINX heap overflow and iControl REST command injection
-
NGINX Rift flaw lets attackers run code with one HTTP request
Researchers at depthfirst disclosed a critical 18-year-old heap buffer overflow in NGINX, tracked as CVE-2026-42945 and named NGINX Rift, affecting both NGINX Open Source and NGINX Plus. The flaw has a CVSS v4 score of 9.2 and lies in the…
-
F5 fixes NGINX heap overflow and iControl REST command injection
F5 on 14 May 2026 announced fixes for over 19 high-severity and 32 medium-severity vulnerabilities affecting BIG-IP, BIG-IQ, and NGINX. Based on CVSS scores, the most severe issue is CVE-2026-42945, a DoS in NGINX’s ngx_http_rewrite_module with a CVSS v4.0…
-
-
Google launches Android Intrusion Logging to track spyware
Google has rolled out a feature to help investigate spyware attacks on Android devices, called Android Intrusion Logging, as part of Android Advanced Protection Mode (AAPM). The tool was released on 12 May 2026 and is designed to let high‑risk users log…
Infosecurity -
AI security startups draw record funding, outpacing M&A by $1bn
AI-driven cybersecurity funding has surged this year, with investment in AI security startups in 1Q26 surpassing AI acquisitions by more than $1 billion, a rare shift in the market, according to Dark Reading. Momentum Cyber’s report shows 108 deals in Q1,…
Dark Reading -
Mythos Proves Potent in Vulnerability Discovery, Less Convincing Elsewhere
Mythos appears to be as powerful as claimed at detecting software vulnerabilities, but its capabilities in other areas are more nuanced, according to SecurityWeek’s review. Independent benchmarking by XBOW found Mythos is extremely strong for source code…
SecurityWeek -
Akamai to buy AI focused browser security firm LayerX for $205m
According to SecurityWeek, Akamai has agreed to acquire LayerX, a company specialising in AI and browser security, for roughly $205 million. The deal will allow Akamai to expand its Zero Trust and application security portfolio with AI usage control…
SecurityWeek -
Alleged Dream Market admin arrested in Germany
According to The Record, German and U.S. authorities arrested Owe Martin Andresen, 49, during a May 7 raid on three locations, on multiple charges of money laundering. An indictment unsealed this week by the DOJ accused Andresen of being the main…
DataBreaches -
Salt Typhoon hits Azerbaijani energy firm via Exchange exploit
SecurityWeek reports that Salt Typhoon, also known as Earth Estries, FamousSparrow, GhostEmperor, and UNC2286, expanded its targets to include an Azerbaijani energy company, with Bitdefender noting the activity between December 2025 and February 2026. The…
SecurityWeekGhostEmperor -
Siemens SIPROTEC 5 devices at risk from weak session ID flaw
Siemens SIPROTEC 5 devices are vulnerable because their session identifiers are not generated from sufficiently random numbers, potentially allowing an unauthenticated remote attacker to hijack a valid user session by brute-forcing the ID, according to the…
-
CISA alerts to Siemens HMI vulnerability permitting browser access
The Cybersecurity and Infrastructure Security Agency has published an ICS Advisory titled Siemens SIMATIC (ICSA-26-134-07), released on 14 May 2026. It outlines a vulnerability in SIMATIC HMI Unified Comfort Panels before V21.0 that could allow an…
-
Critical Path Traversal Flaw in Siemens ROS# File Server Exposed
According to Siemens ProductCERT SSA-357982, Siemens ROS# contains a ROS service file_server that before version 2.2.2 exposes a path traversal vulnerability allowing a remote attacker to read and write arbitrary files on the system hosting the service. The…
-
Siemens gWAP hit by RCE flaw via Axios library, patch now advised
Siemens gWAP is affected by a remote code execution vulnerability introduced through a third‑party component, the Axios HTTP client library, with a specific Gadget attack chain enabling prototype pollution in third‑party dependencies. According to Siemens…
-
Siemens SIMATIC CN 4100 hit by CVE-2024-47704, urges V5.0 update
According to the ICS Advisory “Siemens SIMATIC” released on 14 May 2026, Siemens SIMATIC CN 4100 is listed as affected by a suite of Linux kernel and related components vulnerabilities (CVEs such as CVE-2024-47704, CVE-2024-57924, CVE-2025-6021,…
-
Siemens Ruggedcom Rox flaw lets attackers run root commands
CISA has published ICS Advisory ICSA-26-134-12, released on 14 May 2026, regarding Siemens Ruggedcom Rox. The advisory warns of an input validation vulnerability in the Scheduler functionality of Ruggedcom Rox, which could allow an authenticated remote…
-
Siemens Industrial Devices Flaw Triggers DoS, Needs Manual Restart
According to Siemens ProductCERT, the Siemens ICS advisory ICSA-26-134-06 warns of a vulnerability in multiple Siemens Industrial Devices that could allow an attacker to trigger a denial of service, with a CVSS v3.1 base score of 7.5. The list of affected…
-
PraisonAI flaw exploited hours after CVE-2026-44338 disclosure
Threat actors have been observed attempting to exploit PraisonAI CVE-2026-44338 within hours of its disclosure, highlighting the rapid exploitation trend noted by Sysdig. The flaw, a CVSS 7.3 authentication bypass, affects PraisonAI’s open‑source multi‑agent…
-
AI hallucinations put critical infrastructure at risk study shows
AI hallucinations are introducing serious security risks by delivering highly confident yet incorrect outputs that mislead critical infrastructure decision‑making. The piece cites a 2025 Artificial Analysis AA-Omniscience benchmark which found that, across…
The Hacker News -
G7 Publishes AI SBOM Guidance to Boost Supply Chain Transparency
G7 countries this week published joint AI SBOM guidance aimed at helping organisations create a software bill of materials for AI, with the document titled Software Bill of Materials for AI – Minimum Elements and seven clusters designed to boost transparency…
SecurityWeek -
Kimsuky updates PebbleDash and AppleSeed with HelloDoor backdoor
Kimsuky, a Korean-speaking threat actor, has expanded its PebbleDash and AppleSeed toolset in a string of campaigns, with PebbleDash variants such as HelloDoor, httpMalice and MemLoad, and AppleSeed variants including HappyDoor. The group delivers…
securelist.comKimsuky
