News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Fri 15 May· 37 articles
-
Pwn2Own Berlin 2026, Day Two: $385,750 more, Microsoft Exchange falls, and the running total crosses $900K
Pwn2Own Berlin 2026, Day Two, saw researchers earn $385,750 after demonstrating 15 unique zero-days, bringing the running total to $908,750 and 39 vulnerabilities disclosed over two days, with one day remaining. Microsoft Exchange and Windows 11 were among…
Security Affairs -
AI coding surge spurs hidden vulnerability flood, warns report
The Boring Stuff is Dangerous Now argues that AI is reshaping defence expectations as two powerful pressures collide: widespread use of AI coding tools and the potential for AI agents to exploit obscure vulnerabilities. The piece notes that Mandates to use…
Dark Reading -
Microsoft6 articles this day · The Hacker News first
CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list · CVE-2026-42897: Microsoft warns of active Exchange XSS flaw
-
CISA adds Exchange XSS flaw CVE‑2026‑42897 to KEV list
CISA has added CVE‑2026‑42897 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft Exchange Server and is identified as the Microsoft Exchange Server Cross‑Site Scripting Vulnerability. It is a cross‑site scripting issue that…
-
CVE-2026-42897: Microsoft warns of active Exchange XSS flaw
CVE-2026-42897 describes an improper neutralisation of input during web page generation (cross-site scripting) in Microsoft Exchange Server, with Microsoft warning that attackers are actively exploiting the flaw in the wild. According to Microsoft, the…
-
Microsoft Reports Severe Zero-Day Flaw in On-Prem Exchange Servers
According to Infosecurity Magazine, Microsoft has warned of a high-severity zero-day vulnerability that could allow an attacker to send arbitrary code to a victim by crafting an email to an Outlook user. The flaw, tracked as CVE-2026-42897 and rated CVSS…
-
Microsoft warns of zero day Exchange flaw CVE-2026-42897
According to Microsoft, a newly disclosed zero-day vulnerability in Exchange Server, tracked as CVE-2026-42897, has been exploited in attacks and is described as a spoofing and cross-site scripting issue affecting Exchange Server Subscription Edition, 2016,…
-
CISA Adds MS Exchange XSS Flaw CVE-2026-42897 to KEV Catalog
According to CISA, on 15 May 2026 the agency added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The entry is CVE-2026-42897, described as a Microsoft Exchange Server Cross-Site Scripting…
-
Microsoft patches Exchange Server XSS spoof flaw CVE-2026-42897
On 15 May 2026 The Hacker News reported that Microsoft has disclosed a new vulnerability in on‑premise versions of Exchange Server, tracked as CVE-2026-42897 (CVSS 8.1), described as a cross-site scripting spoofing flaw in the web page generation process.…
-
-
Turla’s Kazuar backdoor now powers stealthy peer to peer botnet
Turla has transformed its Kazuar backdoor into a modular peer-to-peer botnet designed for stealth and long-term access to compromised hosts, according to Microsoft Threat Intelligence. The group, which is assessed by CISA to be affiliated with Center 16 of…
The Hacker NewsTurla -
NHS staff viewed Southport attack victims' records unlawfully
An investigation has revealed that nearly 50 staff at a Merseyside hospital group accessed horrific details of the condition of those attacked in Southport. According to HSJ, 48 staff accessed the medical records of a number of victims of the Hart Street…
DataBreaches -
Apple, Meta Warn Canada's Encryption Bill Could Lead to Backdoors
On 15 May 2026, SecurityWeek reports that Apple and Meta are opposing Canada’s Bill C-22, a law-enforcement access bill that they warn could compel tech firms to build encryption backdoors or install government spyware. Meta points to the Salt Typhoon…
SecurityWeekGhostEmperor -
Gremlin Stealer Upgraded with Modular Discord and Crypto Features
A new version of the Gremlin stealer has evolved from a basic credential harvester into a modular toolkit, according to researchers at Palo Alto Networks’ Unit 42. The threat, which first emerged in April 2025, has rapidly evolved over 12 months with new…
Infosecurity -
UNC6671’s BlackFile Uses Vishing and AiTM to Bypass MFA
The article discusses an extortion campaign led by the threat actor UNC6671, operating under the name "BlackFile", which primarily targets organizations through voice phishing (vishing) and single sign-on (SSO) compromise. Key tactics include sophisticated…
Google CloudUNC6671 -
OpenClaw chain lets attackers hijack config and steal data
OpenClaw researchers disclosed four chainable flaws that could enable data theft, privilege escalation, and persistence, collectively dubbed Claw Chain by Cyera. The vulnerabilities span CVE-2026-44112 (TOCTOU race condition in OpenShell that bypasses…
-
JDownloader Installers Hijacked, Deploy Python RAT on Windows
Attackers replaced the JDownloader installer downloads with malware during a compromise window on May 6-7, 2026. The Windows “Download Alternative Installer” links and the Linux shell installer were affected, while other options such as macOS, JAR files,…
Malwarebytes -
New Chat boosts WhatsApp privacy as Instagram DMs lose encryption
Meta’s latest chat privacy moves appear to pull in opposite directions: WhatsApp’s new Incognito Chat, built on a Private Processing baseline, promises chats that are “truly private” and not readable by Meta, while Instagram has removed end‑to‑end encryption…
Malwarebytes -
Dark Reading’s 20‑Year Lookback: Experts Share Key Lessons
As part of Dark Reading’s 20th Anniversary celebrations, the site invited high-profile cybersecurity leaders to pick their favourite Dark Reading column and reflect on it through the lens of history, featuring Robert Hansen (RSnake), Katie Moussouris, Rich…
Dark Reading -
Gentlemen Ransomware Group Suffers Leak After Internal Breach
The Gentlemen, a RaaS group active since mid-2025, suffered a breach of its own backend in early May 2026, exposing internal chat logs, affiliate rosters, ransom negotiation transcripts, operational tooling discussions, and server credentials. The leak…
SOCRadarThe Gentlemen -
American Lending Center Ransomware Breach Exposes 123k Borrowers
According to SecurityWeek, American Lending Center, a California-based non-bank lender that manages a $3 billion portfolio of government-guaranteed small business loans, disclosed that a data breach discovered last year has affected more than 123,000…
SecurityWeek -
Bitdefender tool cuts enterprise attack surface by 30% in weeks
According to Bitdefender's analysis, Bitdefender’s Internal Attack Surface Assessment is a 45-day, low-effort engagement designed for organisations with 250 or more employees, delivering a precise, prioritized map of users, endpoints and tools you can safely…
The Hacker News -
OpenAI renews macOS signing keys after Mini Shai Hulud hack
OpenAI disclosed that two of its employee devices in its corporate environment were affected by the Mini Shai-Hulud supply chain attack on TanStack, with no user data, production systems, or intellectual property compromised or modified in an unauthorized…
The Hacker News -
Cisco Catalyst SD-WAN3 articles this day · The Hacker News first
CVE-2026-20182 Cisco SD WAN flaw grants remote admin access · Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616
-
CVE-2026-20182 Cisco SD WAN flaw grants remote admin access
CVE-2026-20182 is a critical authentication bypass affecting Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage), with the flaw residing in the peering authentication and control-connection handshake.…
-
Cisco patches SDWAN zero day CVE-2026-20182 exploited by UAT8616
Cisco has released patches for another SD-WAN zero-day, the sixth to be exploited in 2026, tracked as CVE-2026-20182. The flaw is described as an authentication bypass that could let a remote attacker gain admin privileges via specially crafted packets and…
-
CISA warns of Cisco Catalyst SDWAN flaw amid active exploitation
According to The Hacker News, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a newly disclosed vulnerability affecting Cisco Catalyst SD-WAN Controller to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian…
-
-
OpenAI staff devices compromised in TanStack supply chain breach
OpenAI was among the organisations affected by the TanStack supply chain attack, with two employee devices infected and credential material exfiltrated from internal source code repositories. The incident began on May 11 when the TanStack project publisher…
SecurityWeekTeamPCP -
Ghostwriter Attack Hits Ukrainian Govt With JS Loader
ESET researchers have uncovered fresh Ghostwriter (aka FrostyNeighbor) activity targeting Ukrainian governmental organisations, active since at least March 2026. The campaign begins with a spear-phishing email carrying a PDF attachment impersonating…
Security AffairsGhostwriter -
Gremlin Stealer Hides .NET Payloads to Bypass Security Checks
Gremlin Stealer’s evolution is examined as the malware moves to hide payloads inside embedded resources, with the latest variant prioritising stealth to evade static analysis. According to Unit 42, the malicious payload is now stored in the .NET Resource…
unit42.paloaltonetworks.com -
TeamPCP releases Shai Hulud worm code, fuels supply chain attacks
The SecurityWeek article reports that the hacking group TeamPCP has released the source code of its Shai-Hulud worm, inviting miscreants to use it in supply chain attacks and offering monetary rewards. The code was posted to GitHub repositories under several…
SecurityWeek -
Cato CTRL discovers China linked TencShell malware in India
An undocumented malware implant suspected to be associated with a China‑linked actor has been identified by researchers at Cato Networks’ Cyber Threats Research Lab (CTRL). Their discovery followed an intrusion attempt affecting the Indian branch of an…
Infosecurity -
Pwn2Own Berlin 2026 - Day Two Results
According to Zero Day Initiative, Day Two of Pwn2Own Berlin 2026 is underway as the stakes rise and security researchers push enterprise systems to their limits. The piece notes that yesterday $523,000 was awarded for 24 unique 0-days, with DEVCORE holding a…
thezdi.com -
Chrome 148 fixes 79 flaws, two critical bugs earn $68k bounties.
Google’s Chrome 148 update patches 79 vulnerabilities, including 14 critical-severity flaws across multiple components, in a release that now shows as version 148.0.7778.167 for Linux and 148.0.7778.167/168 for Windows and macOS. The two highlighted critical…
-
Windows Zero Days YellowKey & GreenPlasma Expose BitLocker Bypass
Security researchers disclosed two Windows zero-day vulnerabilities named YellowKey and GreenPlasma, affecting BitLocker and the Windows CTFMON framework, in a report published on 15 May 2026. The flaws were exposed by a security researcher known as Chaotic…
-
Outlaw Campaign Updates Libssh Client, Drives SSH Key Hijack
This ISC diary notes that the April 2026 activity relates to the existing mdrfckr Outlaw/Dota campaign rather than a new campaign, with a new libssh client version observed between 14 and 21 April 2026. Between 2026-04-14 01:23:41 UTC and 2026-04-21 02:22:56…
SANS ISC -
Pwn2Own Berlin 2026 Day One Sees 24 Zero Days and $523k in Awards
Pwn2Own Berlin 2026, Day One saw 22 entries targeting browsers, operating systems, AI platforms and NVIDIA infrastructure, with researchers unlocking 24 zero‑days and earning a total of $523,000 in rewards, according to Zero Day Initiative. Orange Tsai of…
Security Affairs -
SANS ISC Stormcast Holds Green Level Amid Training Resources
According to SANS™ Internet Storm Center, ISC Stormcast for Friday, 15 May 2026, shares the usual briefing with the threat level listed as green. The diary page identifies Jan Kopriva as Handler on Duty, continuing the ISC practice of appointing rotating…
SANS ISC -
Student spoofs rail radio signal, halts Taiwan bullet trains
A Taiwanese student experimenting with software-defined radio shut down three high-speed bullet trains for nearly an hour, prompting an anti-terrorism response. On 5 April, a 23-year-old train enthusiast used a radio set-up and hardware bought online to…
Dark Reading -
Law Firm DSD Law Leaks 110k Files in Repeated AWS Bucket Error
Dalbir Singh & Associates, P.C. Law Firm—known as DSD Law—had a misconfigured Amazon bucket that exposed client files, with the bucket reportedly containing more than 110,000 files before it was secured again. DataBreaches[.]net first flagged the exposed…
DataBreaches
