News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 18 May· 50 articles
-
Storm-2949 breaches Microsoft 365, Azure after identity takeover
Microsoft Threat Intelligence researchers describe Storm-2949 conducting a two‑phase campaign that began with targeted identity compromise and progressed to cloud infrastructure takeover, exfiltrating data from Microsoft 365, file hosting, and Azure…
MicrosoftStorm-2949 -
Microsoft2 articles this day · The Hacker News first
Microsoft Exchange Zero-Day Under Attack, No Patch Available · Microsoft Exchange zero day bug exploited in the wild
-
Microsoft Exchange Zero-Day Under Attack, No Patch Available
Microsoft on Thursday disclosed a zero-day vulnerability in Exchange that is under active exploitation, and four days later customers were still awaiting a patch. The flaw, tracked as CVE-2026-42897, affects Exchange Outlook Web Access and could allow an…
-
Microsoft Exchange zero day bug exploited in the wild
The Hacker News’ weekly recap for 18 May 2026 surveys a flurry of cyber incidents from Exchange 0‑day exploits to a worm propagating through npm packages. It flags On‑Prem Microsoft Exchange Server CVE-2026-42897 as being exploited in the wild, described as…
-
-
OpenClaw bugs enable full system takeover via chained exploits
Security researchers have disclosed four new vulnerabilities in the OpenClaw framework, which attackers can chain to gain initial access, steal credentials, escalate privileges, and establish persistent backdoor access. The flaws, dubbed “Claw Chain” by…
-
CISA Admin Leaked AWS GovCloud Keys on Github
According to KrebsOnSecurity, on May 18, 2026 the site reported that until this past weekend a CISA contractor maintained a public GitHub repository exposing credentials to several AWS GovCloud accounts and numerous internal CISA systems. The exposed…
Krebs on Security -
actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials
Varun Sharma reports that the popular GitHub Action actions-cool/issues-helper has been compromised, with every existing tag in the repository moved to point to a single imposter commit that does not appear in the action’s normal history. The imposter commit…
StepSecurity -
TeamPCP3 articles this day · StepSecurity first
Jenkins AST plugin trojanised as Mini Shai Hulud worm floods npm · TeamPCP leaks Shai Hulud worm, fuels NPM supply chain attacks
3 outlets-
Jenkins AST plugin trojanised as Mini Shai Hulud worm floods npm
Two TeamPCP events dominated the campaign in the period up to 17 May 2026, with Checkmarx confirming the Jenkins AST plugin had been trojanised and a new Mini Shai-Hulud worm spreading across npm and PyPI, marking the loudest stretch since the March Trivy…
SANS ISC -
TeamPCP leaks Shai Hulud worm, fuels NPM supply chain attacks
TeamPCP published Shai-Hulud source code to GitHub last week, and the worm already shows signs of spreading. TeamPCP is a financially motivated threat actor long viewed as a key culprit behind Shai-Hulud and related worms. Shai-Hulud began infecting NPM…
Dark Reading -
StepSecurity's Secure Registry blocks npm worm Mini Shai Hulud
Secure Registry, StepSecurity’s install-time defence for the npm supply chain, sits as an authenticated upstream registry that evaluates every npm metadata request and tarball download against configured security controls before it reaches developers, CI…
StepSecurity
-
-
Nx Console VS Code extension hijacked to steal developer secrets
Version 18.95.0 of the Nx Console VS Code extension (nrwl[.]angular-console), published to the VS Code Marketplace, was found to contain malicious code that targets developer credentials, cloud infrastructure tokens, and CI/CD secrets. The compromised…
StepSecurity -
Grafana says hackers stole source code after GitHub token breach
Grafana Labs confirmed a security incident in which a compromised GitHub token gave attackers access to its GitHub environment, after the extortion group Coinbase Cartel listed Grafana on a leak site and claimed data theft on May 15. Grafana said attackers…
Security AffairsCoinbase Cartel -
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests
INTERPOL says its first-of-its-kind crackdown across the MENA region resulted in 201 arrests and the identification of a further 382 suspects, spanning 13 countries between October 2025 and February 2026. The operation targeted phishing and malware…
The Hacker News -
AI powered phishing surges putting small firms at greater risk
AI is rapidly reshaping how work gets done, bringing both opportunities and risk for growing businesses, especially during National Small Business Month. The article notes that AI-automated phishing is 4.5 times more effective than traditional cyberattacks,…
Microsoft -
Canvas LMS Breach Sparks Senators Enquiry Over Student Data
U.S. Senators Bill Cassidy, M.D. and Tommy Tuberville have urged answers after a cybersecurity incident hit Instructure’s Canvas LMS, potentially affecting the data of 275 million students, families and teachers worldwide. Canvas is described as the most…
DataBreaches -
Congress learnt of RXNT breach exposing patient data after delay
Congress is learning months later that RXNT, a healthcare software contractor used by the Office of the Attending Physician, was breached on 1 March and 3 March, with hackers obtaining copies of patient data stored within the platform. The compromised data…
DataBreaches -
Extant Aerospace ransomware data breach exposes 3,012 US records
Extant Aerospace, a defence and space electronics company based in Melbourne, Florida, disclosed a data breach that affected 3,012 individuals in the United States, according to Claim Depot. The company, legally known as Symetrics Industries LLC,…
DataBreaches -
Iranian hackers tweak US fuel tank gauges, security experts warn
Iranian threat actors allegedly exploited online-exposed automatic tank gauge systems to tamper with readings at fuel storage tanks serving gas stations in the US, demonstrating Iran’s cyber reach beyond its conventional military engagements, a claim echoed…
Dark Reading -
B1ack’s Stash Dark Web Site Dumps 4.6M Stolen Credit Cards Free
B1ack’s Stash, a well-known Dark Web carding marketplace, has announced the free release of approximately 4.6 million stolen credit card records, framed as a response to seller misconduct on its platform. In the same move, the operators declared the…
SOCRadar -
Interpol's Operation Ramz leads to 201 MENA arrests
According to Interpol, a first-of-its-kind cybercrime crackdown dubbed Operation Ramz led to 201 arrests across the Middle East and North Africa. The operation ran from October 2025 to February 2026, spanning 13 countries in the MENA region. It targeted…
Infosecurity -
ShinyHunters2 articles this day · SecurityWeek first
ShinyHunters says 7 Eleven breach exposed 600k Salesforce records · ShinyHunters leaks 600k Salesforce records from 7Eleven breach
2 outlets-
ShinyHunters says 7 Eleven breach exposed 600k Salesforce records
ShinyHunters has claimed a breach at 7-Eleven, saying it stole more than 600,000 Salesforce records and franchisee data. 7-Eleven confirmed the breach after an unauthorized party accessed systems storing franchisee documents on 8 April 2026, and said it had…
Security Affairs -
ShinyHunters leaks 600k Salesforce records from 7Eleven breach
7-Eleven has confirmed a data breach after the ShinyHunters hacker group claimed to have stolen information from its systems. The intrusion into a franchise documents storage area was detected on 8 April, and the hackers claimed more than 600,000 Salesforce…
SecurityWeek
-
-
Five UK Startups Vie for Infosecurity Europe 2026 Cyber Prize
The Infosecurity Europe Cyber Startup Competition is back for 2026, with five cybersecurity startups set to pitch live on 2 June to an audience of senior industry leaders, investors and buyers. The five finalists are Cytidel, a vulnerability intelligence…
Infosecurity -
AI Generated Bug Bounty Reports Overwhelm Security Programmes
According to The Financial Times Ltd, bug bounty programmes are being overwhelmed by AI-generated, low-quality reports as researchers flood schemes with spurious submissions. Bugcrowd, whose customers include OpenAI, T-Mobile and Motorola, said reports more…
Ars Technica -
Public Amazon S3 bucket leaks hotel guests’ IDs and selfies
Public Amazon bucket leaks sensitive guest data from Japanese hotel platform Tabiq describes a misconfigured Amazon S3 bucket that left Reqrea’s TabIq hotel check‑in system publicly accessible, exposing passports, driver’s licenses and selfie verification…
Security Affairs -
Early phishing detection stops threats before they hit business
The Hacker News outlines how early phishing detection can stop a single misleading click from turning into broader disruption, emphasising the value of moving from uncertainty to evidence fast. A recent ANY[.]RUN investigation shows a dangerous phishing…
The Hacker News -
US healthcare breaches expose millions as HHS tracker updates
Several major healthcare data breaches were added to the US Department of Health and Human Services (HHS) tracker in recent days, according to the tracker. The largest incident involves NYC Health and Hospitals Corporation, with a breach detected on 2…
SecurityWeek -
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery
Four vulnerabilities in the OpenClaw AI assistant have been linked in a chainable set named Claw Chain, capable of escaping the sandbox and delivering backdoors, security firm Cyera warns. The four flaws can be exploited in sequence to move from prompt…
-
SparkCat stealer hides in Android apps as Mamont Trojans surge
According to Kaspersky Security Network, in Q1 2026 more than 2.67 million attacks utilizing malware, adware, or unwanted mobile software were prevented. The Trojan-Banker category was the prevalent mobile malware threat with a 10.86% share of total…
securelist.com -
Kaspersky blocks 343M attacks as ransomware variants surge in Q1 2026
According to AMR, IT threat evolution in Q1 2026 shows that Kaspersky products blocked more than 343 million attacks originating from online resources, with Web Anti-Virus responding to 50 million unique links and File Anti-Virus blocking nearly 15 million…
-
Boulevard of Broken Dreams: 2 Decades of Cyber Fails
According to TechTarget and Informa Tech’s Digital Business Combine, the two groups power an unparalleled network of 220+ online properties spanning 10,000+ granular topics. The network serves an audience of more than 50 million professionals with original,…
Dark Reading -
SOCRadar finds kernel EDR killer and huge data leaks on dark web
SOCRadar’s Dark Web Team identified several new underground posts, including a kernel-level “EDR/XDR terminator” package advertised as source code plus a compiled driver, and a post claiming an 832.87GB “Adobe Business” dataset, among other…
SOCRadar -
Attackers Hit Developer Workstations to Harvest CI/CD Credentials
Developer workstations are identified as a real part of the software supply chain, with attackers increasingly targeting secrets stored in developer environments and CI/CD pipelines. In a 48-hour window, three campaigns hit npm, PyPI and Docker Hub, all…
The Hacker News -
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws
Ivanti, Fortinet, SAP, VMware, and n8n have all released security fixes for a range of flaws that could allow unauthenticated attackers to read data, execute code or bypass authentication. The notable listing starts with Ivanti Xtraction CVE-2026-8043 (CVSS…
-
Edge to stop loading all passwords into memory at startup
Microsoft says it is changing Edge’s plaintext password handling as a defence‑in‑depth measure. Previously Edge decrypted the entire saved‑password store on startup and kept credentials in memory in clear text for the whole browser session. It had been…
Malwarebytes -
MiniPlasma exploit revives Windows privilege flaw CVE-2020-17103
SecurityWeek reports that a researcher has released MiniPlasma, an exploit targeting CVE-2020-17103, a privilege-escalation flaw in the Windows Cloud Filter driver disclosed in 2020. The CVE, tracked with a CVSS score of 7.0, was addressed by Microsoft as…
-
UK NCSC Issues Agentic AI Guidance to Curb Cyber Risks
The UK’s National Cyber Security Centre (NCSC) has released new guidance for organisations keen to harness agentic AI while keeping cyber risks in check, as published on 18 May 2026. According to NCSC, the guidance accompanies a broader report produced with…
Infosecurity -
Cloned Shai Hulud Worm Targets NPM After Source Code Leak
According to Ox Security, the first Shai-Hulud worm clones emerged after TeamPCP released the malware’s source code on GitHub, with at least one threat actor adopting it in attacks against NPM developers. Shai-Hulud was first used in September 2025 and again…
SecurityWeek -
Pwn2Own Berlin 2026 awards $1.3m for 47 zero day flaws
Security researchers were awarded close to $1.3m after discovering 47 zero-day vulnerabilities at Pwn2Own Berlin, which ran for three days from 14 to 16 May and was sponsored by TrendAI’s Zero Day Initiative (ZDI). The Devcore team won the event, claiming a…
Infosecurity -
UK regulators tell banks to act on rising AI cyber risks
According to Bank of England, FCA and Treasury, UK financial services firms must actively manage cybersecurity risks stemming from frontier AI. A joint missive dated 15 May clarifies and reinforces the message as the operating environment becomes more…
Infosecurity -
Malicious npm packages spread worm clone and DDoS botnet
Cybersecurity researchers have flagged four new npm packages that carry information-stealing malware, with one package containing a direct clone of the Shai-Hulud worm released by TeamPCP. The identified packages and download counts are chalk-tempalte (825…
The Hacker News
