News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 19 May· 51 articles
-
Dev Machine Guard adds native Linux support for fleet visibility
Dev Machine Guard now supports Linux, running natively on Linux while already covering macOS and Windows, so the same scanning engine can see every developer machine in your fleet from one dashboard. The release enables Linux developers to appear in the…
StepSecurity -
Dev Machine Guard now covers Windows and macOS developer machines
Dev Machine Guard now supports Windows, giving security teams full visibility into Windows and macOS developer machines, with the same scanning engine and enterprise dashboard as macOS. According to StepSecurity, the Windows release runs natively on Windows,…
StepSecurity -
AI BOMs Move From Concept to Practice Amid Regulatory Pressure
AI BOMs are moving from concept to practice as standards bodies, open-source projects and vendors push for practical tooling and governance. According to OWASP, with its CycloneDX SBOM standard, and the Linux Foundation, with its SPDX standard, have both…
Dark Reading -
Verizon DBIR Reveals Patch Gaps as Vulnerability Exploits Rise
Defenders are grappling with an unprecedented influx of vulnerabilities, with patch prioritisation now more critical than ever, according to Verizon's "2026 Data Breach Investigations Report" ("DBIR"). The DBIR highlights that vulnerability exploitation…
Dark Reading -
Windows Zero-Day Barrage Continues After Patch Tuesday
Six Windows zero-days were disclosed by Nightmare Eclipse in the six weeks since May 2026’s security update, adding to a growing list that researchers say attackers are already exploiting in some cases. The three new vulnerabilities are YellowKey,…
-
CISA’s private GitHub repo leaked passwords for months
GitGuardian researcher Guillaume Valadon revealed a public GitHub repository belonging to the Cybersecurity and Infrastructure Security Agency (CISA) contained 844MB of sensitive data, including plain-text passwords, authentication tokens and other secrets,…
Dark Reading -
Drupal to Release Critical Core Patch Amid Short Exploit Window
Drupal is pushing a core security update on May 20, with the Drupal Security Team urging site administrators to block out time between 5 and 9 p.m. UTC for the release window. The vulnerability type has not been disclosed ahead of the coordinated release,…
Security Affairs -
[Virtual Event] Anatomy of a Data Breach: What to Do if it Happens to You
According to Dark Reading, the virtual event Anatomy of a Data Breach: What to Do if it Happens to You examines the main vulnerabilities and exploits that lead to enterprise data breaches, plus the latest tools and best practices for conducting incident…
Dark Reading -
CISA contractor’s GitHub leak exposed AWS GovCloud access keys
Security researcher Brian Krebs brings us the news that America’s Cybersecurity & Infrastructure Agency has had a large store of plaintext passwords, SSH private keys, tokens and other sensitive CISA assets exposed in a public GitHub repo since at least…
Ars Technica -
Microsoft durabletask SDK hijacked on PyPI to steal cloud secrets
On 19 May 2026, three malicious versions of Microsoft’s official durabletask Python SDK—1.4.1, 1.4.2, and 1.4.3—were published to PyPI within a 35-minute window, and they were not released through Microsoft’s official CI/CD pipeline. The versions were pushed…
StepSecurity -
Fox Tempest4 articles this day · Infosecurity first
Microsoft Disrupts Fox Tempest Malware Signing Service Worldwide · Microsoft shuts Fox Tempest malware signing service
4 outlets-
Microsoft Disrupts Fox Tempest Malware Signing Service Worldwide
Microsoft disrupted Fox Tempest, a malware-signing-as-a-service operation that allowed threat actors to sign malicious software with short-lived certificates to appear legitimate. The group provided infrastructure and services rather than conducting direct…
Security Affairs -
Microsoft shuts Fox Tempest malware signing service
Microsoft has disrupted a cybercrime service run by a threat actor it calls Fox Tempest, which operated a malware-signing-as-a-service that abuses Microsoft Artifact Signing to generate short-lived code-signing certificates used to sign malware and evade…
SecurityWeek -
Microsoft disrupts Fox Tempest malware signing service
Fox Tempest is a financially motivated threat actor that operates a malware-signing-as-a-service (MSaaS) used by other cybercriminals to distribute malicious code, including ransomware, by fraudulently signing it to appear legitimate. The operation has…
Microsoft -
Microsoft seizes Fox Tempest domains after undercover operation
Microsoft has cracked down on Fox Tempest, a financially motivated group that fuelled Rhysida ransomware and helped develop tools for strains such as Oyster, Lumma Stealer and Vidar. On 19 May 2026 the company unsealed a US district court case in the…
Infosecurity
-
-
Trapdoor ad fraud hijacked 455 Android apps, spawning traffic
Cybersecurity researchers have disclosed Trapdoor, a mobile ad fraud operation targeting Android devices, which at its peak generated 659 million bid requests per day and involved 455 apps, with 183 threat actor-owned C2 domains forming its infrastructure.…
The Hacker News -
Drupal to patch highly critical flaw on May 20, urges swift action
Drupal has announced it is preparing a patch for a “highly critical” vulnerability that security researchers fear could be exploited within hours or days of disclosure. According to SecurityWeek, patches will be released for all supported Drupal versions on…
SecurityWeek -
NYC Health+Hospitals breach exposes 1.8M patient data via vendor
NYC Health + Hospitals (NYC H+H) disclosed a months‑long breach via a third‑party vendor that exposed highly sensitive patient and employee data for at least 1.8 million people, including medical records, government IDs, geolocation data, and even biometric…
Malwarebytes -
Linux2 articles this day · SecurityWeek first
Linux Kernel Privilege Escalation Flaw Exposed by DirtyDecrypt PoC · DirtyDecrypt kernel flaw PoC released, raising privilege fears
-
Linux Kernel Privilege Escalation Flaw Exposed by DirtyDecrypt PoC
Proof-of-concept PoC for a Linux kernel local privilege escalation has been released in relation to CVE-2026-31635, a vulnerability that Zellic and V12 security team reported on 9 May 2026. The flaw is described as an rxgk pagecache write issue caused by a…
-
DirtyDecrypt kernel flaw PoC released, raising privilege fears
SecurityWeek reports that a proof-of-concept (PoC) for the DirtyDecrypt Linux kernel vulnerability is now available, with the exploit published by the V12 security team who discovered it earlier this month after fixes were rolled out in April. The flaw,…
-
-
Dark Reading Editors Chart 20 Years of Cybersecurity Evolution
Looking Back, Looking Forward: Digesting a Dynamic Bouillabaisse of Cyber Evolution sees Dark Reading editors reflecting on two decades of dramatic change in cybersecurity, from perimeter defence to resilience, and noting how AI, cloud and the pandemic have…
Dark Reading -
MSHTA abuse spreads Lumma, Amatera stealers via phishing
Attackers are increasingly abusing Microsoft’s legacy MSHTA utility to silently deliver stealers, loaders and persistent malware through phishing, fake software downloads and LOLBIN-based attack chains, according to BitDefender. Since the start of this year…
SecurityWeek -
Cloudflare and Anthropic Upgrade AI Agent Sandbox Security
Cloudflare and Anthropic have collaborated to integrate Claude Managed Agents with Cloudflare Sandboxes, giving developers more control, security, and observability for agent sandboxes. According to Anthropic, the integration lets you run your agent loop on…
Cloudflare -
MSHTA Abused to Deliver Password Stealers and Advanced Threats
The article details the continued exploitation of Microsoft's HTML Application Host (MSHTA) by cybercriminals, despite its classification as a legacy utility. Researchers from Bitdefender observe that attackers utilize MSHTA to deliver a variety of malware,…
bitdefender.com -
ChromaDB flaw allows remote shell via malicious HuggingFace model
An unpatched vulnerability in ChromaDB could allow remote, unauthenticated attackers to spawn a shell and take control of the server process, according to HiddenLayer. Tracked as CVE-2026-45829 and referred to as ChromaToast, the pre-authentication remote…
-
Fake Aldi meat box deal on Facebook lures victims to payment scam
A Facebook post falsely claiming Aldi is offering a meat box for under £10 is not from the retailer and leads victims to a scam flow designed to harvest payment details. The user is redirected first to a site that fingerprinted their device before sending…
Malwarebytes -
ENISA warns AI scanners leave firms no excuse for software flaws
AI-powered vulnerability scanning tools are accelerating the ability to identify and fix bugs, with industry voices arguing there is now little excuse for firms to be unaware of flaws in their software, according to ENISA. During the ESET World conference on…
Infosecurity -
AI fuels surge in mobile app attacks, 87% of apps hit in 2026
According to Digital[.]ai, the frequency of cyber-attacks on customer-facing mobile apps has risen rapidly as AI lowers barriers for threat actors. The 2026 Application Security Threat Report, published on 19 May 2026, claims 87% of monitored apps faced…
Infosecurity -
ZKTeco CCTV Cameras
According to CISA, the ICS Advisory ICSA-26-139-04 warns of a vulnerability in ZKTeco CCTV Cameras, specifically CVE-2026-8598, where an undocumented configuration export port is accessible on some models and does not require authentication, exposing open…
-
Kieback & Peter DDC Building Controllers
Kieback & Peter DDC Building Controllers is the subject of an ICS Advisory released on 19 May 2026, which warns that successful exploitation could allow an attacker to take control of a victim’s browser. According to CISA, the affected products include…
-
Critical flaw in Palo Alto firewalls lets attackers run root code
According to Siemens ProductCERT, a buffer overflow vulnerability in the User-ID Authentication Portal (Captive Portal) service of Palo Alto Networks PAN-OS software could allow an unauthenticated attacker to execute arbitrary code with root privileges on…
-
ABB patches critical path traversal flaw in CoreSense HM and M10
An update has been issued for ABB CoreSense HM and CoreSense M10 to remediate a path traversal vulnerability (CVE-2025-3465) that could allow unauthenticated users to access restricted directories and potentially lead to complete system compromise, according…
-
ScadaBR bugs allow unauthenticated remote code execution on SCADA
According to CISA, ScadaBR has multiple unauthenticated remote code execution vulnerabilities that could be exploited through version 1.2.0. The advisory lists four CVEs affecting ScadaBR 1.2.0: CVE-2026-8602, CVE-2026-8603, CVE-2026-8604 and CVE-2026-8605,…
-
B1ack’s Stash leaks 4.6M cards, SOCRadar says 4.3M usable
SecurityWeek reports that the dark web carding marketplace B1ack’s Stash announced a free download of 4.6 million stolen credit card records, released after sellers were caught reselling data purchased from the site on other platforms. The data dump…
SecurityWeek -
EvilTokens hijacks 340 Microsoft 365 firms via OAuth consent
According to The Hacker News, a phishing-as-a-service platform called EvilTokens went live in February 2026 and, within five weeks, had compromised more than 340 Microsoft 365 organisations across five countries. The targets were asked to enter a short code…
The Hacker News -
ISF 2026 guides cyber resilience as business continuity backbone
The article argues that cyber resilience should be the backbone of business continuity, linking security, continuity and risk management around what the business cannot afford to lose. It cites the ISF Standard of Good Practice 2026 as a framework that asks…
SecurityWeek -
YouTube rolls out selfie ID deepfake detection for creators
YouTube is expanding its likeness detection system, inviting users to upload a selfie video and government ID to help combat deepfake videos that use their image. According to YouTube, the idea is to let its own AI patrol the service for fakes and offer…
Malwarebytes -
Drupal warns of exploit risk, urges sites to prep for May update
Drupal has issued an alert that it intends to release a core security update for all supported branches on 20 May 2026, from 5–9 p.m. UTC. According to Drupal Security Team, exploits might be developed within hours or days, so site operators are urged to…
The Hacker News -
201 Arrested in Crackdown on Cybercrime in Middle East, North Africa
A 13-country law enforcement crackdown on phishing and malware threats in the Middle East and North Africa, named Operation Ramz, led to 201 arrests, with 382 additional suspects identified. The operation ran from October 2025 to 28 February 2026, and…
SecurityWeek -
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access
Security researchers have disclosed critical vulnerabilities in SEPPMail Secure E-Mail Gateway that could enable remote code execution and allow attackers to read arbitrary mails from the appliance, according to InfoGuard Labs researchers Dario Weiss, Manuel…
-
Grafana Labs Rejects Ransom After Source Code Leak Via Token
Grafana Labs says hackers stole its source code after an unauthorised party obtained a token that gave access to its GitHub environment and allowed download of the codebase. The firm said in posts on X that they have invalidated the compromised credentials…
InfosecurityCoinbase Cartel
