News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 21 May· 53 articles
-
Police arrest Ottawa man for running 30 Tbps Kimwolf DDoS botnet
Canadian authorities arrested Jacob Butler, a 23-year-old from Ottawa, for allegedly operating the Kimwolf DDoS botnet, which enslaved millions of Internet-of-Things devices for massive DDoS attacks over six months. Butler, also known as "Dort," faces…
Krebs on Security -
CISOs should log AI agent authority using AI Bills of Materials
The article discusses the evolving need for AI Bills of Materials (AI BOMs), which document not only the components of AI systems but also their operational behaviors, particularly in agentic AI where decisions are made autonomously. Current standards focus…
Dark Reading -
CISA Adds Critical Flaws in Windows, Office, Defender to KEV List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities in Microsoft and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog as of May 21, 2026. Notable vulnerabilities include: 1. **CVE-2008-4250** -…
-
CISA Flags Trend Micro Apex One Flaw (CVE‑2026‑34926) in KEV
CISA has added CVE‑2026‑34926 to its Known Exploited Vulnerabilities catalogue. The flaw affects Trend Micro Apex One (on‑premise) and is described as a directory traversal vulnerability that could let a pre‑authenticated local attacker alter a key table on…
-
CISA warns of critical Langflow CVE-2025-34291 flaw under attack
CISA has added CVE‑2025‑34291 to its Known Exploited Vulnerabilities catalogue, effective 2026‑05‑21. The entry concerns Langflow’s Langflow product and is titled the Langflow Origin Validation Error Vulnerability. It involves an overly permissive CORS…
-
Google API keys linger active up to 23 minutes after deletion
A security research report revealed that Google API keys remain active for up to 23 minutes after being deleted, contrary to user expectations of immediate deactivation. Researcher Joe Leon tested the revocation window, finding a median deactivation time of…
Dark Reading -
ZionSiphon Malware Fails Due to XOR Bug in Israeli Water Target
The ZionSiphon malware, identified by the executable SCADA_SecurityPatch_v8.4.exe, is a Windows-based implant intended to target industrial control systems (ICS), particularly in Israeli water treatment facilities. While technically capable at the host…
dti.domaintools.com -
First VPN taken down in worldwide police raid, admin arrested
A global law enforcement operation has successfully taken down First VPN, a service utilized by cybercriminals, including ransomware groups, for concealing their activities. Conducted between May 19 and 20, 2026, the operation led to the seizure of numerous…
Security Affairs -
Microsoft Defender vulnerabilities are being exploited in the wild
On May 21, 2026, it was reported that two vulnerabilities within Microsoft Defender are actively being exploited. These were added to the CISA's Known Exploited Vulnerabilities catalog, indicating that they pose significant risks. The vulnerabilities…
-
Apple Blocks Over 2 Million Apps in 2025 Fraud Crackdown
In 2025, Apple reported a significant crackdown on app fraud, rejecting over 2 million app submissions and blocking more than 1 billion fake account creations. This effort involved a combination of artificial intelligence and human oversight. Apple processed…
Security Affairs -
Police Shut Down First VPN, Arrest Admin in Ukraine, Aid Europol
An international law enforcement operation, led by France and the Netherlands, successfully dismantled a cybercriminal anonymization service known as First VPN, which was utilized by ransomware actors and fraudsters. Bitdefender collaborated with Europol,…
DataBreaches -
Kaspersky, Group-IB Detail Role in INTERPOL Cyber Operation Involving Morocco
Global cybersecurity firms, Kaspersky and Group-IB, participated in **Operation Ramz**, the first major cybercrime crackdown by INTERPOL in the Middle East and North Africa from October 2025 to February 2026. The operation led to 201 arrests across 13…
DataBreaches -
Microsoft’s May 2026 update brings new Purview, Entra ID features
The May 2026 update from Microsoft Security highlights several key advancements aimed at enhancing security across various platforms. Significant features include a new Data Security Posture Management experience in Microsoft Purview, which streamlines data…
Microsoft -
UK’s Computer Misuse Act update gives researchers little cover
The British government's proposed amendments to the Computer Misuse Act 1990 are expected to provide very limited legal protections for security researchers. Despite a pledge from Security Minister Dan Jarvis to introduce statutory defenses for researchers,…
DataBreaches -
AI agent boom forces firms to split identity security budgets
The article discusses the evolving budget dynamics within identity security as enterprises increasingly adopt AI agents. Recent research from Omdia reveals that the funding for identity security related to AI agents often comes from separate budgets,…
Dark Reading -
France and Netherlands shut down First VPN, seize 33 servers
A coordinated operation led by France and the Netherlands has dismantled a VPN service, known as First VPN, used by cybercriminals including ransomware operators and fraudsters. The crackdown, supported by Europol, succeeded in taking down 33 servers and…
Infosecurity -
Malicious Nx Console VS Code Extension Leaks 3800 GitHub Repos
GitHub recently experienced a significant breach linked to a compromised Visual Studio Code extension called 'Nx Console,' which allowed unauthorized access to 3,800 internal repositories. The malicious version of the extension was uploaded on May 18, 2026,…
InfosecurityTeamPCP -
Attackers exploit CVE-2024-12802 to bypass SonicWall VPN MFA
A recent report reveals that attackers are bypassing Multi-Factor Authentication (MFA) on SonicWall Gen6 VPNs due to an incomplete fix for vulnerability CVE-2024-12802. Despite available firmware updates, proper remediation requires six critical manual steps…
-
Dev Machine Guard scans extensions to block supply chain attacks
Dev Machine Guard has expanded its capabilities to scan IDE extensions across multiple platforms including VS Code, Cursor, JetBrains IDEs, Android Studio, and more. This update allows organizations to manage a unified inventory and assesses risk via a…
StepSecurity -
Showboat malware hits Middle East telecoms with SOCKS5 backdoor
The article discusses the emergence of 'Showboat', a Linux malware targeting Middle Eastern telecom operators through a SOCKS5 proxy backdoor for cyber espionage. This malware represents a growing threat in cybersecurity, emphasizing the need for vigilance…
The Hacker News -
Chinese Calypso APT Uses Showboat Linux Backdoor on Telecoms
The article discusses recent findings regarding Chinese state-aligned hackers utilizing a Linux backdoor malware framework named "Showboat" to spy on telecommunications companies in Central Asia. The malware has been observed being used by the Chinese APT…
Dark ReadingCalypso -
Linux Lacks Proxifier: How to Proxy Select Traffic Securely
The article discusses methods for selective HTTP proxying in Linux environments. It highlights the absence of a Linux equivalent to the Proxifier tool available on other operating systems like Windows, macOS, and Android. Key techniques for configuring…
SANS ISC -
Cisco Secure Workload2 articles this day · SecurityWeek first
Cisco fixed maximum severity flaw CVE-2026-20223 in Secure Workload · Cisco Patches Critical Vulnerability in Secure Workload
-
Cisco fixed maximum severity flaw CVE-2026-20223 in Secure Workload
Cisco has addressed a critical vulnerability (CVE-2026-20223) in its Secure Workload platform that could allow attackers to gain Site Admin privileges via crafted API requests. The flaw, with a CVSS score of 10.0, is due to insufficient validation and…
-
Cisco Patches Critical Vulnerability in Secure Workload
Cisco has released patches for a critical-severity vulnerability (CVE-2026-20223) in its Secure Workload software that could allow attackers to gain Site Admin privileges access through insufficient validation in REST API endpoints, affecting both SaaS and…
-
-
Underminr Flaw Lets Attackers Hide Malice Behind Trusted Websites
The article discusses a cybersecurity vulnerability known as 'Underminr,' which allows attackers to exploit the Internet infrastructure by modifying Web requests to mask malicious activities using trusted websites. This technique is similar to the earlier…
Dark Reading -
Three quarters of firms ship vulnerable code despite AI risks
A recent report reveals that 75% of organizations knowingly deploy vulnerable code, a decrease from 81% last year, but still significant amid rising AI-driven threats. Checkmarx highlights that vulnerabilities can now be exploited within two days, a sharp…
Infosecurity -
Today’s reminder to terminate employees’ credentials when their employment ends
A significant security breach occurred when an American city's water utility was compromised due to the failure to revoke login credentials of a former employee. Nicole Beckwith, a security consultant, revealed that a hacker exploited an unused account…
DataBreaches -
GitHub hit by breach after malicious VS Code extension installed
GitHub confirmed a breach affecting approximately 3,800 internal repositories due to a malicious Visual Studio Code (VS Code) extension installed by an employee. The compromised extension has been removed from the VS Code marketplace, and GitHub secured the…
DataBreaches -
CVE-2026-46333: Linux ptrace flaw leaks SSH keys, patch now
A newly discovered flaw in the Linux kernel, specifically in the process trace path (ptrace), allows unprivileged local users to access sensitive information such as SSH private keys and password hashes. This vulnerability, identified as CVE-2026-46333, has…
-
CISA warns of remote code execution flaws in ABB B&R PCs
The CISA advisory ICSA-26-141-02, released on May 21, 2026, addresses multiple vulnerabilities in ABB B&R PCs, which could allow remote code execution, DoS attacks, and data exposure. Affected versions include various models of ABB B&R PCs (APC4100, APC910,…
CISA -
CISA Warn of Flaws in ABB Wallbox Allowing Remote Firmware Hijack
The advisory from CISA (ICSA-26-141-05) dated May 21, 2026, addresses vulnerabilities in the ABB Terra AC Wallbox (version <= 1.8.33). Exploitation could lead to remote control of the device by polluting heap memory and altering firmware. Specific…
-
Hitachi Energy GMS600 Fixes OpenSSL Timing Bug CVE-2022-4304
The advisory from CISA addresses a vulnerability in Hitachi Energy's GMS600 due to a flaw in the OpenSSL component (CVE-2022-4304). This vulnerability can allow an attacker to recover sensitive data by exploiting timing discrepancies in RSA decryption. The…
-
ABB Automation Studio flaws let attackers gain remote access
The document is an ICS Advisory (ICSA-26-141-03) from CISA regarding vulnerabilities in ABB B&R Automation Studio versions earlier than 6.5. Released on May 21, 2026, the advisory highlights critical vulnerabilities that could lead to unauthorized access and…
CISA -
Linux rootkits surge router zero day and AI intrusions rise
The article titled "ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI Intrusions, Scam Kits and 25 New Stories" provides an overview of recent cybersecurity threats, including the emergence of Linux rootkits, vulnerabilities in routers, AI-related…
The Hacker News -
Ocean Emerges From Stealth With $28M for Agentic Email Security Platform
Ocean, a cybersecurity startup, has raised $28 million in funding to enhance its email security platform utilizing AI technology. Founded by Shay Shwartz and Oran Moyal, the platform aims to detect sophisticated cyber threats like business email compromise…
SecurityWeek -
Apple Blocks $2.2bn in Fraudulent App Store Transactions in 2025
In 2025, Apple rejected over 2 million app submissions and blocked 1.1 million fraudulent accounts, preventing over $2.2 billion in potentially fraudulent transactions. The company has stopped more than $11 billion in such transactions over six years. In…
SecurityWeek -
Ofcom warns TikTok and YouTube feeds are unsafe for children
A recent Ofcom report has deemed TikTok and YouTube's content feeds "not safe enough" for children, calling attention to their lack of commitment to eliminating harmful content. While Snap, Meta, and Roblox have agreed to enhance safety measures to combat…
Malwarebytes -
Drupal patches PostgreSQL SQL injection flaw CVE-2026-9082
Drupal has addressed a highly critical vulnerability (CVE-2026-9082) in its CMS, which could allow attackers to exploit PostgreSQL databases through crafted requests, leading to SQL injection risks. The flaw can be exploited without authentication, enabling…
-
Microsoft Warns of Active Defender Flaws Urging Immediate Updates
Microsoft has issued warnings about two vulnerabilities in Defender that are currently being exploited. The vulnerabilities could lead to significant security risks, necessitating immediate attention from users to protect against potential breaches. The…
The Hacker News -
Socket secures $60M Series C funding, reaches $1B valuation
Socket, a California-based supply chain protection provider, has raised $60 million in a Series C funding round, reaching a total of $125 million and a valuation of $1 billion. Founded in 2020, Socket's platform utilizes AI-assisted analysis to identify…
SecurityWeek
