News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 25 May· 39 articles
-
TryGhost Ghost3 articles this day · The Hacker News first
Ghost CMS SQL flaw lets attackers hijack 700+ sites, steal keys · Ghost CMS CVE-2026-26980 SQLi Triggers Attack on 700 Sites
-
Ghost CMS SQL flaw lets attackers hijack 700+ sites, steal keys
A vulnerability in Ghost CMS, identified as CVE-2026-26980, is being actively exploited by attackers to compromise over 700 unpatched websites, including educational institutions and organizations. The flaw allows SQL injection attacks that can expose…
-
Ghost CMS CVE-2026-26980 SQLi Triggers Attack on 700 Sites
A vulnerability in the Ghost CMS, tracked as CVE-2026-26980, has been exploited to compromise over 700 websites, including major organizations like DuckDuckGo and Harvard University. This SQL injection flaw allows attackers to extract sensitive data,…
-
CVE-2026-26980 flaw hijacks 700+ Ghost sites for click fraud
A significant vulnerability (CVE-2026-26980) in the Ghost CMS was exploited, leading to the hijacking of over 700 websites for click-fraud attacks. Security experts emphasize the urgency of addressing this issue and implementing necessary patches to prevent…
-
-
340 million OnlyFans records sold on cybercrime forum
A hacker known as "Euphoric_Reply_5727" is selling a dataset containing 340 million OnlyFans user records, reportedly compiled from existing breaches and public data rather than a direct hack into OnlyFans. The seller's post on a cybercrime forum claims the…
Security Affairs -
Microsoft Access VBA, (Mon, May 25th)
Didier Stevens discusses Microsoft Access VBA code and its analysis limitations due to the lack of official documentation from Microsoft for the Access file format. He highlights the ineffectiveness of traditional tools like oledump.py on Microsoft Access…
SANS ISC -
Zero day flaws in Microsoft Defender trigger urgent Windows alert
The weekly recap on cybersecurity highlights several significant issues: 1. Vulnerabilities found in Linux systems pose critical threats, warranting immediate attention. 2. New zero-day exploits targeting Microsoft Defender have emerged, increasing the risk…
The Hacker News -
TeamPCP2 articles this day · SANS ISC first
TeamPCP supply chain attack hits VS Code, Microsoft SDK, npm · VS Code Extension Hack
1 outlet-
TeamPCP supply chain attack hits VS Code, Microsoft SDK, npm
The article discusses the TeamPCP supply chain campaign, highlighting a series of significant security breaches that occurred from May 18 to May 24, 2026. Key points include: 1) A malicious Nx Console VS Code extension was published on the Visual Studio…
SANS ISC -
VS Code Extension Hack
The content discusses the TeamPCP supply chain campaign impacting various development ecosystems, particularly GitHub, npm packages, and a Microsoft Python SDK. Key incidents included: 1) A malicious Nx Console VS Code extension led to a significant GitHub…
SANS ISC
-
-
Netherlands Seizes 800 Servers, Arrests 2 for Aiding Cyberattacks
Authorities in the Netherlands arrested two co-owners of internet hosting companies linked to Russia, charged with violating EU sanctions by facilitating cyberattacks and misinformation efforts. The arrests were part of an investigation into Stark Industries…
Krebs on Security -
PowerSchool settles $17.25m Naviance lawsuit with Chicago schools
In early April 2026, many students were informed about a lawsuit settlement pertaining to PowerSchool's Naviance platform. This lawsuit accused Naviance of embedding a third-party tracking software, Heap, that recorded private communications and student data…
DataBreaches -
Oncology Institute says third party breach exposed patient data
The Oncology Institute (TOI) confirmed that a cybersecurity incident involving a third-party software services provider has impacted patient information. In a recent SEC filing, TOI disclosed that unauthorized access to its data systems was detected by…
SecurityWeek -
Agentic AI cuts through alert overload to boost threat detection
The article discusses the need for enhanced threat detection systems in the context of cybersecurity, particularly focusing on the challenges posed by a deluge of alerts. It highlights that traditional systems struggle to manage overwhelming amounts of…
The Hacker News -
Richmond radiology firm breach leaks data of 266k patients
Radiology Associates of Richmond (RAR) reported a data breach that compromised the protected health information of 266,183 individuals. The breach occurred on approximately July 25, 2025, and involved unauthorized access to internal systems. Although RAR…
SecurityWeek -
SOCRadar warns of major leaks: WhatsApp, OnlyFans, BlockFi
The SOCRadar Dark Web Team reported several significant data leaks this week, including: 1. **WhatsApp Data Dump**: An alleged dump of 3 billion records containing sensitive information primarily from UK users. 2. **Ramen Kuroda Leak**: Compromise of 7.1…
SOCRadarStormous Group -
Anthropic’s AI spots thousands of flaws in open‑source code
Anthropic's Claude Mythos model has identified over 23,000 potential vulnerabilities in more than 1,000 open source software (OSS) projects. Out of these, 1,726 vulnerabilities have been confirmed, including over 1,000 rated as 'high' or 'critical'. With…
SecurityWeek -
Laravel-Lang Packages Poisoned for Malware Delivery
The Laravel-Lang organization experienced a supply chain attack where four of its popular Composer packages were compromised by hackers who maliciously altered Git tags within a 15-minute window on May 22, 2026. The affected packages, used for localization…
SecurityWeek -
TrapDoor malware hits npm, PyPI, Crates.io, stealing dev secrets
A newly identified malware campaign named **TrapDoor** has targeted developer ecosystems by distributing malicious packages across **npm**, **PyPI**, and **Crates.io**. This coordinated attack aims to steal developer secrets, particularly focusing on crypto…
SOCRadar -
Zero-Click WhatsApp Account Takeover Hits iPhone Users Running iOS 16. No Linked Devices, No Warning
A recent zero-click attack has compromised WhatsApp accounts of iPhone users running iOS 16 in Italy, allowing attackers to send messages asking for money transfers without user consent or knowledge. The investigation by digital forensics firm Forenser found…
-
Digital Knowledge KnowledgeDeliver2 articles this day · Google Cloud first
CVE-2026-5426 Flaw Lets Attackers Hijack Knowledge Deliver LMS · KnowledgeDeliver hit by CVE-2026-5426, allowing RCE attacks
-
CVE-2026-5426 Flaw Lets Attackers Hijack Knowledge Deliver LMS
A critical vulnerability, CVE-2026-5426, has been detected in the Knowledge Deliver Learning Management System, exploited by attackers injecting malware into the system. The flaw arises from hardcoded machineKey values used for data encryption, allowing…
-
KnowledgeDeliver hit by CVE-2026-5426, allowing RCE attacks
The article discusses a security incident involving the Learning Management System, KnowledgeDeliver, which was compromised due to a critical vulnerability (CVE-2026-5426) that allowed unauthenticated Remote Code Execution (RCE). This vulnerability arose…
-
-
DocketWise breach exposes 143k after third party login
DocketWise, an immigration and legal case management platform, has reported a data breach affecting over 143,000 individuals. The breach was caused by a third-party partner whose repositories were accessed by a threat actor using valid credentials. The…
SecurityWeek -
Lazarus Group Deploys Memory Only RAT Against Crypto and Banks
The article discusses the cybersecurity threats posed by the Lazarus Group, particularly focusing on their deployment of a RemotePE memory-only Remote Access Trojan (RAT) targeting financial and cryptocurrency firms. It highlights how this group has evolved…
The Hacker NewsLazarus Group -
FBI alerts on Kali365 AI phishing stealing Microsoft 365 tokens
The FBI has issued a warning about a new phishing-as-a-service platform called Kali365, discovered in April 2026, which primarily operates on Telegram. This tool allows cybercriminals to use AI-generated phishing methods to capture Microsoft 365 OAuth…
Infosecurity -
Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat
The content discusses a serious vulnerability (CVE-2026-9082) affecting the Drupal Core due to a malicious Go module backdoor discovered by Socket's Threat Research Team. The attack was crafted through a clever supply chain tactic, where a typosquatted…
-
F1 Fans Targeted by Fake Streams and Counterfeit Merch Scams
Cybercriminals are increasingly targeting Formula 1 (F1) fans with scams surrounding counterfeit merchandise, fake streaming services, and social media scams, as detailed in a report from Bitdefender. The report, which analyzes the cybercriminal landscape…
Infosecurity -
Dutch authorities dismantle hosting network allegedly used for cyberattacks and disinformation
Dutch authorities have dismantled a hosting network used for cyberattacks and disinformation, arresting two suspects and seizing 800 servers tied to Stark Industries. This company was reportedly a front for activities supporting Russian and Belarusian…
Security AffairsNoName057(16) -
Satori Shuts Down Trapdoor Ad Fraud Targeting 455 Android Apps
The Satori Threat Intelligence and Research Team at HUMAN has disrupted a sophisticated mobile ad fraud scheme named "Trapdoor," which involved 455 malicious Android apps and 183 command-and-control (C2) domains. This operation generated 659 million…
SecurityOnline -
Megalodon supply chain attack hits 5,500 repos with malware
The article discusses a significant supply chain attack named 'Megalodon', which infected over 5,500 GitHub repositories through automated commits. Introduced on May 18, 2026, the attack involved 5,700 malicious commits that added or altered GitHub Actions…
SecurityWeek -
Microsoft Halts Fox Tempest Malware Signing, Revokes 1,000 Certs
Microsoft's Digital Crimes Unit disrupted a significant cybercrime operation known as "Fox Tempest," which provided malware-signing-as-a-service (MSaaS) to other cybercriminals. This service enabled actors to generate short-lived fraudulent digital…
SecurityOnlineFox Tempest -
Chrome flaws and healthcare breach top week’s cybersecurity news
The article from Malwarebytes discusses significant events in cybersecurity from May 18 to May 24, 2026. Key topics include critical vulnerabilities in Google Chrome that could allow attackers to execute code, exploitation of Microsoft Defender…
Malwarebytes -
FBI Director merch site hacked, Mac malware spreads via ClickFix
FBI Director Kash Patel's merchandise website was taken offline after it was hacked, resulting in malware being spread through a ClickFix attack, where users were tricked into executing malicious commands that downloaded malware on their devices. The attack…
Security Affairs -
Banana RAT hits Brazilian banks via fileless, live session hijack
The article discusses the Banana RAT (Remote Access Trojan), attributed to a cybercriminal group known as SHADOW-WATER-063, targeting Brazilian financial institutions. The trojan employs advanced strategies for financial theft, utilizing a fileless execution…
SecurityOnlineSHADOW-WATER-063 -
Chinese PhaaS services bypass MFA to steal crypto wallets fast
The article discusses the rise of Chinese-language Phishing-as-a-Service (PhaaS) offerings, emphasizing their evolution and unique characteristics compared to Russian counterparts. Key highlights include a shift from static password harvesting to real-time…
Google Cloud -
TrapDoor spreads via npm, PyPI, CratesIO to steal credentials
The article discusses a recent supply chain attack known as the TrapDoor attack, which distributes credential-stealing malware through package repositories such as npm, PyPI, and CratesIO. This attack targets developers and compromises software supply…
The Hacker News -
Unbound DNS update patches critical RCE flaw CVE-2026-33278
NLnet Labs has issued a significant security update for its Unbound DNS resolver software to address multiple vulnerabilities, including a critical DNSSEC validation flaw (CVE-2026-33278) allowing remote code execution. This issue, stemming from a memory…
-
Kopia backup tool patched after remote code execution flaw found
The content discusses a critical security vulnerability in Kopia, an open-source backup tool, tracked as CVE-2026-45695. This vulnerability allows remote code execution through command injection due to flawed handling of external requests when the server…
-
Critical TYPO3 Extension Exploit: Content Element Selector Flaw (CVE-2026-46725) Triggers Unauthenticated RCE
The TYPO3 project has issued a critical security advisory regarding a remote code execution (RCE) vulnerability (CVE-2026-46725) affecting the "Content Element Selector" plugin. This vulnerability arises from an insecure deserialization issue, allowing…
-
FreeBSD Patches Critical RCE, Privilege Escalation Vulnerabilities
The FreeBSD Project has issued critical security advisories addressing seven vulnerabilities in its core operating system. Notable vulnerabilities include: 1. **Wi-Fi Scanner RCE (CVE-2026-45255)**: A severe input expansion vulnerability in `bsdinstall`…
-
Critical NGINX heap overflow flaw lets attackers hijack servers
The page reports a critical NGINX heap buffer overflow vulnerability (CVE-2024-24989) impacting both NGINX Plus and NGINX Open Source causing potential crashes and system takeovers. The flaw is due to errors in the web server’s regex rewrite handling,…
