News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 26 May· 55 articles
-
Fake utilities spread cryptojacking via poisoned search
Microsoft Defender identified a cryptojacking campaign that uses poisoned search results and AI chatbot interactions to distribute malicious software posing as system utilities. The campaign targets users likely owning high-performance GPUs, using trusted…
Microsoft -
BadHost CVE-2026-48710 flaw in Starlette puts AI apps at risk
A critical vulnerability, tracked as CVE-2026-48710 and named BadHost, has been identified in Starlette, an open-source framework widely used in AI applications. This flaw allows attackers to exploit servers by injecting malicious data into the HTTP Host…
-
TeamPCP2 articles this day · Dark Reading first
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos · The Hackers Behind Shai-Hulud: Lucky or Skilled?
1 outlet-
Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos
A cybersecurity campaign named "Megalodon" has targeted GitHub repositories, injecting malware that steals credentials and developer secrets. Over 5,700 malicious commits were made to more than 5,500 repositories in a span of six hours. The malware exploits…
Dark Reading -
The Hackers Behind Shai-Hulud: Lucky or Skilled?
The article discusses TeamPCP, the group behind the Shai-Hulud worm, which has notably harmed the open-source ecosystem. It highlights how TeamPCP's success is attributed more to opportunistic attacks rather than advanced skills. Formed in late 2025, the…
Dark Reading
-
-
CISA flags LiteSpeed cPanel Plugin bug CVE-2026-48172 in KEV
CISA has added CVE-2026-48172 to its Known Exploited Vulnerabilities catalogue. The flaw affects LiteSpeed’s cPanel Plugin and is titled LiteSpeed cPanel Plugin Privilege Escalation Vulnerability. It permits any authenticated cPanel user to escalate…
-
Microsoft SharePoint Server2 articles this day · The Hacker News first
Microsoft patches critical SharePoint RCE flaw CVE-2026-45659 · Microsoft patches critical SharePoint RCE flaw CVE-2026-45659
-
Microsoft patches critical SharePoint RCE flaw CVE-2026-45659
Microsoft has released an out-of-band patch to address a critical remote code execution vulnerability in SharePoint Server (CVE-2026-45659). This flaw allows authenticated attackers to remotely execute code without elevated privileges, assigning it a high…
-
Microsoft patches critical SharePoint RCE flaw CVE-2026-45659
Microsoft has patched a critical remote code execution vulnerability (CVE-2026-45659) affecting all SharePoint Server versions. This flaw could allow attackers to take complete control of affected systems. The patch is vital for organizations using…
-
-
Exposed databases hit by ransom notes, but few pay, study shows
A five-year study by the Ransomnews Research Team identified that 30,515 out of 65,907 exposed databases were compromised through ransom demands, causing considerable data loss despite few victims paying. Exposed databases, particularly MongoDB and MySQL,…
Security Affairs -
MuddyWater Uses DLL Side Loading in Nine Nation Espionage
The article discusses a cyber espionage campaign conducted by the hacker group MuddyWater, which utilizes DLL side-loading to target nine countries. This technique involves manipulating legitimate software to load malicious DLL files, thereby bypassing…
The Hacker NewsMuddyWater -
Chinese Phishing Services Now Bypass MFA With Live OTP Interception
The article discusses a shift in phishing tactics by Chinese threat actors, who are moving from static phishing pages to real-time credential interception. Google researchers highlighted that these phishing-as-a-service (PhaaS) operations now target various…
Infosecurity -
AppOmni introduces AI driven SSPM to reduce SaaS config risks
The article discusses the challenges of securing Software-as-a-Service (SaaS) applications, emphasizing that traditional cybersecurity controls are not suitable for them. Due to varied configurations by users, misconfigurations become a primary risk factor.…
SecurityWeek -
BTMOB Android RAT fuels Brazil phishing with malware builder
The article discusses the BTMOB Android Remote Access Trojan (RAT), which enables users to create custom malware payloads without coding, facilitating its spread through phishing campaigns in Brazil and beyond. This Malware-as-a-Service (MaaS) platform…
Infosecurity -
UNC15492 articles this day · Infosecurity first
Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software · Nimbus Manticore hackers hit US aviation via fake Oracle SQL page
2 outlets-
Iranian APT Nimbus Manticore Shifts Focus to US Aviation Software
An Iranian APT referred to as Nimbus Manticore has evolved its techniques and tools for cyber intrusions targeting aviation and software companies, according to Check Point. This group, active since at least 2022 and believed to have ties to Iran’s IRGC,…
SecurityWeek -
Nimbus Manticore hackers hit US aviation via fake Oracle SQL page
Iranian state-aligned hackers, known as Nimbus Manticore, have targeted the US aviation sector through a sophisticated phishing and SEO poisoning campaign. The group, linked to the Iran Revolutionary Guard Corps (IRGC), shifted tactics by using a counterfeit…
Infosecurity
-
-
Fake ChatGPT, AutoTune installers spread DinDoor RAT on GitHub
The article discusses the discovery of fake software installers on GitHub and SourceForge distributing the Deno RAT called DinDoor. Attackers are exploiting popular software names like ChatGPT and AutoTune, using compromised YouTube channels to direct users…
Malwarebytes -
Dark Reading Marks 20 Years Honouring Founder Tim Wilson’s Legacy
The article commemorates the late Tim Wilson, co-founder and former editor-in-chief of Dark Reading, as it celebrates the 20th anniversary of the publication. It reflects on Wilson's impactful contributions to cybersecurity journalism and the media site's…
Dark Reading -
ABB B&R Automation SDM Flaw CVE-2025-3450 Allows Remote DoS
The advisory addresses a critical vulnerability in ABB B&R Automation's System Diagnostics Manager (SDM), affecting versions of Automation Runtime prior to 6.3 and Q4.93. This vulnerability, identified as CVE-2025-3450, allows unauthorized network-based…
-
CISA alerts to hardcoded password flaw in Eppendorf BioFlo 320
The CISA issued an advisory (ICSMA-26-146-01) regarding vulnerabilities in the Eppendorf BioFlo 320 bioreactor, released on May 26, 2026. The advisory highlights a critical vulnerability (CVSS score 9.8), due to a hard-coded password in the VNC server,…
CISA -
ABB Zenon Remote Service Flaw Allows Unauthenticated Reboots
CISA released an advisory on May 26, 2026, concerning a vulnerability in the ABB Ability™ Zenon Remote Transport Service (Advisory code: ICSA-26-146-03). This vulnerability allows unauthorized access to the Reboot OS function, enabling attackers to reboot…
CISA -
Attackers can intercept Modbus data from ABB AC500 PLCs
The CISA advisory ICSA-26-146-02, released on May 26, 2026, addresses vulnerabilities in the ABB AC500 V2, specifically versions 2.5.2 and 2.5.3. An attacker could exploit this vulnerability to access fragments of Modbus telegrams sent by the PLC. The…
CISA -
CISA warns of heap overflow flaw in ABB EV charger firmware
The advisory ICSA-26-146-01 issued by CISA covers vulnerabilities in the ABB Terra AC wallbox chargers. An attacker exploiting a heap-based buffer overflow vulnerability could gain control over the affected devices by sending specially crafted messages via…
CISA -
CISA warns ABB MConfig flaw leaks cleartext passwords
The CISA advisory ICSA-26-146-06, released on May 26, 2026, details a vulnerability in the ABB LVS MConfig software (version <= 1.4.9.21). This issue allows an attacker with local network access to potentially retrieve sensitive information, such as…
CISA -
ABB Camera Connect flaws expose systems to MMS stream attacks
The advisory report from ABB identifies vulnerabilities in its ABB Ability Camera Connect software, specifically linked to the VLC Media Player component included in versions 1.5.0.14 and below. These vulnerabilities, identified under alert code…
CISA -
ShinyHunters leak 185k 7 Eleven records, data on HaveIBeenPwned
The article discusses a data breach at 7-Eleven that occurred on April 8, affecting over 185,000 individuals, as reported by HaveIBeenPwned. The breach involved the theft of personal information such as names, addresses, and emails. The infamous hacking…
SecurityWeekShinyHunters -
Experts Warn AI Powered DDoS Surge Demands New Defence Tactics
The content discusses rising concerns over AI-driven DDoS attacks and includes invitations to a webinar aimed at educating defenders on how to combat these threats. The article highlights the evolution of attack techniques leveraging AI, strategies for…
The Hacker News -
Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations
Anthropic has expanded its Claude AI to connect with 28 security and compliance platforms, enhancing its utility in corporate IT environments. This rollout includes the Claude Compliance API, which offers access to conversation content and activity logs for…
SecurityWeek -
Hackers hijack Laravel Lang packages via fake Git tags, steal data
Hackers have compromised four Laravel-Lang Composer packages by rewriting over 700 Git tags, injecting malware into the libraries used for localization in Laravel applications. The affected packages are not official parts of the Laravel framework but are…
Security Affairs -
Hackers Exploited KnowledgeDeliver Zero-Day for Web Shell Deployment
The article discusses the exploitation of a zero-day vulnerability (CVE-2026-5426) in the KnowledgeDeliver Learning Management System, widely used in Japan. Reported by Mandiant, the vulnerability arises from hardcoded values in the system's configuration,…
-
SecurityWeek’s TDIR Event On Demand Boosts SOC Efficiency
The Threat Detection & Incident Response Summit, hosted by SecurityWeek on May 20, 2026, is now available for on-demand viewing. The event features expert-led sessions aimed at enhancing security team strategies to reduce alert fatigue, utilize AI and…
SecurityWeek -
Hackers Hijack 700+ Sites via Ghost CMS SQLi Flaw CVE-2026-26980
A significant malware campaign, termed ClickFix, has hijacked over 700 education and tech websites by exploiting a SQL injection vulnerability (CVE-2026-26980) in the Ghost Content Management System. Attackers injected malicious JavaScript that prompts users…
-
DockSec Leverages AI to Fix Docker Vulnerabilities Quickly
DockSec is an open-source security tool aimed at addressing the gap between vulnerability detection and remediation in software development, particularly within Docker images. Created by Advait Patel, DockSec operates by running existing vulnerability…
SecurityWeek -
India's CERTIn mandates 12 hour patch for AI driven exploits
India's Computer Emergency Response Team (CERT-In) mandates that organizations patch actively exploited internet-facing vulnerabilities within 12 hours due to the accelerating nature of cyber-attacks powered by AI. The guidance categorizes vulnerabilities…
Infosecurity -
Attackers use MFA fatigue to breach security despite safeguards
This article from The Hacker News discusses 'MFA prompt bombing,' a tactic that exploits multifactor authentication (MFA) by overwhelming users with excessive prompts. It highlights how attackers can leverage users' psychological discomfort and uncertainty to…
The Hacker News -
Lithuania faces 600k data leak linked to suspected Russian hack
Lithuanian authorities are responding to a significant data leak affecting over 600,000 entries from national registers, suspected to be orchestrated by a foreign entity, possibly linked to Russian intelligence operations. The leak involved unauthorized…
SecurityWeek -
AI driven attacks rise with weaponised configs and credential theft
The AI Threat Landscape Digest for March-April 2026 outlines significant advancements in the use of AI technologies for cyber-attacks. Key points include: 1) AI attacks have shifted from experimental state-sponsored applications to practical criminal…
Check Point -
Former execs admit helping Microsoft impersonation scammers
Scammers impersonating Microsoft have received assistance from executives of a call tracking company. Two former executives from C.A. Cloud Attribution Ltd pleaded guilty for selling infrastructure to tech support scammers and coaching them on evading law…
Malwarebytes -
Admins of Bulletproof Hosting Service Used by Russian Hackers Arrested in Netherlands
Authorities in the Netherlands have arrested two men for allegedly providing bulletproof hosting services to Russian threat actors, evading EU sanctions. An investigation revealed that Youssef Z. and Andrey N. facilitated cyberattacks against EU targets by…
SecurityWeek -
Clever Phishing Campaign Exploits Corporate Trust in Pakistan
A recent cyber espionage operation targeted public safety organizations in Pakistan through a spear-phishing campaign, notably affecting the Punjab Safe Cities Authority. The attackers used customized emails that mimicked internal communication, leading…
SecurityOnline -
BIND 9 flaws let attackers crash DNS and drain bandwidth
The Internet Systems Consortium (ISC) has released urgent updates for BIND 9 to address critical flaws affecting DNS infrastructure. Key vulnerabilities include severe memory leaks (CVE-2026-3039, CVE-2026-3593) that could allow unauthenticated remote…
-
CERTIn mandates 12 hour patch window for internet facing flaws
The article discusses CERT-In's mandate for a 12-hour patching requirement for Internet-facing vulnerabilities due to the rising threat of AI-assisted cyber attacks. This initiative aims to bolster the security of organizations against rapidly evolving…
The Hacker News
