News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 8 Jun· 74 articles
-
OWASP warns prompt injection flaws persist, risking AI agents
During Infosecurity Europe 2026, OWASP researcher Ariel Fogel warned that prompt injection issues remain unresolved, presenting significant risks for AI development. He emphasized the challenges posed by large language models (LLMs) processing inputs as…
Infosecurity -
VerdantBamboo Deploys BSD BRICKSTORM Variant on Linux Appliances
The article discusses VerdantBamboo's deployment of a BSD variant of the BRICKSTORM malware on Linux appliances, marking a notable trend in cyber espionage and malware effectiveness. It emphasizes the increasing threat landscape in cybersecurity, where…
The Hacker NewsVerdantBamboo -
Meta Instagram AI flaw leaks 20k accounts, forces password resets
Meta's AI-powered Instagram recovery tool, known as High Touch Support (HTS), had a significant flaw that led to the exposure of over 20,000 accounts, allowing attackers to reset passwords without proper email verification. This vulnerability remained…
Security Affairs -
Hackers pilfer exec emails from UK bank in five month spy run
A recent cyber operation targeted a major financial institution, executing a prolonged executive espionage campaign focused on extracting sensitive information from a senior leader's Outlook mailbox over five months. The attackers implemented stealthy…
SecurityOnline -
Massive Smishing Error524 Campaign Evades Traditional Security Filters Worldwide
The article discusses a significant cyber threat known as the Smishing Error524 campaign, which has evolved its tactics to exploit mobile users globally. Originally emerging in Latin America in 2025, it now spans 72 countries, impersonating over 267 brands…
SecurityOnline -
Open Source Community Lacks Awareness of EU Cyber Resilience Act
A report by OpenSSF reveals that two-thirds of the open source community is unaware of the Cyber Resilience Act (CRA) set for compliance by December 2027. The CRA aims to establish security standards for software and hardware in the EU, requiring…
Infosecurity -
OpenAI adds Lockdown Mode and Active Sessions to secure ChatGPT
OpenAI has announced two new security features for ChatGPT: Lockdown Mode and Active Sessions. Lockdown Mode helps protect sensitive data from prompt injection attacks by limiting outbound network requests. It is particularly aimed at users handling highly…
SecurityWeek -
Hades Campaign hijacks PyPI ensmallen, steals credentials
The article discusses the Hades Campaign, identified on June 8, 2026, involving a compromised version of the `ensmallen` package on PyPI, along with several others in bioinformatics. The campaign features a multifaceted payload that executes upon package…
StepSecurity -
Instagram recovery bug lets attackers hijack 20k accounts
Meta has reported a serious security flaw in Instagram's account recovery system, allowing unauthorized access to user accounts. The vulnerability stemmed from a logic error in the High Touch Support AI tool, which failed to properly verify email addresses…
SecurityOnline -
APT28’s PixyNetLoader uses PNG steganography to hide malware
The article details an analysis of the PixyNetLoader malware linked to the APT28 group, which uses steganography to hide payloads in PNG files. The malware is a DLL-based loader that exploits a specific vulnerability to install itself and execute a malicious…
SecurityOnlineAPT28 -
UK DSIT Secures Half Million Domains Amid Rising Threats
The UK's Department of Science, Innovation and Technology (DSIT) is responsible for securing over half a million domains across various government organizations, including the National Health Service (NHS). At Infosecurity Europe 2026, Nick Woodcraft from…
Infosecurity -
Redis DarkReplica Exploit: Full PoC Code and Technical Details Released
Severe Infrastructure Exposure Discovered A researcher has released the technical mechanics of a critical post-authentication flaw impacting multiple
SecurityOnline -
Meta patches bug that sent Instagram reset links to wrong users
Meta disclosed a vulnerability in its AI-powered High Touch Support (HTS) tool that exposed over 20,000 Instagram accounts to unauthorized access. The flaw allowed third parties to exploit the system, receiving password reset links meant for the actual…
Infosecurity -
Anthropic calls for global pause on advanced AI development
Anthropic, the company behind the Claude chatbot, has proposed a coordinated pause in the development of advanced AI systems due to concerns over rapid advancements potentially leading to a loss of human control. They emphasize the need for a global…
SecurityWeek -
SolarWinds Serv-U4 articles this day · SecurityOnline first
CISA warns of DoS risk in SolarWinds Serv-U flaw CVE-2026-28318 · Verizon VoLTE flaw CVE-2026-28318 exposes calls to interception
-
CISA warns of DoS risk in SolarWinds Serv-U flaw CVE-2026-28318
The US cybersecurity agency CISA has issued a warning regarding attacks exploiting a recently patched vulnerability in SolarWinds' Serv-U software, tracked as CVE-2026-28318, which has a CVSS score of 7.5. This denial-of-service vulnerability can be…
-
Verizon VoLTE flaw CVE-2026-28318 exposes calls to interception
A critical vulnerability (CVE-2026-28318) has been detected in Verizon's VoLTE services, exposing mobile communications to severe risks. The flaw arises from the lack of necessary cryptographic protections in Verizon’s core voice network, allowing sensitive…
-
Attackers exploit CVE-2026-28318 and Zip Slip in Collibra Agent
A critical security vulnerability, CVE-2026-28318, has been detected in the Collibra Platform Agent, allowing remote code execution without authentication. The issue stems from inadequate handling of REST endpoints that expose sensitive functionalities. A…
-
SolarWinds ServU bug lets attackers drain system resources
The latest cybersecurity report highlights an active exploit related to CVE-2026-28318, affecting SolarWinds Serv-U by causing uncontrolled resource consumption. Between June 1 and June 7, 2026, security teams identified 1,701 new vulnerabilities,…
-
-
Broadcom patches VMware Cloud Foundation XSS bugs after alert
Broadcom has announced critical patches for its VMware Cloud Foundation due to multiple stored XSS vulnerabilities found in its management applications, affecting systems like VMware Aria Operations and VMware Telco Cloud Platform. The vulnerabilities, rated…
SecurityOnline -
UNC3753 gang uses vishing and break ins for US data theft
The article discusses the UNC3753 group, known for using vishing and physical intrusions as part of a data theft extortion campaign in the U.S. This cybercriminal organization highlights the dangers of social engineering and its implications for…
The Hacker NewsUNC3753 -
GitHub users face mystery outage as firm investigates status lag
GitHub is currently experiencing an unidentified technical outage affecting many users. Although access to the main homepage and individual repositories remains functional, connectivity issues were first noted approximately twenty-five minutes prior,…
SecurityOnline -
Operation FlutterBridge: macOS malware hijacks ads to steal data.
The article discusses a new malware campaign named Operation FlutterBridge targeting macOS systems, evolving from basic adware to sophisticated backdoor implementations. The malware exploits legitimate advertising platforms to distribute rogue software that…
SecurityOnline -
Meta Support Bot Gives Hackers Access to Instagram Accounts
The report from Malwarebytes Labs for the week of June 1 to June 7, 2026, highlights several significant cybersecurity issues. Key topics include: 1. Mobile device security, urging users to clean their phones. 2. A fake BlueWallet targeting Mac users to…
Malwarebytes -
New Gafgyt Botnet Variant C0XMO Hijacks DDWRT Routers for DDoS
The article discusses the emergence of C0XMO, a new variant of the Gafgyt botnet, which exploits unpatched vulnerabilities in IoT devices. Discovered in March 2026, C0XMO spreads through a specific flaw (CVE-2021-27137) found in DD-WRT router firmware,…
-
Gemini caching flaw on Google Cloud drives $200/hr bills
The content discusses a significant billing issue related to the Gemini platform on Google Cloud, specifically tied to a persistent caching defect causing excessive resource consumption and financial drain. Developers report an hourly cost of $200 due to…
SecurityOnline -
Google Password Manager adds passkey import/export support
The article discusses a critical security update regarding the Google Password Manager, specifically its new ability to support import and export of passkeys via the Credential Exchange Protocol (CXP). Traditionally, users could easily manage alphanumeric…
SecurityOnline -
Meta shuts AI recovery tool after 20k Instagram accounts hacked
Meta recently reported that approximately 20,000 Instagram accounts were hacked due to an exploitation of an AI-powered account recovery tool. Hackers could reset account passwords by manipulating this tool, which allowed them to link their email addresses…
SecurityWeek -
WeedHack malware targets Minecraft players via fake videos
The article discusses a dangerous malware campaign called WeedHack that is targeting online gaming communities, particularly Minecraft players. McAfee Labs has identified this campaign utilizing malware as a service, distributed through deceptive video…
SecurityOnline -
VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks
VS Code has introduced a two-hour delay for automatic updates of extensions in response to increasing concerns about supply chain attacks and malware risks. This measure aims to provide additional time for testing and vetting of updates before they are…
The Hacker News -
The Fractured Evolution of Wireless Connectivity: Stagnant Wi-Fi 7 Adoption and the Emergence of Wi-Fi 8
The article discusses the current state and future prospects of Wi-Fi technologies, specifically focusing on Wi-Fi 7's adoption and the upcoming Wi-Fi 8. Key points include: 1. **Wi-Fi 7** adoption is below 2% globally as of 2026, with Wi-Fi 6 and Wi-Fi 5…
SecurityOnline -
CVE-2026-47744 flaw lets attackers hijack Laravel Shopper admin
A critical vulnerability (CVE-2026-47744) has been found in the Shopper Laravel e-commerce platform, allowing unauthorized access to online store admin panels with a CVSS score of 9.9. The flaw involves an authorization bypass in the settings, which could…
-
Critical Sitefinity Vulnerabilities: CVSS 10.0 Security Alert
A critical security alert has been issued for Progress Sitefinity due to multiple high-priority vulnerabilities. Notably, CVE-2026-7312, rated 10.0 on the CVSS scale, allows unauthorized remote access to plain-text credentials. Other significant…
-
ISC Stormcast June 8 2026: Xavier Mertens Sees Green Threat Level
The content presents information about an ISC Stormcast for Monday, June 8th, 2026, including details about handler Xavier Mertens and the current threat level, which is green. It provides various links to relevant resources, including classes taught by…
SANS ISC -
Cloud Foundry UAA bug exposes private keys, CVE-2026-40965
A critical security vulnerability (CVE-2026-40965) has been discovered in the Cloud Foundry platform's User Account and Authentication (UAA) system, allowing unauthorized access to sensitive elliptic curve private keys through an API error. This flaw has a…
