News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 16 Jun· 79 articles
-
Cisco Catalyst SD-WAN Manager3 articles this day · SecurityWeek first
Cisco SD WAN manager flaw lets attackers write files, patch urged · CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack
-
Cisco SD WAN manager flaw lets attackers write files, patch urged
Cisco's Catalyst SD-WAN Manager has a vulnerability identified as CVE-2026-20262, which allows for arbitrary file writes, and is currently being exploited in the wild. This flaw has a CVSS score of 6.5 and stems from improper validation of user inputs during…
-
CISA Flags Cisco SD WAN and LiteSpeed Plugins Under Active Attack
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-20262 and CVE-2026-54420. CVE-2026-20262, with a CVSS score of 6.5, affects the Cisco Catalyst SD-WAN…
-
Cisco Patches Another SD-WAN Zero-Day Exploited in Attacks
Cisco has issued a warning regarding a zero-day vulnerability, tracked as CVE-2026-20262, affecting its Catalyst SD-WAN Manager. This medium-severity flaw allows attackers to exploit specially crafted HTTP requests to create or overwrite files on the…
-
-
Arch Linux halts AUR signups after 1500 package supply attack
Arch Linux has suspended new account registrations on the Arch User Repository (AUR) due to a significant supply chain attack, known as Atomic Arch, which involves over 1,500 malicious packages. The attack began with modifications to abandoned packages that…
SecurityWeek -
US seizes CFake.com and SOCFake.com under TAKE IT DOWN Act
The U.S. Departments of Justice and Homeland Security have seized the domains CFake.com and SOCFake.com under the TAKE IT DOWN Act, which criminalizes the publication of nonconsensual intimate imagery, including deepfakes. The act mandates content removal…
Malwarebytes -
US seizes deepfake sites CFake.com, SOCFake.com under new law
The U.S. Departments of Justice and Homeland Security have seized the domains CFake.com and SOCFake.com due to their involvement in nonconsensual intimate deepfakes, as enforced under the TAKE IT DOWN Act, which criminalizes such publications. The seizure…
Malwarebytes -
Fortinet FortiSandbox flaws exploited after recent patch
The article discusses three recently exploited vulnerabilities in Fortinet's FortiSandbox, underscoring one that was patched just a week before the exploitation. It highlights the importance of timely updates and vigilance in cybersecurity to protect against…
The Hacker News -
Tech chiefs urge US to lift curbs on Anthropic's Fable 5 AI
A group of over 100 cybersecurity leaders, including executives from Adobe and Nvidia, is urging the Trump administration to remove export restrictions on Anthropic's latest AI models, Fable 5 and Mythos 5. They argue that the restrictions could…
SecurityWeek -
US bars export of Claude Fable 5 AI over jailbreak security flaws
The U.S. government has implemented an emergency export control directive banning the Claude Fable 5 AI model from being offered to non-U.S. citizens due to critical security vulnerabilities. Anthropic, the model's developer, is in negotiations with the…
SecurityOnline -
Vertex AI SDK bug enables model hijack via bucket squatting
The Palo Alto Networks report discusses a vulnerability in the Google Cloud Vertex AI SDK for Python, which potentially allows attackers to hijack and poison model uploads via a technique known as 'bucket squatting.' This exploit enables remote code…
unit42.paloaltonetworks.com -
Chinese SprySOCKS backdoor gains Windows driver stealth capability
The article discusses the expansion of the SprySOCKS backdoor associated with Chinese cyber espionage, now targeting Windows systems through driver-based stealth techniques. It highlights malware trends, the importance of cybersecurity measures, and ongoing…
The Hacker News -
Fintech firms launch Athena to guard open source from AI hacks
A coalition named Athena has been formed by over two dozen fintech and tech organizations to safeguard open source software (OSS) from AI-driven cyber exploitation. Key members include BNY, Cisco, and JPMorgan Chase. Athena aims to identify and mitigate…
SecurityWeek -
Microsoft Teams brings back Workplace Check in location tracking
The article discusses the reintroduction of Microsoft's controversial Workplace Check-in feature for Microsoft Teams that allows tracking employee presence based on Wi-Fi connections. Initially criticized for corporate surveillance, Microsoft modified its…
SecurityOnline -
North Korea linked hackers target devs with fake job phishing
The article discusses the UNK_DeadDrop phishing campaigns targeting software developers, assessed to be orchestrated by North Korea-aligned hackers. These attacks leverage fake job offers and code review requests to infiltrate companies and steal sensitive…
SecurityOnline -
Malware in Steam Wallpaper Engine hits Chinese, Russian gamers
The article discusses the rise of malware distributing through 'Wallpaper Engine' on the Steam Workshop, targeting mainly gamers in China and Russia. Attackers exploit the app's ability to share custom wallpapers, embedding malware within them. Popular types…
securelist.com -
Telegram bots get new HTML, Markdown features for richer chats
The page discusses new features in Telegram that enhance bot capabilities through improved HTML and Markdown formatting, enabling developers to create richer, interactive content. Key enhancements include support for complex text structures, multimedia…
SecurityOnline -
LiteSpeed cPanel Plugin3 articles this day · SecurityOnline first
Could Apple Build Its Own OpenClaw Competitor? · Inside the Stealthy Agent Tesla Infection Chain
-
Could Apple Build Its Own OpenClaw Competitor?
The article discusses two critical security vulnerabilities detected today: CVE-2026-54420 related to LiteSpeed cPanel and CVE-2026-20262 concerning Cisco Catalyst SD-WAN Manager. Additionally, it speculates on Apple's potential development of an AI agent…
-
Inside the Stealthy Agent Tesla Infection Chain
The article highlights two critical vulnerabilities detected today: CVE-2026-54420 related to a LiteSpeed cPanel Plugin and CVE-2026-20262 involving Cisco Catalyst SD-WAN Manager. It elaborates on an advanced malware infection chain, specifically Agent…
-
LiteSpeed flaw lets users gain root, Cisco SD WAN also exposed
Two critical vulnerabilities have been detected: CVE-2026-54420 affects the LiteSpeed cPanel Plugin, enabling privilege escalation for low-privileged users to gain root access, and CVE-2026-20262 pertains to Cisco Catalyst SD-WAN Manager allowing directory…
-
-
FBI warns crypto courier cash scams are on the rise
The FBI warns that scams involving cryptocurrency investment are escalating, with fraudsters using cash pickups by couriers to circumvent bank checks. Victims are lured through unsolicited communications, often believing they need to pay 'fines' or upscale…
Infosecurity -
North Korean Hackers Deploy Fake Microsoft Alerts for NarwhalRAT
The article discusses the use of fake Microsoft alerts to deploy NarwhalRAT malware by North Korean attackers. This malware allows remote access to infected systems, posing significant security threats. The report emphasizes the growing sophistication of…
The Hacker News -
Fluffy Wolf hits Russia with fileless PowerLoader and ransomware
In recent months, the threat actor known as Fluffy Wolf has intensified phishing attacks targeting various sectors in Russia, including construction and e-commerce. These attacks utilize deceptive emails containing malicious RAR attachments and GitHub links…
SecurityOnlineFluffy Wolf -
Curl halts bug reports for summer, delays 8.22.0 release
The curl project has announced a month-long pause on accepting vulnerability reports, dubbed the "curl summer of bliss," from July 1 to August 3, 2026, to allow the team to rest after extensive workloads. During this period, urgent issues will still be…
SecurityOnline -
Chinese hackers stole data from US medical networks for two years
A cyberespionage group linked to China, known as UNC6508, infiltrated North American medical research networks for over two years, starting from September 2023. This group was discovered in November 2025, indicating a lack of visibility in network defenses.…
Security AffairsUNC6508 -
AMD silently disables TSME memory encryption on mid range Ryzen
AMD's Transparent Secure Memory Encryption (TSME), introduced in 2016, has been removed from mid-range and entry-level Ryzen processors through recent BIOS updates, with no public explanation or mention in release notes. TSME, which provided robust memory…
SecurityOnline -
Novo Nordisk breach leaks AI models from Dragonfly project
Novo Nordisk experienced a significant data breach where attackers accessed and stole sensitive information, including fully trained AI models, proprietary datasets, training codebases, and logs. The hackers claimed to have exfiltrated 16.7GB from a project…
SecurityOnline -
Anthropic Faces Lawsuit Over Max Subscription Limit Claims
A class-action lawsuit has been filed against Anthropic by Karl Kahn in the U.S. District Court for Northern California, claiming deceptive advertising regarding their Claude Max subscription limits. The lawsuit alleges that both the $100 5x usage plan and…
SecurityOnline -
German users hit by ZIP to VHDX malware delivering Remcos RAT
The article, authored by Xavier Mertens, discusses a cybersecurity threat involving a malicious ZIP file that, when extracted, reveals a VHDX file containing obfuscated JavaScript. This JavaScript leverages WMI to execute a PowerShell script, bypassing…
SANS ISC -
Zscaler Warns of MLTBackdoor Malware Using ClickFix Deception
The article discusses the emergence of the MLTBackdoor malware family, identified by Zscaler ThreatLabz, which employs sophisticated evasion tactics and social engineering to infiltrate corporate environments. It highlights a multi-stage delivery mechanism…
SecurityOnline -
Cisco patches critical SDWAN Manager flaw under active attack
Cisco has released important security updates addressing a significant vulnerability in its SD-WAN Manager that is currently being exploited. Organizations using this software should promptly apply these updates to mitigate potential attacks. The updates are…
The Hacker News -
LiteSpeed cPanel plugin bug lets hackers gain root, CISA warns
The article discusses a critical vulnerability in the LiteSpeed cPanel plugin that can be exploited for root privilege escalation, as flagged by CISA. It emphasizes the need for server security measures to prevent such attacks. Highlights include the urgent…
The Hacker News -
Tornado fixes credential leak in redirect, urges immediate update
The Tornado web framework has addressed three critical security vulnerabilities in its version 6.5.6 update. The most severe issue (CVE-2026-49853) is a credential leak where the SimpleAsyncHTTPClient retains the original Authorization header during…
-
Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)
The article discusses a critical remote code execution (RCE) vulnerability in the Vitest testing framework, tracked as CVE-2026-53633, with a CVSS score of 9.8. The vulnerability arises from the Browser Mode's cdp() API, which allows attackers to bypass…
-
Haskell TLS flaw allows forged certificates, CVE-2026-9648
A serious vulnerability in the Haskell TLS library (CVE-2026-9648) poses risks to secure communications in finance and enterprise systems. The flaw stems from the crypton-x509-validation library's failure to enforce X.509 NameConstraints, allowing attackers…
-
ISC Stormcast June 2026: Green Alert, Xavier Mertens Hosts
The ISC Stormcast for June 16th, 2026, is presented by handler Xavier Mertens with a current threat level classified as green. Listeners can learn more about Dr. Johannes Ullrich and the classes he teaches for SANS via provided links. Additional features on…
SANS ISC -
CVE-2026-28742 flaw exposes Naxclow smart devices to hijack
CISA has revealed seven serious vulnerabilities in Naxclow IoT products, including popular smart doorbells and cameras, which allow attackers to hijack devices and access sensitive information. The most critical issue, CVE-2026-28742, is linked to a…
-
FreeSWITCH bugs allow remote code exec without auth, urgent patch
The content discusses two critical security vulnerabilities in FreeSWITCH, an open-source telecom stack, identified as CVE-2026-49841 and CVE-2026-49840. Both are heap buffer overflow bugs that can lead to crashes and possible remote code execution without…
-
Novo Nordisk Faces Data Breach Exposing 11,500 Trial Records
Novo Nordisk, a major producer of insulin and semaglutide, reported a cybersecurity incident affecting patient data from clinical trials. The breach involved pseudoanonymized records from approximately 11,500 research participants. The hacker group…
DataBreachesFulcrumSec -
Critical phpBB OAuth flaw lets hackers hijack any account
A critical vulnerability (CVE-2026-48611) in phpBB allows unauthenticated attackers to log in as any user, including administrators, compromising numerous online communities. The flaw exists in phpBB's OAuth implementation, requiring only the target's…
