News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 19 Jun· 55 articles
-
15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers
A coordinated 8-month supply chain attack on the JetBrains Marketplace led to the exposure of API keys from approximately 70,000 developers. Fifteen malicious plugins masqueraded as legitimate AI tools, embedding credential-stealing code that exfiltrated…
StepSecurity -
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
The article discusses the unpatchable 'usbliter8' exploit that undermines the SecureROM boot chain of Apple A12 and A13 chips, posing significant security vulnerabilities. This exploit allows unauthorized access that is difficult to mitigate, highlighting…
The Hacker News -
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The article discusses the emergence of the Gentlemen Ransomware-as-a-Service (RaaS), utilizing the GentleKiller EDR framework, which targets approximately 400 security processes. It highlights the increasing sophistication of cyber threats, particularly in…
The Hacker NewsThe Gentlemen -
Operation Endgame Shuts Down SocGholish, Cleans 15k WP Sites
A recent law enforcement action named Operation Endgame successfully dismantled the SocGholish malware operation, which has been distributing fake software updates since 2017. Authorities cleaned nearly 15,000 infected WordPress sites and took down 106…
MalwarebytesSocGholish -
AutoJack Attack lets sites hijack AI agents to execute code
The article discusses the AutoJack Attack, a vulnerability that allows a web page to hijack an AI agent for code execution on the host system. This security threat highlights the risks associated with AI-driven systems, particularly in the context of…
The Hacker News -
In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum
This week's cybersecurity roundup includes critical updates such as: a 10-year-old phpBB flaw allowing session hijacking, Velvet Ant's stealth operations in air-gapped infrastructures, vulnerabilities in Chrome extensions impacting over 10 million users, and…
SecurityWeek -
Splunk Enterprise2 articles this day · Security Affairs first
CVE-2026-20253 Splunk bug lets hackers run code remotely · CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21
-
CVE-2026-20253 Splunk bug lets hackers run code remotely
CVE-2026-20253 is a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to perform arbitrary file operations, potentially leading to remote code execution (RCE). CISA warns of active exploitation and has listed this…
-
CISA adds Splunk flaw CVE-2026-20253, urges patch by June 21
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a severe flaw, CVE-2026-20253, in Splunk Enterprise to its Known Exploited Vulnerabilities catalog. This flaw, which has a CVSS score of 9.8, stems from improper authentication on the…
-
-
Operation Endgame dismantles SocGholish, cleans 15k sites
The article titled "Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites" discusses a significant cybersecurity operation that effectively dismantled the servers associated with the SocGholish malware. This operation led to the…
The Hacker News -
Gcore protects Ucom's election stream from Armenian DDoS threats
Gcore provided DDoS protection to Ucom, a leading Armenian telecommunications provider, during the 2026 parliamentary elections to ensure the stability of public live broadcast services. Ucom faced risks of Layer 3 and Layer 4 DDoS attacks, which could…
SecurityOnline -
FortiBleed flaw exposes 86,000 FortiGate devices, CISA warns
CISA has issued a warning regarding the vulnerability known as FortiBleed, which has impacted 86,644 FortiGate devices. The vulnerability emphasizes the importance of patch management and cybersecurity vigilance. Organizations using Fortinet products are…
The Hacker News -
Operation EndGame Disables SocGholish, Seizes 106 Servers
On June 18, 2026, a coordinated international law enforcement operation, 'Operation EndGame,' successfully disrupted the SocGholish malware distribution network. The operation resulted in the takedown of 106 servers and remediation of 14,971 compromised…
Security Affairs -
Fake review campaign floods AI search, damaging eFAQ's reputation
The eFAQ investigation reveals a coordinated reputation attack aimed at manipulating brand perception in search results and AI-assisted platforms. The campaign involved the creation of multiple accounts that posted identical negative claims about…
SecurityOnline -
Bombay Court Blocks Hacker Group From Leaking Kids' Data
The Bombay High Court issued an interim order to stop the hacker group FulcrumSec from leaking sensitive data related to students from the Pratiksha Foundation Charitable Trust. The leaked data includes personal medical details and information about the…
DataBreachesFulcrumSec -
CISOs shift to part time as AI and threats pile on pressure
Chief Information Security Officers (CISOs) are facing increasing pressures due to the complexity of cyber threats and the advent of AI technologies. A survey by ISSA and Omdia reveals that 68% of cybersecurity professionals find their jobs more challenging…
Dark Reading -
Cloudflare launches temporary accounts to ease AI agent workflows
Cloudflare has introduced Temporary Cloudflare Accounts for AI agents to facilitate smoother deployments without traditional signup processes. Agents can deploy websites and APIs instantly using the `wrangler deploy --temporary` command, which creates a…
Cloudflare -
Agentic AI now hunts and stops cyber threats on its own
The article discusses the evolution of AI in cybersecurity, transitioning from assistive to agentic roles in threat management. It highlights how agentic AI can autonomously identify and mitigate cyber threats, thereby enhancing security solutions. Key…
The Hacker News -
Apple patches CVE-2025-20701 Bluetooth flaw in Beats Studio Buds
Apple has addressed a critical Bluetooth vulnerability, tracked as CVE-2025-20701, affecting Beats Studio Buds that could allow attackers to eavesdrop on users via the earbuds' microphones. This flaw relates to improper verification during the pairing…
-
Microsoft flags CryptoBandits malware that steals crypto via .lnk
Microsoft has issued a warning about a new malware called CryptoBandits, which targets Windows systems to steal cryptocurrency. The malware operates by using a lightweight backdoor, facilitating remote code execution, and data exfiltration. It has been…
SecurityWeek -
AWS Introduces AI Powered Continuum for Vulnerability Management
Amazon Web Services (AWS) recently launched 'Continuum', an AI-powered vulnerability management platform designed to assist security teams in managing the lifecycle of code vulnerabilities from discovery to remediation. Announced during the AWS Summit in New…
Infosecurity -
CISA urges action after FortiBleed hits 86k firewalls
CISA is urging organizations to secure their Fortinet devices due to the FortiBleed campaign, which has compromised over 86,000 firewalls and VPNs. This campaign involves a Russian-speaking threat actor who has compiled a database of working credentials from…
SecurityWeek -
Forget Data Leakage: Shadow AI's Real Threat Is Access Control
The article titled "Forget Data Leakage: Shadow AI's Real Threat Is Access Control" emphasizes that while data leakage remains a concern, the primary risk associated with Shadow AI lies in inadequate access control measures. This highlights the need for…
The Hacker News -
Dutch Police Lead Global Takedown of SocGholish Malware Botnet
Operation Endgame has successfully disrupted the SocGholish malware network, which was part of a global police initiative against cybercrime. The Dutch police announced the takedown, which involved dismantling a botnet linked to 15,000 infected websites,…
InfosecurityEvil Corp -
FortiBleed Reveals Credential Reuse Threat to Fortinet Devices
The article discusses FortiBleed, a large-scale credential theft campaign targeting Fortinet devices, particularly FortiGate firewalls and SSL VPN gateways. The operation is driven by credential reuse, using stolen credentials from previous breaches.…
SOCRadar -
Klue supply chain breach leaks OAuth tokens via Salesforce API
A recent supply chain attack on the market intelligence platform Klue has led to unauthorized access to sensitive data. This incident, which began on June 11, allowed hackers to exploit Klue's backend servers and execute malicious commands that harvested…
SecurityWeekIcarus -
CERT Polska warns of Ghostwriter Gmail phishing aimed at elites
Poland's national cyber team, CERT Polska, warns of an active phishing campaign by the group UNC1151 (also known as Ghostwriter) targeting Gmail accounts, particularly high-profile users, since March 2026. This Belarus-linked group aims to steal credentials,…
SecurityOnlineGhostwriter -
Salesforce disables Klue app after OAuth token leak
Salesforce has disabled its Klue app integration following incidents of OAuth token abuse, which compromised customer data. This incident highlights ongoing concerns regarding cloud security and data breaches in tech applications.
The Hacker News -
Half of Firms Unsure About Threat Detection in Slack and Teams
A recent study highlights growing concerns among cybersecurity leaders regarding the detection of cyber threats in non-email platforms like Slack and Microsoft Teams. Conducted at Infosecurity Europe 2026, the survey revealed that 50% of cybersecurity…
Infosecurity -
F5 releases patches for critical NGINX HTTP/3 and HTTP/2 flaws
F5 has issued urgent patches for two critical vulnerabilities in NGINX: CVE-2026-42530 and CVE-2026-42055. CVE-2026-42530, categorized as a major-severity use-after-free vulnerability in NGINX's HTTP/3 implementation, affects versions 1.31.0 to 1.31.1,…
-
IBM X Force ties Interlock and Rhysida ransomware via tools
IBM X-Force's research reveals a two-year overview of the Interlock and Rhysida ransomware ecosystem, detailing connections between initial-access brokers, crypters, and backdoors. Interlock has been active since September 2024, using a custom toolkit, while…
SecurityOnlineInterlock -
Dialog network leak reveals elite members' personal data
A significant data breach at Peter Thiel's exclusive Dialog network exposed sensitive personal details of its members, including participation in events, personal biographies, and login tokens. Discovered by hacktivist maia arson crimew, an open directory on…
Security Affairs -
CVE-2026-8713 lets attackers delete files in Avada Builder plugin
A critical vulnerability, CVE-2026-8713, has been detected in the Avada Builder plugin for WordPress, impacting around 1 million sites. This flaw allows unauthenticated attackers to delete any server file, including critical WordPress files, by exploiting…
-
APT37 Uses Fake Microsoft Emails to Drop NarwhalRAT on Korean PCs
The article discusses the APT37 NarwhalRAT malware, a sophisticated Python-based backdoor that targets Korean users via spear-phishing attacks. Attackers impersonate Microsoft in deceptive emails, prompting users to download malicious attachments. The…
SecurityOnlineAPT37 -
Cisco acquires WideField Security to strengthen Splunk’s Agentic SOC
Cisco has announced its acquisition of WideField Security to enhance the capabilities of Splunk’s Agentic SOC. The deal, details undisclosed, aims to strengthen identity lifecycle security by integrating WideField's technology, which helps organizations…
SecurityWeek -
Belgian bank targeted by phishing using IPv4 mapped IPv6 trick
Xavier Mertens reported on a phishing email targeting a major Belgian bank, utilizing an interesting technique by embedding an IPv4-mapped IPv6 address within a URL. The phishing link is disguised as 'hxxp://[::ffff:5511:74be]/kWC5PHA1', which can be…
SANS ISC -
Google Calendar gains RGB colour picker and expands palette
Google has announced an update to Google Calendar, increasing the color options available for event organization. Key changes include an expansion from 11 to 24 default color choices and the introduction of a full RGB color picker, allowing users to choose…
SecurityOnline -
Anthropic compensates Claude Code users after server outage
On June 19, a server issue at Claude Code affected around 3% of the premium subscriber base, preventing users from sending messages due to quota misrepresentation. Anthropic announced a compensatory reset for affected users, including a five-hour allocation…
SecurityOnline -
Global police take down SocGholish malware, protect 15k WP sites
Law enforcement from four countries collaborated with Europol to dismantle the SocGholish malware infrastructure, affecting nearly 15,000 compromised WordPress websites. Known since 2017, SocGholish is a malware framework utilized for deploying various…
SecurityWeekMustard Tempest -
Apple Patches Beats Studio Buds After Mic Eavesdropping Flaw
Apple has issued a patch for its Beats Studio Buds to address a significant security flaw that allowed nearby attackers to use the device's microphone for eavesdropping. The vulnerability posed a risk where users could unknowingly be spied on, prompting the…
The Hacker News -
SiderAI and MaxAI extensions suffer critical zero day flaws
Recent research has unveiled critical vulnerabilities in two widely used Chrome extensions, SiderAI and MaxAI, with over ten million combined installations. These flaws, named Spyder and MaXSS, allow attackers to exploit users' browsers without requiring any…
SecurityOnline
