News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 19 Jun· 55 articles
-
Massive 24 Billion Credential Leak Found in Exposed Elasticsearch
A massive data leak has exposed 24 billion stolen credentials, including usernames, emails, and plaintext passwords, mainly from infostealers and Telegram channels associated with cybercrime. Researchers discovered an Elasticsearch cluster with over 8.3…
Security Affairs -
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure
A critical vulnerability in Splunk Enterprise, identified as CVE-2026-20253, is being actively exploited, prompting urgent patching for affected versions (10.2 < 10.2.4 and 10.0 < 10.0.7). This vulnerability allows unauthenticated attackers to perform file…
-
Apple enables third party store payments in Brazil via iOS 26.5
Apple has announced significant changes for iPhone users in Brazil, allowing them to download apps from third-party marketplaces and integrate alternative payment systems. This follows a three-year antitrust battle initiated by MercadoLibre against Apple's…
SecurityOnline -
F5 Patches Two Critical NGINX Flaws in HTTP/3 and HTTP/2 Modules (CVE-2026-42530, CVE-2026-42055)
F5 has released urgent patches for two critical vulnerabilities in its NGINX web server, both scoring 9.2 on the CVSS v4.0 scale. The first vulnerability (CVE-2026-42530) is a use-after-free issue found in the HTTP/3 module, which can lead to service denial…
-
Critical iba Deserialization Vulnerability Exposes ibaPDA and ibaDatCoordinator to RCE (CVE-2026-8024)
A critical vulnerability identified as CVE-2026-8024 affects ibaPDA and ibaDatCoordinator, allowing remote attackers to execute arbitrary code without authentication. Rated 9.3 on the CVSS scale, it poses a significant risk to industrial data acquisition and…
-
OpenBSD vulnerability allows auth bypass using empty credentials
A critical vulnerability, CVE-2026-55706, has been discovered in OpenBSD, allowing an authentication bypass in the PAP login process. This issue, which has remained unnoticed for 27 years, enables attackers to authenticate without credentials due to improper…
-
LiteLLM bug lets attackers bypass auth via Host header, CVSS 9.5
A critical vulnerability, CVE-2026-49468, has been identified in LiteLLM, an open-source AI gateway product. This flaw allows for authentication bypass via a Host header injection, achieving a CVSS rating of 9.5. The vulnerability affects versions below…
-
Langflow File Upload Flaw: Details and PoC Exploit Publicly Disclosed (CVE-2026-55450)
A critical vulnerability (CVE-2026-55450) in Langflow, an open-source platform, allows unauthenticated users to upload unlimited data, leading to potential denial-of-service conditions and information leaks. The CVSS score is 9.3, indicating a high severity.…
-
Canadian hacker pleads guilty to charges for cyberattack on Texas Republican website
Alexandra Posadzki reports that Canadian hacker Aubrey Cottle has pleaded guilty to three charges related to a cyberattack on the Texas Republican Party, associated with the hacktivist group Anonymous. Cottle admitted to fraudulently obtaining computer…
DataBreachesAnonymous Sudan -
Blue Fish Pediatrics breach exposes data of 41,485 Texas patients
A data breach at Blue Fish Pediatrics in Houston may have exposed personal and protected health information of 41,485 Texans. The breach occurred between July 11 and July 17, 2025, but notifications to patients are only being sent now. The compromised…
DataBreaches -
Amazon-owned One Medical Faces ShinyHunters Data Leak Threat
One Medical, acquired by Amazon in 2023, is under scrutiny after the cybercriminal group ShinyHunters claimed to have stolen 8.8 terabytes of its data, threatening to publish it unless negotiations are initiated by June 22. The authenticity of the claim is…
DataBreachesShinyHunters -
Texas Parks & Wildlife breach exposes 3 million driver licences
A data breach at a Texas state government department compromised the driver’s license information and passport numbers of over 3 million individuals, as reported by the state's attorney general. This breach is recognized as one of the largest data incidents…
DataBreaches -
Spencer Gifts Plan Pays $450k After HIPAA Breach Affecting 10k
The U.S. Department of Health and Human Services (HHS) announced a settlement with Spencer Gifts LLC's health plan over HIPAA violations related to a data breach that potentially affected the personal health information (PHI) of 10,023 individuals. Following…
DataBreaches -
Rockwell Automation patches multiple ICS flaws
Rockwell Automation has announced vulnerabilities in its FactoryTalk Historian and FLEX I/O devices, urging critical manufacturing operators to patch immediately. The most severe issue in the FactoryTalk Historian, identified as CVE-2025-13036, is an…
-
AutoGen Studio bug lets rogue web code execute local commands
The article discusses a security vulnerability discovered in AutoGen Studio, a framework for AI agents, referred to as "AutoJack." This vulnerability allows untrusted web content loaded by an AI agent to execute arbitrary processes on the local host due to a…
Microsoft
