News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 22 Jun· 66 articles
-
Attackers exploit bucket hijacking to reroute cloud data
The article discusses a newly identified cloud security vulnerability termed "bucket hijacking," which impacts major cloud service providers like AWS, Google Cloud, and Microsoft Azure. The threat arises from the global uniqueness of storage bucket names,…
unit42.paloaltonetworks.com -
Leaked files show APT35 runs like a government department
APT35, or Charming Kitten, represents a bureaucratic structure mimicking a hacker collective within Iranian cyber operations. Their latest leak exposes operational mechanics, revealing how espionage is administered with administrative diligence rather than…
dti.domaintools.comCharming Kitten -
Kaspersky flags WhatsApp malware that sends fake debt notices
A recent malware campaign targets WhatsApp users, hijacking accounts to distribute fake debt notices that install remote access software on victims' computers. The campaign, analyzed by Kaspersky, has affected users in various countries, primarily Malaysia.…
Security Affairs -
Two men, believed to part of Scattered Spiders, plead guilty over £39m TfL cyber attack
Two members of Scattered Spider, Thalha Jubair and Owen Flowers, have pleaded guilty to charges related to a significant cyber attack on Transport for London (TfL) that caused three months of disruption, resulting in a £39 million loss. Their change of plea…
DataBreachesScattered Spider -
AMD restores memory encryption on Ryzen CPUs after user outcry
AMD is reinstating memory encryption for its consumer CPUs following user backlash over the silent removal of the feature, known as Transparent Secure Memory Encryption (TSME). This encryption protects against physical attacks by encrypting data stored in…
Ars Technica -
Microsoft outlines AI memory security amid rising threats
The blog post discusses the significance of AI memory, which transforms AI from a stateless tool into a learning collaborator, enhancing personalization and coherence in user interactions but increasing potential security vulnerabilities. It outlines the…
Microsoft -
Texas Parks Breach Exposes 3 Million Records via Vendor Hack
The Texas Parks and Wildlife Department (TPWD) has reported a significant data breach affecting approximately 3 million individuals due to a compromise of a third-party vendor responsible for license sales. The breach exposed sensitive personal information,…
Security Affairs -
Backdoored ShapedPlugin WP Pro plugins raise supply chain risk
The article details a supply chain attack involving ShapedPlugin WordPress Pro plugins, which were backdoored to exploit vulnerabilities. This incident highlights the growing risks associated with supply chain security and emphasizes the importance of…
The Hacker News -
Cloudflare fixes hyper race condition bug that truncates images
In this article, Cloudflare's team explains how they identified and resolved a bug in the hyper HTTP library, which affected image processing requests through the Images service. The issue manifested as intermittent image data truncation during…
Cloudflare -
Flaw in Dify AI platform exposes tenant chat data to attackers
Researchers have identified vulnerabilities in Dify that could potentially allow unauthorized access to AI chat data across multiple tenants. This presents significant privacy risks as sensitive information shared in AI communications may be exposed. The…
The Hacker News -
Fake reputation scam spreads clipboard hijacker to steal crypto
The article details a significant cryptocurrency heist orchestrated by attackers utilizing an elaborate fake reputation-boosting campaign through platforms like GitHub, YouTube, and VirusTotal. Researchers from Check Point Software uncovered this advanced…
Dark Reading -
FBI warns hackers abuse traffic systems to send users to malware
The FBI has issued a warning about cyber criminals exploiting traffic distribution systems (TDS) to redirect users to malicious websites. These attackers alter the code of legitimate sites, specifically targeting those with weak security, to deploy TDS that…
SecurityOnline -
Xsolis data breach exposes 1.4M patients after phishing attack
Xsolis, Inc. is a healthcare business associate that focuses on utilization and case management services using AI and automation. On June 19, they notified clients' patients about a data breach due to a phishing attack on January 22, 2026. Although…
DataBreaches -
One intrusion, two cyberattackers: Uncovering parallel threat activity
The report from Microsoft's Detection and Response Team (DART) details a complex cyberattack involving a multi-stage intrusion by two parallel threat actors. Initially, a ransomware investigation revealed that the first actor, known as Storm-2603, had…
MicrosoftStorm-2603 -
Cherry Health reports breach exposing patient data in Michigan
On April 19, 2026, Cherry Health in Michigan detected suspicious network activity, revealing unauthorized access and data copying. A preliminary notice was published on June 18, 2026, which did not acknowledge previous reports suggesting a ransomware attack.…
DataBreaches -
AryStinger Botnet Hijacks 4,300 D Link Routers for Network Recon
Researchers have discovered that the AryStinger botnet has hijacked over 4,300 outdated D-Link routers and network-attached storage devices, turning them into a distributed scanning network for launching cyberattacks. The compromised devices exploit…
Malwarebytes -
Gentlemen ransomware uses GentleKiller to disable security tools
The GentleKiller Framework, developed by the ransomware group called The Gentlemen, is a sophisticated toolkit that disables victims' security software to facilitate ransomware attacks. Recent analysis from ESET reveals that GentleKiller targets over 400…
InfosecurityThe Gentlemen -
Squidbleed flaw exposes cleartext HTTP requests on legacy proxy
A 29-year-old vulnerability in the Squid proxy server, called 'Squidbleed', can leak cleartext HTTP requests, posing security risks. This vulnerability, discovered on June 22, 2026, highlights the importance of ongoing security evaluations, even for…
The Hacker News -
Webshells Remain Popular, (Mon, Jun 22nd)
The article discusses the ongoing popularity of webshells, particularly a new variant called ZypeerShell. This webshell, claimed to be 'the most powerful, undetectable, and feature-rich PHP webshell' is available on GitHub. The author, Xavier Mertens, notes…
SANS ISC -
Apple A12/A13 BootROM bug usbliter8 leaves devices open to attack
A critical BootROM vulnerability has been discovered affecting Apple A12 and A13 chips, enabling attackers with physical access to compromise the boot chain. Identified as 'usbliter8', this vulnerability stems from an exploit involving a USB controller flaw…
Infosecurity -
US blocks Anthropic AI after Mythos breaches NSA, Cyber Command
On June 12, 2026, the Trump administration ordered Anthropic to restrict access to its AI models, Fable 5 and Mythos 5, exclusively to U.S. citizens after Mythos allegedly breached NSA and Cyber Command systems within hours. Senate testimony revealed that…
Security Affairs -
Squidbleed bug leaks HTTP data via FTP flaw (CVE-2026-47729)
Security researchers from Calif.io have revealed a memory leak vulnerability in Squid Proxy, dubbed 'Squidbleed,' which has been present since 1997. The vulnerability, tracked as CVE-2026-47729, allows an FTP parser in Squid to read beyond memory boundaries,…
-
Google Ads Abused in Malvertising Push of CastleStealer
The article discusses the emergence of the OXLOADER loader, which utilizes malicious Google Ads to deliver the CastleStealer malware. It highlights the increasing trend of malvertising in cybersecurity threats, particularly focusing on endpoints. The content…
The Hacker News -
Beware of Fake Document Delivery Calls Demanding Urgent Payments
This article discusses document delivery scams, where scammers impersonate a legitimate delivery service to collect personal information and money from victims. Key points include: 1. **Nature of the Scam:** Scammers create an official-sounding voicemail…
Malwarebytes -
Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries
Google has set a September 30, 2026 deadline for Android developers in four countries to complete verification processes. The article outlines the importance of this initiative for enhancing mobile security and ensuring compliance with the latest industry…
The Hacker News -
Google Uncovers UNC6508 Cyber Espionage Campaign
The article discusses a cyber espionage campaign attributed to the UNC6508 threat actor, believed to be linked to China. This group targeted North American academic, medical, and military research organizations using bespoke INFINITERED malware, achieving…
SecurityOnlineUNC6508 -
Five Eyes warn AI heightens cyber risk, urge stronger defences
The Five Eyes cyber security agencies have issued a call to action regarding the rapidly transforming landscape of artificial intelligence (AI) and its impact on cyber risk. They emphasize that, while AI enhances cyber defenses, it also accelerates and…
ncsc.gov.uk -
Protecting AI Agents from Legacy System Vulnerabilities
The article discusses the importance of protecting AI agents from being compromised by legacy infrastructure, highlighting vulnerabilities that can lead to attacks on these AI systems. It emphasizes the need for organizations to implement modern…
The Hacker News -
Gravity SMTP Plugin Flaw (CVE-2026-4020) Exposes Site Data
Threat actors are exploiting a medium-severity vulnerability (CVE-2026-4020) in the Gravity SMTP WordPress plugin, affecting versions before 2.1.5. This vulnerability allows unauthenticated users to access sensitive system information through a REST API…
-
STARDUST CHOLLIMA2 articles this day · SecurityWeek first
North Korean hackers breach Mastra via tainted npm packages · North Korean Group Targets NPM Supply Chain, 8M Devs at Risk
2 outlets-
North Korean hackers breach Mastra via tainted npm packages
Microsoft has attributed a recent supply chain attack against Mastra, an open-source AI application development framework, to North Korean hackers, specifically a group known as Sapphire Sleet. The attack involved breaching an npm maintainer account to…
Infosecurity -
North Korean Group Targets NPM Supply Chain, 8M Devs at Risk
Microsoft reports that the North Korean group Sapphire Sleet conducted a supply chain attack affecting over 140 NPM packages linked to the Mastra open-source framework on June 17. The attackers utilized a compromised maintainer account to introduce a…
SecurityWeek
-
-
Smart TV botnet rises amid browser bugs and Android Trojan surge
The article discusses key cybersecurity incidents and advancements from the past week, highlighting various security vulnerabilities and threats. Key points include: 1) The emergence of browser bugs and their implications. 2) The potential risks of endpoint…
The Hacker News -
ShinyHunters shift focus to stolen credentials and token abuse
The article discusses the evolving tactics of cybercriminals, specifically the ShinyHunters collective, who are increasingly targeting identities and authentication processes rather than exploiting software vulnerabilities. Key points include: 1) Attackers…
SecurityWeekShinyHunters -
Russian hackers steal 110M credentials from 430k FortiGate devices
The article details the FortiBleed operation, a significant Russian credential-harvesting campaign affecting over 430,000 FortiGate firewalls and capturing around 110 million credentials. Conducted by SOCRadar's Threat Research Unit (STRU), the report…
Security Affairs -
Klue breach leaks OAuth tokens, puts cybersecurity firms on alert
The article discusses a security breach at Klue, a business intelligence provider, which has affected multiple cybersecurity firms. Unauthorized access was gained through a compromised legacy credential leading to the theft of OAuth tokens that allowed…
InfosecurityIcarus -
New BootROM flaw Usbliter8 puts iPhone A12/A13 models at risk
A new BootROM exploit, named Usbliter8, has been disclosed by the European cybersecurity firm Paradigm Shift, affecting millions of iPhones and Apple Watches. This exploit targets Apple’s SecureROM, which is critical for the secure boot process. Usbliter8…
SecurityWeek -
Malicious VBScript spreads via WhatsApp, drops RMM on victims
A malware campaign has been identified that distributes malicious VBScript files via WhatsApp, primarily targeting users of WhatsApp Desktop and Web in multiple countries including Malaysia, Brazil, and India. The attack employs social engineering tactics,…
securelist.com -
Fortinet Alerts Users to Massive Credential Harvesting Campaign
Fortinet is currently facing a large-scale credential-harvesting campaign termed 'FortiBleed,' which has compromised over 86,000 credentials for its firewalls and VPNs across 194 countries. Unlike typical attacks, this incident does not exploit new…
SecurityWeek -
QNAP patches critical QuMagie flaws exposing private photos
QNAP has addressed four significant vulnerabilities in their QuMagie photo management app, impacting versions prior to 2.9.1 and 1.9.56 with a high severity score of 9.8 (CVSSv3). These vulnerabilities allow unauthenticated access to personal media files, AI…
-
UK Information Commissioner Resigns Over Harassment Allegations
John Edwards, the UK Information Commissioner, resigned following an HR investigation that substantiated complaints regarding inappropriate behavior in the workplace. His conduct was deemed unacceptable for a public official, with evidence of vulgar language…
Infosecurity
