News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 17 so far |
Fri 26 Jun· 59 articles
-
Jaguar Land Rover ransomware attack costs UK economy £1.9 billion
A substantial cyberattack on Jaguar Land Rover has had significant repercussions on the UK economy, costing approximately £1.9 billion ($2.5 billion) and impacting over 5,000 businesses, leading to historic lows in car production. Investigators have…
DataBreaches -
FBI warns Russian hackers target Signal backup recovery keys
The FBI has issued a warning about Russian intelligence hackers targeting Signal backup recovery keys, emphasizing that these attackers are attempting to exploit vulnerabilities in secure messaging systems and social engineering tactics. The alert highlights…
The Hacker News -
AI Pen Testing Trust Drops to 9% Over False Positives and Costs
In 2026, a significant decline in trust towards autonomous AI in penetration testing was reported, with only 9% of organizations relying on AI for security, down from 29% in 2025. Security professionals have grown cautious after realizing AI systems often…
Dark Reading -
Court Dismisses Bayamón Med Center Breach Suit Over Causation
The First Circuit upheld the dismissal of a proposed class action lawsuit regarding a data breach at Bayamón Medical Center (BMC). The court determined that the plaintiff could not sufficiently link her alleged injuries to a 2019 ransomware attack on BMC.…
DataBreaches -
SharkLoader Malware Deploys Cobalt Strike in StrikeShark Attacks
The article discusses the emergence of new SharkLoader malware that deploys Cobalt Strike in cyberattacks known as StrikeShark. This malware poses significant threats to Windows security, highlighting vulnerabilities faced by organizations. It emphasizes the…
The Hacker News -
Cisco buys Astrix and WideField to secure AI agents and API keys
Cisco has made recent acquisitions of Astrix Security and WideField Security to enhance its security platform, particularly focusing on the management of non-human identities (NHIs) such as API keys and AI agents that possess human-level privileges. As…
Dark Reading -
UAT-72372 articles this day · Infosecurity first
Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware · China Linked Hackers Use New TinyRCT Malware in SE Asia Energy
2 outlets-
Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware
A recent report by Unit 42 highlights the Chinese APT group CL-STA-1062, which has expanded its operations targeting Southeast Asian government and critical energy infrastructure since mid-2025. This group, previously linked to attacks on Taiwan's web…
Security Affairs -
China Linked Hackers Use New TinyRCT Malware in SE Asia Energy
The article discusses a sustained cyber campaign attributed to China-linked hackers, specifically a group named CL-STA-1062, targeting critical infrastructure in Southeast Asia, particularly state-owned energy sectors. The campaign involves the use of a new…
Infosecurity
-
-
New Open Source Initiative Addresses End of Life Software Risks
The Open Source Sustainability Initiative (OSSI) has been launched by the Commonhaus Foundation to assist enterprises in managing the security of end-of-life (EOL) open-source software. As the reliance on open-source projects increases, the initiative aims…
Dark Reading -
Chinese APT deploys TinyRCT backdoor targeting Southeast Asia
The article discusses a new cybersecurity threat emerging from a Chinese-speaking APT (Advanced Persistent Threat) that has deployed a backdoor named TinyRCT in a campaign targeting Southeast Asia. Key points include the identification of the backdoor's…
The Hacker News -
AI reshapes junior cyber roles, shifting focus to strategy
The article discusses the impact of AI on entry-level cybersecurity jobs, asserting that rather than displacing these positions, AI is reshaping them by automating repetitive tasks, which allows early-career professionals to focus on more strategic and…
Dark Reading -
Immobiliare Labs npm packages hijacked to steal cloud credentials
Multiple npm packages maintained by Immobiliare Labs were compromised on June 26, 2026, running a malicious payload during installation via a 'binding.gyp' hook. Affected packages include various Backstage plugins, which harvest credentials from GitHub…
StepSecurity -
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories
Researchers at Wiz identified a high-severity vulnerability in the Amazon Q Developer extension for Visual Studio Code that could enable attackers to steal cloud credentials by exploiting malicious code repositories. This vulnerability allows unauthorized…
-
Klue supply chain hack leaks Salesforce data at two dozen firms
A supply chain attack targeting the market intelligence platform Klue compromised the Salesforce instances of approximately two dozen customers between June 11 and 12. Hackers utilized old credentials to gain access, exfiltrating data including business…
SecurityWeekIcarus -
Weekly Security Roundup: Cellebrite, Tata Hack, AI Warnings
SecurityWeek's latest cybersecurity news roundup covers several significant events: 1) Russia used Cellebrite software to hack an activist's phone, highlighting ongoing surveillance issues. 2) Two members of the Scattered Spider hacker group pleaded guilty to…
SecurityWeekScattered Spider -
Iranian dual citizen arrested in Montenegro for $3.4bn US hack
An Iranian national, Amir Barati, who also holds Turkish citizenship, was arrested in Montenegro for hacking attacks on U.S. infrastructure, causing damages estimated at $3.4 billion. He is wanted in New York for conspiracy, computer fraud, and identity…
DataBreaches -
Amazon Q Developer flaw lets malicious repos run code
The article highlights a security vulnerability in Amazon's Q Developer platform, allowing malicious repositories to execute code through misconfigured MCP settings. This flaw raises concerns about potential exploitation by cybercriminals, prompting…
The Hacker News -
Cambridge Hospital staff accessed boy's crocodile attack records
The medical records of a young boy who was attacked by a crocodile at a Cambridgeshire zoo were accessed by around 40 staff members at Addenbrookes’ Hospital. Cambridge University Hospitals (CUH) is investigating the reasons for these accesses and has…
DataBreaches -
Meeting Trump's 2030 Quantum Deadline Will be Expensive, Complex
The article discusses the challenges and upcoming mandates for organizations as they prepare for quantum readiness by 2030, following recent executive orders from President Trump. Key points include the requirement for federal agencies to implement…
Dark Reading -
ICO uncovers data protection flaws in UK edtech firms
The UK Information Commissioner's Office (ICO) released a report titled 'EdTech examined — Key Findings from Our Audits,' focusing on data protection practices among 28 edtech providers used in UK primary and secondary schools. The audits revealed positive…
DataBreaches -
Linux 'pedit COW' flaw gives attackers root via binary poisoning
The article discusses a new exploit discovered in Linux systems, referred to as the 'pedit COW exploit', which allows attackers to gain root access by poisoning cached binaries. This highlights a serious vulnerability that security researchers and users need…
The Hacker News -
Dark Reading seeks original input, urges AI free submissions
The article from Dark Reading acknowledges the overwhelming number of submissions received from the cybersecurity community and explains the delays in response times. Senior Editor Becky Bracken expresses gratitude for the contributions and requests that…
Dark Reading -
Malicious PDF Email Spreads Chrome Extension to Hijack Sessions
Researchers have discovered malware that hijacks Chrome session cookies through an email attachment disguised as a PDF. This malware uses a malicious Chrome extension for data collection and to execute PowerShell commands on the host system, leveraging…
Malwarebytes -
Nebulock raises $25M Series A to expand AI driven threat hunting
Nebulock, a cybersecurity startup focused on autonomous threat hunting, has raised $25 million in a Series A funding round, totaling over $33 million in funding. The investment, led by FirstMark, aims to enhance the company’s AI-powered solutions for…
SecurityWeek -
CISA warns of active PTC Windchill RCE exploited via web shells
CISA has added an exploited Remote Code Execution (RCE) vulnerability in PTC Windchill to its Known Exploited Vulnerabilities (KEV) catalog. This flaw is being actively targeted in web shell attacks, prompting organizations to apply necessary patches and…
The Hacker News -
PTC Windchill and FlexPLM2 articles this day · Security Affairs first
Cisco SD-WAN Zero-Day Exploited in Attacks · CISA adds critical PTC Windchill, Cisco UC flaws to KEV list
-
Cisco SD-WAN Zero-Day Exploited in Attacks
An alert has been issued regarding two critical vulnerabilities: CVE-2026-12569 affecting PTC Windchill and FlexPLM, and CVE-2026-20230 related to Cisco Unified Communications Manager. A detailed report by Mandiant reveals that attackers exploited a zero-day…
-
CISA adds critical PTC Windchill, Cisco UC flaws to KEV list
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill and FlexPLM with…
-
-
DirtyClone Flaw Lets Linux Users Escalate to Root Access
The article discusses a newly discovered vulnerability in the Linux kernel, referred to as DirtyClone, which allows local users to gain root access through the exploitation of cloned packets. This flaw presents significant security risks, enabling…
The Hacker News -
Guardian Agents Boost Identity Security Amid Evolving AI Threats
The article discusses the emergence of Guardian Agents as a crucial layer in identity governance, enhancing cybersecurity measures against sophisticated attacks. It emphasizes the importance of managing AI's role in identity security and governance,…
The Hacker News -
Linux Foundation launches Akrites to boost OSS security response
The Linux Foundation has launched a new initiative called Akrites, aimed at improving the security of open source software (OSS) by establishing a shared Security Incident Response Team (SIRT). This effort focuses on the efficient discovery, patching, and…
SecurityWeek -
Cellebrite tools used by Russian to crack activist's iPhone
Russian security services accessed activist Andrey Pivovarov's iPhone using Cellebrite's tools, despite the company's announcement to cease sales to Russia. Pivovarov was detained in May 2021, and his devices were searched weeks later with the forensic tools,…
Security Affairs -
Miasma malware targets npm, GitHub Actions in supply chain hack
The article discusses a supply chain attack carried out by the Miasma malware, which specifically targets npm packages and GitHub Actions, posing significant risks to developers and organizations. The malware exploits vulnerabilities within software…
The Hacker News -
Microsoft to keep Windows 10 free updates until 2027
Microsoft has extended its Windows 10 Extended Security Updates (ESU) program to October 2027, allowing general consumers to continue receiving security patches beyond the original end date of October 2025. This decision comes amidst concerns that many users…
SecurityOnline -
Polymarket to refund users after $3m hack via vendor breach
Polymarket, a decentralized prediction market platform, has announced it will fully refund users affected by a recent hacking incident. The platform admitted that a third-party vendor had been compromised, leading to the injection of malicious scripts that…
SecurityWeek -
Microsoft warns hotels of new Node.js phishing ZIP attack
Microsoft has issued a warning about a new phishing attack targeting hotels, which employs a malicious Node.js implant embedded in ZIP files posing as photo files. This campaign aims to trick victims into downloading and executing the harmful software.…
The Hacker News -
WhatsApp malware spreads VBScript with hidden RMM payloads
A new WhatsApp malware campaign has been identified, involving a threat actor that hijacks accounts to send malicious VBScript files to users, primarily in Malaysia. The scripts are disguised as financial documents and use localization to trick victims. Once…
SecurityOnline -
Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets
Russia-linked APT Turla, also known as Krypton or Snake, is targeting Ukrainian government and military organizations with a new backdoor named StockStay. This .NET-based backdoor, under development since 2022, has been used for espionage activities,…
SecurityWeekTurla -
Russia pulls activist iPhone data via Cellebrite after sales stop
The article discusses Russia's use of Cellebrite technology on the iPhone of a jailed activist, occurring months after the company ceased sales to Russian agencies. It highlights the implications for digital privacy and security, raising concerns over the…
The Hacker News -
Polymarket confirms $2.94M theft after third party breach
A recent security breach at Polymarket, caused by compromised third-party vendor software, resulted in a theft of approximately $2.94 million in cryptocurrency from affected user wallets. Hackers injected malicious code into the platform, draining funds from…
Security Affairs -
Over 55 fake Samsung and Adidas shops scam European consumers
Recent cybersecurity threats revealed over 55 fake shop campaigns targeting consumers in 12 European countries, with the perpetrators impersonating well-known brands like Samsung and Adidas. These campaigns, which operated between March and May 2026,…
SecurityOnline
