News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Tue 30 Jun· 80 articles
-
Police Arrest Suspect in Takedown of XSS.is Cybercrime Forum
The article discusses the takedown of XSS.is, a prominent Russian-language cybercrime forum that facilitated ransomware activities. On July 22, 2025, French and Ukrainian police arrested an alleged administrator linked to the forum, which had over 50,000…
Security Affairs -
Agentjacking flaw lets hackers hijack AI coding tools via Sentry
The article discusses a new cybersecurity threat called "agentjacking," where attackers exploit the inability of AI coding agents to distinguish between content and instructions. Researchers from Tenet Security demonstrated that by submitting a fake-error…
Dark Reading -
Bill threatens journalists with jail over state threat contacts
The UK is advancing the National Security (State Threats) Bill, which could criminalize British journalists and NGO workers interacting with groups deemed state-backed threats. Experts warn the bill's vague language could lead to serious consequences,…
DataBreaches -
Attackers hijack exposed Ollama and LiteLLM AI endpoints for ops
The article discusses a recent trend where attackers are hijacking exposed AI endpoints without needing special authentication, simply by knowing their location. Between March and May, multiple campaigns were recorded exploiting infrastructure related to…
Dark Reading -
Fake Amazon Job Offers Lure Victims with High Pay Scam Texts
The article warns readers about a prevalent scam involving fraudulent job offers from supposed Amazon recruiters. These texts promise high pay for minimal work, typically claiming $250-$500 per day for just 60-90 minutes of effort. A common tactic is to use…
Malwarebytes -
BioShocking fools AI browsers, bypassing safety to leak data
This article discusses the vulnerabilities of AI browsers that can be exploited through a technique called "BioShocking." Researchers have demonstrated that these browsers can be tricked into disregarding safety guardrails by presenting them with false…
Ars Technica -
SimpleHelp2 articles this day · Infosecurity first
U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog · Critical SimpleHelp Vulnerability Exploited For Malware Delivery
-
U.S. CISA adds SimpleHelp flaw to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical authentication bypass vulnerability, tracked as CVE-2026-48558, to its Known Exploited Vulnerabilities catalog. This flaw affects SimpleHelp versions 5.5.15 and earlier, as…
-
Critical SimpleHelp Vulnerability Exploited For Malware Delivery
A critical vulnerability in SimpleHelp's remote monitoring and management (RMM) software has been exploited by attackers to deliver two new malware families. The flaw, designated CVE-2026-48558, allowed unauthenticated users to forge login tokens and gain…
-
-
Silverfort CISO: AI won't replace humans, cyber demand grows
The article discusses the perspective of John Paul Cunningham, CISO at Silverfort, on the evolving landscape of cybersecurity and career opportunities in the field. He emphasizes that while AI automates certain tasks, human oversight remains crucial,…
Dark Reading -
Microsoft urges organisations to adopt quantum safe crypto by 2029
Microsoft is accelerating its quantum-safe security efforts due to advances in quantum technology, which suggest that quantum computers capable of breaking current cryptographic systems could arrive sooner than previously thought. Recognizing this urgency,…
Microsoft -
Hospitality firms hit by photo zip phishing using blockchain RAT
The article discusses recent phishing campaigns targeting hospitality organizations in Europe and Asia, as observed by researchers from Microsoft and Trend Micro. Attackers use malicious zip files disguised as guest photos to install malware and gain…
Dark Reading -
Microsoft Warns Poisoned MCP Tool Descriptions Can Make AI Agents Leak Data
Microsoft has issued a warning regarding potential security risks associated with polluted descriptions in its Managed Cloud Platform (MCP) tools. These contaminated descriptions have the potential to cause artificial intelligence agents to unintentionally…
The Hacker News -
Rust based Botnet Takes Over Routers, Fuelling Fresh DDoS Threat
The article discusses the RustDuck Botnet, which has been rebuilt using the Rust programming language. This new iteration targets routers and servers for launching Distributed Denial of Service (DDoS) attacks. The focus on Rust enhances the botnet's…
The Hacker News -
Adobe patches ColdFusion flaws to block arbitrary code execution
Adobe has addressed 11 vulnerabilities in ColdFusion, including six critical flaws with a CVSS score of 10.0, allowing for arbitrary code execution. The most urgent updates were released on June 30, 2026, following no known exploits in the wild. Key issues…
SecurityOnline -
NetScaler ADC bugs let attackers read files and crash services
A critical alert regarding six vulnerabilities found in NetScaler ADC and Gateway has been issued. The highest CVSS rating of 8.8 is related to insufficient input validation leading to memory overread. No confirmed exploitation is reported; however, patches…
SecurityOnline -
Kaspersky Warns of ToddyCat Gmail Hack via Shadow Token Technique
Kaspersky Lab has identified a new method used by the ToddyCat group to compromise corporate Gmail accounts. The attack utilizes a toolkit called Umbrij, which exploits APIs to access user data (emails, calendars, etc.) without the need for login…
DataBreachesToddyCat -
Microsoft June 2026 update adds MDASH scanning and AI defence
The June 2026 update from Microsoft Security introduces several advancements aimed at enhancing security across various environments. Key highlights include: 1) **Codename MDASH** - a new multi-model scanning system that identifies and helps remediate…
Microsoft -
Nissan employee data exposed via Oracle PeopleSoft zero day flaw
Nissan has reported a data breach affecting current and former employees, linked to a zero-day vulnerability in Oracle's PeopleSoft software. Sensitive information, including Social Security numbers and banking details, may have been exposed. The breach was…
InfosecurityShinyHunters -
Microsoft Warns of Tool Poisoning Attack on AI Finance Agents
The Microsoft blog post discusses the evolution of AI agents in enterprise environments, transitioning from content readers to action takers. It highlights an emerging attack pattern targeting Model Context Protocol (MCP) tools, particularly tool poisoning…
Microsoft -
Aflac Japan breach leaks 4.38m records, US ops safe
Hackers gained unauthorized access to Aflac Japan's systems from June 15 to June 25, 2026, leading to the theft of personal information from 4.38 million customers and agents. The disclosed data includes names, addresses, phone numbers, dates of birth,…
Security Affairs -
Critical Langflow RCE flaw lets attackers mine Monero on AI apps
The article discusses a recent exploitation of a critical vulnerability in Langflow that was used to deploy a Monero miner on unsecured AI application endpoints. This incident highlights the rising trend of cyber threats targeting AI systems, emphasizing the…
The Hacker News -
Fake Google Notes addon silently swaps crypto wallet addresses
The article discusses a new method employed by cybercriminals, specifically a silent swap crypto clipper that uses a fake Google Notes extension to replace cryptocurrency wallet addresses. This technique poses significant security risks to users by…
The Hacker News -
NDSS Symposium Heads to Seoul in 2027 to Expand Global Cybersecurity Collaboration
The 2027 Network and Distributed System Security (NDSS) Symposium will be held from March 22-26, 2027, in Seoul, South Korea, as announced by the Internet Society. As a prestigious cybersecurity research conference, it seeks to enhance global collaboration…
SecurityOnline -
Reflectiz and Taboola Talk AI Marketing Script Security
Reflectiz, a web exposure management platform, will host a live webinar with Taboola on July 8, 2026, focused on securing third-party marketing in the context of AI. The discussion highlights the risks posed by third-party scripts that are often unvetted,…
SecurityOnline -
North Korean operatives flood US firms with fake job applications
Nisos conducted an investigation into DPRK employment fraud, revealing how North Korean operatives infiltrate US companies. Their findings, presented in a recent newsletter and a podcast, detail the operational methods of a DPRK cell that submitted over…
DataBreaches -
Apple fixes two dozen WebKit bugs in iOS, macOS and Safari
Apple has released security updates for iOS, iPadOS, macOS Tahoe, and Safari to address over two dozen vulnerabilities, particularly in the WebKit engine, which affects all browsers on iPhones and iPads. The updates enhance security by fixing vulnerabilities…
Malwarebytes -
GuardFall exposes old shell flaws in open source AI coding agents
The article discusses the cybersecurity risks associated with open-source AI coding agents, particularly highlighting how GuardFall has exposed these agents to shell injection vulnerabilities that have existed for decades. It emphasizes the need for enhanced…
The Hacker News -
OpenMatter launches cryptographic trust layer for secure AI governance
OpenMatter Network has launched a cryptographically verifiable platform aimed at secure collaboration and AI governance, moving away from traditional trust-based systems. As organizations face challenges with distributed data and autonomous AI, the platform…
SecurityOnline -
AppViewX Launches Global Partner Program Amid Rising Demand for Machine and Agent Identity Security
AppViewX has launched its first global Partner Program to enhance partner success amid increasing demand for machine and agent identity security. This program aims to provide resources, infrastructure, and frameworks that support effective engagement with…
SecurityOnline -
BlueHammer Defender Flaw Linked to Ransomware Exploits
A Microsoft Defender vulnerability, known as BlueHammer (CVE-2026-33825), is currently being exploited in ransomware attacks, as reported by CISA. This vulnerability was publicly disclosed on April 2, with Microsoft issuing patches on April 14. Despite…
-
Ukrainian and French police seize Russian XSS cybercrime forum
Ransomnews provides an in-depth analysis of the XSS Forum, a significant Russian-language cybercrime hub, detailing its history and eventual seizure in 2025 due to law enforcement actions in Ukraine and France. XSS Forum, with over 50,000 members, served as…
DataBreaches -
282 iOS apps expose API keys and OpenAI proxy via network traffic
A recent study identified that 282 iOS applications are leaking vital information such as API keys and OpenAI proxy access through network traffic. This poses a significant risk to user security and privacy. The article emphasizes the importance of securing…
The Hacker News -
AI Generated Teams Workflow Leaks HR Data After Misconfiguration
The article discusses the hidden security risks associated with AI-generated workflows in organizations. It highlights a case where sensitive HR documents were mistakenly shared due to a misconfigured Microsoft Teams Power Automate workflow created by a…
Dark Reading -
GuardFall flaw exposes AI coding agents to Bash command hacks
A recent study by Adversa AI highlights a critical security vulnerability, named 'GuardFall', affecting popular open-source AI coding agents due to weaknesses in handling Bash shell commands. Out of eleven agents tested, only one effectively blocked…
SecurityWeek -
Aflac Japan breach exposes personal data of 4.38M customers
Aflac Life Insurance Japan announced a data breach on June 15, affecting 4.38 million customers. Hackers accessed the company’s systems multiple times until the breach was detected on June 25. No US business systems were compromised. The breach involved…
SecurityWeek -
Aflac Japan breach exposes customers' personal, bank data
Aflac, an American insurance provider, has reported a data breach involving its Japan subsidiary, where attackers accessed personal and bank account information. This incident, revealed in a filing with the U.S. SEC, indicates that the breach occurred…
DataBreaches -
NLnet Labs fixes critical NSD DNS server flaws in new release
NLnet Labs has released version 4.14.3 of the Name Server Daemon (NSD) to address four critical security vulnerabilities. These vulnerabilities, identified as CVE-2026-12244, CVE-2026-12245, CVE-2026-12246, and CVE-2026-12490, have high severity scores (up…
-
From Teen Hacker to Red Team CEO: Chris Thompson on AI Threats
Chris Thompson's journey from a teenage game hacker to an elite professional in cybersecurity highlights the evolution of his career and the impact of offensive AI in the field. He founded IBM's first dedicated red team and is now CEO at RemoteThreat, aiming…
SecurityWeek -
How ClickFix tricks users into pasting malware commands on macOS
The article discusses the rise of the 'ClickFix' technique as a key method for cybercriminals to deliver malware. Analysis by ReliaQuest reveals that ClickFix's popularity stems from its effectiveness in tricking users into executing malicious commands in…
Infosecurity -
Supreme Court Rules Constitutional Privacy Protections Apply to Cellphone Users’ Location History
The Supreme Court ruled that constitutional privacy protections extend to cellphone location data, affirming that users do not lose their privacy rights even when using Google’s location services. The case involved Okello Chatrie, a bank robber whose…
SecurityWeek
