News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Fri 3 Jul· 44 articles
-
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
The article discusses unpatched vulnerabilities discovered in a widely used filesystem found in millions of embedded devices, highlighting critical risks to IoT security. The vulnerabilities were disclosed by researchers and can potentially allow…
The Hacker News -
Pegasus hits MEP Kouloglou via HomeKit zero click exploit
The Citizen Lab reported that Stelios Kouloglou, a former Member of the European Parliament (MEP) involved in an investigation into the Pegasus spyware, was targeted by the spyware itself. His devices were infected multiple times while the PEGA Committee was…
Security Affairs -
AI 'Jadepuffer' launches first autonomous ransomware
Security researchers have found the first instance of an artificial intelligence (AI) executing a cyber attack autonomously. This AI-driven attack involved a ransomware scheme where the AI, named Jadepuffer, infiltrated a vulnerable server, extracted…
DataBreaches -
Bad Epoll Flaw Lets Users Gain Root Access on Linux and Android
A new vulnerability in the Linux kernel, dubbed 'Bad Epoll', allows unprivileged users to escalate privileges to root on both Linux and Android systems. This flaw presents a significant security risk and has drawn attention for its potential exploitation.…
The Hacker News -
Avalon malware framework blends CrownX ransomware, raising alarm
The article discusses the emergence of a new malware framework called New Avalon, which integrates CrownX ransomware capabilities. As ransomware threats evolve, the framework represents a significant shift in the landscape of cybersecurity. The integration…
The Hacker News -
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
The article discusses the emergence of npm packages linked to North Korea that disguise themselves as Rollup polyfills to siphon off sensitive developer information. This highlights a significant threat within the software supply chain, emphasizing the…
The Hacker News -
KDDI Data Breach Exposes Personal Data of 14 Million Users
The weekly roundup from SecurityWeek highlights essential cybersecurity news and developments: 1. Aubrey Cottle, linked to Anonymous, was sentenced to 18 months for a cyberattack on the Texas GOP. 2. KDDI's data breach affected 14 million users. 3. Push…
SecurityWeek -
GitHub burns code to CD ROM as Sony ends PlayStation discs
Sony will stop producing physical game discs for new releases starting January 2028, marking a shift to a fully digital PlayStation ecosystem. In response, GitHub launched a limited-time initiative to burn public code repositories onto CD-ROMs, allowing…
SecurityOnline -
Armored Likho2 articles this day · securelist.com first
BusySnake Stealer Aims at UK Govt, Power Sector, Experts Warn · Armored Likho deploys BusySnake Stealer via phishing emails
2 outlets-
BusySnake Stealer Aims at UK Govt, Power Sector, Experts Warn
The article discusses the emergence of the cybersecurity threat known as BusySnake Stealer, which specifically targets government agencies and the power sector, orchestrated by a group called Armored Likho. The threat involves sophisticated information theft…
The Hacker News -
Armored Likho deploys BusySnake Stealer via phishing emails
This article discusses the discovery of a new phishing campaign linked to the Armored Likho APT group, which focuses on government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. The campaign utilizes a modular RAT and infostealer,…
securelist.com
-
-
Fake X ad spreads malware to Macs, ConsentFix hijacks M365
The article discusses two new cybercriminal strategies targeting users: a ClickFix attack spreading malware through a sponsored advertisement on X, specifically targeting Mac users, and a ConsentFix technique that steals Microsoft 365 accounts without…
Malwarebytes -
Chinese AI models sharpen vulnerability search, experts warn
Chinese firms have recently unveiled two advanced AI models aimed at enhancing vulnerability discovery, raising alarms among cybersecurity professionals. Notably, Zhipu AI's GLM 5.2 model has shown superior performance in vulnerability detection benchmarks…
Dark Reading -
Qilin Tops Ransomware Market Rising Competition, Analysts Say
The article discusses the rise of Qilin as a leading player in the ransomware-as-a-service (RaaS) market, holding approximately 16% market share as of July 2026. Qilin's emergence follows the disruption of other major groups like LockBit and RansomHub,…
InfosecurityQilin -
Shun Hing Group reports March 2023 breach affecting over 920,000
Shun Hing Group confirmed a significant data breach due to a cyber attack in March 2023, affecting over 921,000 individuals, including personal data of around 920,000 customers. The company detected the intrusion on March 20 and promptly reported it to…
DataBreaches -
Claude Fable 5 trial ends July 7, users face credit billing
The page discusses the situation surrounding the Claude Fable 5 subscription model by Anthropic, which has reset weekly quotas for premium subscribers following its restoration. A free trial period extends until July 7, after which users will need to…
SecurityOnline -
Chrome to auto pin new extensions, keeping visible in toolbar
Google Chrome is introducing an auto-pin feature for extensions, addressing the issue of users forgetting about newly installed extensions hidden in a collapsed menu. This new functionality allows extensions to automatically appear in the main toolbar upon…
SecurityOnline -
Warning Over “Industrialized” Cyber-Attacks After Ransomware Gang Partners With TeamPCP
The article discusses a new partnership between the Vect ransomware group and TeamPCP, a cybercriminal gang specializing in supply chain attacks. This alliance creates a 'new model' of industrialized ransomware, combining large-scale credential theft with…
InfosecurityTeamPCP -
Langflow2 articles this day · SecurityWeek first
JADEPUFFER AI ransomware exploits Langflow flaw CVE-2025-3248 · Agentic AI Used to Conduct Ransomware Attack via Langflow
-
JADEPUFFER AI ransomware exploits Langflow flaw CVE-2025-3248
Sysdig's Threat Research Team revealed the first documented end-to-end AI-driven ransomware operation, named JADEPUFFER. This operation leveraged a vulnerability in Langflow (CVE-2025-3248) to conduct a fully automated attack without human intervention,…
-
Agentic AI Used to Conduct Ransomware Attack via Langflow
A security report details a ransomware attack by threat actor JadePuffer, who exploited a critical vulnerability (CVE-2025-3248) in Langflow, a Python framework for building applications. After gaining access via the vulnerability, the attacker executed…
-
-
MEP investigating spyware falls victim to Pegasus mobile hack
The article discusses how a member of the European Parliament, involved in investigating spyware issues, became a victim of hacking through the Pegasus spyware. This incident highlights the ongoing challenges in mobile security and the vulnerabilities that…
The Hacker News -
Claude Fable 5 access cut, developers protest throttled limits
Claude Fable 5 is now accessible to developers under a subscription until July 7, but usage is limited to 50% of the allowance. Post this date, extra credits will be required for continued access. A model classifier assesses tasks' difficulty and may…
SecurityOnline -
Unvetted AI Tool Sparks Vercel Breach, Exposing Shadow AI Risks
The article discusses the 2026 Vercel breach, which was triggered by an unvetted AI tool that was adopted by an employee. This breach illustrates the emergence of 'Shadow AI', a subset of Shadow IT, posing new risks for enterprises. In this case, attackers…
Security Affairs -
Medtronic Warns 3.8M After ShinyHunters Steals Patient Data
Medtronic has notified over 3.8 million individuals about a data breach where personal and medical information was compromised. The breach, attributed to the extortion group ShinyHunters, occurred in April 2026, involving the theft of over 9 million records.…
SecurityWeekShinyHunters -
FBI and Google disrupt NetNut botnet using hijacked devices
The FBI and Google's Threat Intelligence Group successfully disrupted the NetNut proxy network, which co-opted over two million consumer devices to facilitate cybercriminal activities. The operation targeted the network's infrastructure, seizing numerous…
Infosecurity -
US extradites alleged Scattered Spider teen over jewelry heist
Peter Stokes, a dual US-Estonian citizen and alleged member of the hacking group Scattered Spider, was extradited to the US following his arrest in Finland. At 19 years old, he faces multiple charges including conspiracy and fraud related to a cyberattack on…
SecurityWeekScattered Spider -
Lazarus-Linked npm Malware Masquerades as Rollup Polyfills
JFrog's research has revealed a supply chain attack attributed to the Lazarus group from North Korea, involving malicious npm packages that mimic legitimate Rollup polyfill packages. These six fake packages, designed to steal credentials and crypto wallet…
SecurityOnlineLazarus Group -
Google, FBI and Lumen Take Down NetNut Proxy Network
Google, in collaboration with the FBI and Lumen, has disrupted NetNut, a large residential proxy network that illegally routed internet traffic through compromised home devices. This operation follows a previous action against the IPIDEA network and aims to…
Security Affairs -
Google, FBI dismantle NetNut proxy from hijacked Android phones
Google, in collaboration with the FBI, has dismantled the NetNut residential proxy network, which consists of over 2 million compromised Android devices. This operation targeted malware-infected devices that the network operator, linked to Israeli company…
SecurityWeek -
Fake Google Notes extension hijacks crypto via clipboard swap
The Silent Swap crypto clipper is a malicious browser extension recently identified that intercepts cryptocurrency transactions by tampering with the clipboard. It operates as a fake Google Notes extension, stealing digital assets by replacing copied wallet…
SecurityOnline -
Fake Maccy Sites Spread PamStealer Malware to Harvest macOS Logins
The article discusses the PamStealer malware, which targets macOS devices by utilizing counterfeit websites resembling legitimate Maccy sites to steal user credentials, particularly login passwords. The malware manipulates users into entering sensitive…
The Hacker News -
Government and Healthcare Email Security Lag Behind Tech Sector
A Comparitech analysis of email security across 5,849 domains highlights significant vulnerabilities in the government and healthcare sectors, which scored poorly on essential email authentication protocols (SPF, DMARC, DKIM, MTA-STS). Government domains…
Security Affairs -
Critical Cursor flaws allow remote code execution via path tricks
Two critical vulnerabilities in the AI code editor Cursor, identified as CVE-2026-50548 and CVE-2026-50549 with a CVSS score of 9.8, can lead to remote code execution (RCE) on the underlying operating system. The first issue involves the sandbox's security…
-
Kernel.org downtime follows mirror config error, blocks downloads
On July 2, 2026, kernel.org experienced a significant outage due to a configuration error during the addition of a new primary mirror by the Linux Foundation. This misconfiguration caused all hosted kernel files to become inaccessible, resulting in HTTP 404…
SecurityOnline -
EU Court upholds €4.1 billion antitrust fine against Google Android
On July 2026, the EU Court upheld a €4.1 billion fine against Google for antitrust violations related to its Android operating system. The ruling dismissed Google's final appeal, confirming that it abused its dominant market position by requiring default…
SecurityOnline -
Fake Rental Apps Deploy Android Spyware Glitch SPY Across Poland
A new Android Remote Access Trojan (RAT) named Glitch SPY has been detected, targeting individuals in Poland through fake rental property websites. It is delivered via a loader that disguises itself as a rental app, requesting permission to install from…
SecurityOnline -
ToddyCat APT hijacks corporate Gmail via Umbrij OAuth theft
Security analysts have identified the ToddyCat APT group utilizing the Umbrij tool to hijack corporate Gmail accounts, bypassing standard security measures through OAuth token theft. This malware operates in headless mode to conduct unauthorized access to…
SecurityOnlineToddyCat -
Active ColdFusion Arbitrary Code Execution Flaw Scores CVSS 10
A critical vulnerability, designated CVE-2026-48282, in Adobe ColdFusion allows for arbitrary code execution without user interaction. This flaw exploits a path traversal issue, enabling attackers to gain full control of affected servers remotely. The…
-
CVE-2026-57517 bug lets attackers hijack Control Web Panel
A critical vulnerability, CVE-2026-57517, has been disclosed in Control Web Panel, with a CVSS score of 9.8. It allows for blind SQL injection via the 'userRes' parameter in versions prior to 0.9.8.1225, potentially enabling remote code execution by…
-
UltraVNC Repeater CVE-2026-7840 lets attackers run code remotely
Two critical vulnerabilities have been disclosed in UltraVNC's repeater tool's HTTP admin server, impacting versions through 1.8.2.2. The first vulnerability, CVE-2026-7840, allows arbitrary code execution via a repeater HTTP server global buffer overflow…
-
WatchGuard patches critical Firebox RCE flaw CVE-2026-13368
WatchGuard has issued patches for seven critical vulnerabilities in its Firebox appliances, with the most severe being CVE-2026-13368, which allows unauthenticated remote code execution (RCE) with a CVSS score of 9.2. This flaw can expose the entire network…
