News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 10 so far |
Tue 7 Jul· 64 articles
-
Washington DSHS breach exposes 8,600 records after insider misuse
The Washington Department of Social and Health Services (DSHS) has reported a significant data breach from March affecting approximately 8,600 individuals. An internal investigation uncovered that a former employee accessed sensitive data without…
DataBreaches -
Mexican banking fraud gang uses SCMBANKER toolkit to steal data
The document discusses an active banking fraud operation in Mexico named REF6045, which employs a PowerShell toolkit called SCMBANKER to facilitate fraud against customers of banks and fintech services. SCMBANKER allows operators to monitor banking sessions,…
elastic.co -
GitHub launches public secret scanning for enterprise
The article discusses GitHub's new public monitoring feature, aimed at scanning for leaked secrets across all public content on github.com for enterprise users. Key points include its functionality, what it cannot detect, and strategies for preventing data…
StepSecurity -
Malvertising Campaign Spreads Vidar Stealer and XMRig Miner
Unit 42 researchers from Palo Alto Networks have uncovered a financially motivated malware campaign primarily utilizing the Vidar Stealer and XMRig cryptocurrency miner. Attackers leverage malvertising techniques to lure victims into downloading fake…
unit42.paloaltonetworks.com -
Gitea Open Source Git Server2 articles this day · SecurityWeek first
CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth · Critical Gitea Flaw Under Active Exploitation, Researchers Warn
-
CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth
A critical vulnerability (CVE-2026-20896) has been identified in Gitea's Docker images, allowing attackers to bypass authentication with a single HTTP header, potentially exposing sensitive repositories and data. The flaw affects versions prior to 1.26.3 and…
-
Critical Gitea Flaw Under Active Exploitation, Researchers Warn
Threat actors are exploiting a vulnerability in Gitea's reverse-proxy authentication, identified as CVE-2026-20896, with a critical CVSS score of 9.8. This issue affects Gitea Docker images prior to version 1.26.3 and allows unauthorized access using only a…
-
-
Fake Coca Cola Job Scam Steals Google Logins From Marketers
A phishing campaign targeting marketing professionals has been uncovered, utilizing fake job recruitment emails from big brands like Coca-Cola, Netflix, and FIFA to steal Google credentials. This sophisticated scam employs nested redirects to hide phishing…
Dark Reading -
Google patches Dialogflow CX flaw that let attackers hijack AI agents
In July 2026, Varonis disclosed a critical vulnerability named "Rogue Agent" in Google's Dialogflow CX AI platform. This flaw allowed attackers to potentially seize data from AI agents by exploiting the Code Blocks feature, which could facilitate persistent…
Dark Reading -
Adobe ColdFusion2 articles this day · SecurityWeek first
CISA KEV Catalog Flags Adobe ColdFusion CVE-2026-48282 Exploit · Adobe ColdFusion flaw CVE-2026-48282 exploited hours after patch
-
CISA KEV Catalog Flags Adobe ColdFusion CVE-2026-48282 Exploit
CISA has added CVE‑2026-48282 to its Known Exploited Vulnerabilities catalogue. The entry concerns Adobe ColdFusion and involves the Adobe ColdFusion Path Traversal Vulnerability, which could allow arbitrary code execution in the context of the current user.…
-
Adobe ColdFusion flaw CVE-2026-48282 exploited hours after patch
A recently patched vulnerability in Adobe ColdFusion, labeled CVE-2026-48282 with a CVSS score of 10/10, is being actively exploited by threat actors. The vulnerability, which allows for path traversal and arbitrary code execution, was addressed in updates…
-
-
Spain arrests suspect tied to pro Russian hacktivist group
Spanish authorities arrested a suspected collaborator of the pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest. The suspect, detained in Palencia, faces charges including collaboration with terrorist organizations and computer…
Security AffairsCyber Army of Russia Reborn -
CISA Flags Joomlack Page Builder RCE Flaw (CVE-2026-56290) in KEV
CISA has added CVE-2026-56290 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Joomlack’s Page Builder product and is tracked as the Joomlack Page Builder Improper Access Control Vulnerability, which permits unauthenticated arbitrary…
-
-
CISA adds critical Langflow auth bypass flaw to KEV list
CISA has added CVE‑2026-55255 to its Known Exploited Vulnerabilities catalogue, affecting the Langflow product from vendor Langflow. The vulnerability is an authorization bypass through a user‑controlled key that lets an authenticated attacker run any flow…
-
CISA flags JoomShaper SP Page Builder upload flaw CVE-2026-48908
CISA has added CVE‑2026‑48908 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects JoomShaper’s SP Page Builder extension for Joomla and is named “JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability”.…
-
Reddit users targeted by fake report scams on Discord
The article discusses a scam on Reddit and Discord where scammers use social engineering tactics to steal accounts. The scam starts with a direct message claiming someone reported the victim's account or that the victim accidentally reported someone else.…
Malwarebytes -
US agency pays $1m ransom to Kairos after 2TB data breach
A U.S. government entity reportedly paid $1 million in ransom to the Kairos cyber extortion group following a data breach that occurred in May 2025. Initially, the attackers demanded $3 million, but through negotiations, they settled for $1 million after the…
SecurityWeekKairos -
Android banking malware as a service on Telegram fuels fraud
The article discusses the emergence of malware packages like RedWing MaaS designed for Android bank fraud, which are rented out via platforms like Telegram. The piece highlights how sophisticated malware has become, allowing cybercriminals to easily access…
The Hacker News -
Google Dialogflow CX flaw could let attackers hijack chatbots
The article discusses a vulnerability in Google Dialogflow CX that could have allowed attackers to hijack chatbots. This rogue agent flaw poses significant security risks as it can compromise the interactions managed by AI-driven chat systems. The potential…
The Hacker News -
China linked hackers hit US Canada universities via Roundcube
A China-aligned threat group, identified as UNK_MassTraction, has been exploiting vulnerable Roundcube mail servers at universities in the US and Canada. The attackers are targeting physics and engineering departments potentially linked to national security.…
-
GitHub’s ‘GitLost’ bug exposes private repo data via Issues
The article discusses a critical flaw named 'GitLost' in GitHub's Agentic Workflows that allows unauthenticated attackers to extract data from private repositories by crafting GitHub Issues in public ones. Researchers from Noma Security discovered that the…
Dark Reading -
Attackers can hijack servers via unauthenticated BMC Control M flaw
The content discusses a critical vulnerability in BMC Control-M/Server, identified as CVE-2026-10539. Scoring 9.5 on the CVSSv4 scale, this flaw allows unauthenticated remote command injection, posing a significant risk as it can lead to server takeover and…
-
DEBULL tool abuses Microsoft device code flow against M365 accounts
The article titled 'DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts' highlights a new threat targeting Microsoft 365 accounts through an exploitation of Microsoft's device-code flow. The piece emphasizes the importance of identity…
The Hacker News -
Public GitHub Issues Flaw Could Leak Private Repo Data
The article discusses a vulnerability related to public GitHub issues that could enable attackers to trick GitHub workflows, potentially leaking private repository data. It highlights the importance of managing security in open-source environments and…
The Hacker News -
Critical SharePoint Flaw Lets Low Privilege Users Run Remote Code
CVE-2026-33112 is a high-risk vulnerability (CVSS 8.8) in Microsoft SharePoint Enterprise Server 2016, allowing low-privilege users to execute remote code. No confirmed exploitation has been observed. Microsoft issued patches in May 2026, and users are…
-
Scattered Spider2 articles this day · The Hacker News first
Scattered Spider’s Structure More Like a Cybercrime Collective Than a Unified Gang · FBI tracks alleged Scattered Spider via Windows Device ID
2 outlets-
Scattered Spider’s Structure More Like a Cybercrime Collective Than a Unified Gang
The article discusses the reclassification of Scattered Spider, now seen as a decentralized cybercrime collective instead of a unified gang. Group-IB's analysis reveals that this group comprises separate independent clusters that share tactics and tools but…
Infosecurity -
FBI tracks alleged Scattered Spider via Windows Device ID
A court filing has disclosed that the FBI utilized a Windows device ID to trace and identify an alleged hacker linked to the Scattered Spider cybercrime group. This highlights the importance of device identification in cybersecurity investigations and law…
The Hacker News
-
-
Attackers Exploit Ghost Certificates in ADFS to Steal SAML Keys
The article discusses the 'Ghost' in the Database, particularly focusing on the vulnerabilities associated with Active Directory Federation Services (ADFS) signing keys through Machine DPAPI. It highlights how threat actors can exploit old certificates,…
Google Cloud -
Marketers hit by phishing scam posing as Netflix, Coke job offers
A recent phishing campaign targets marketing professionals by impersonating major companies like Netflix, Coca-Cola, and FIFA. Scammers utilize fake job interview requests and display fraudulent Google sign-in pop-ups within the phishing sites. These attacks…
Malwarebytes -
Ubiquiti fixes critical UniFi Connect app RCE flaw
Ubiquiti has issued UniFi Security Advisory Bulletin 066, addressing 25 vulnerabilities across its range of products, including critical flaws in the UniFi Connect app that could allow attackers to execute commands without login. The advisory emphasizes the…
-
Writer AI flaw leaks session tokens across tenants
The article discusses a vulnerability in an AI writing tool that may allow session tokens to leak between different tenants, potentially compromising security. This risk highlights the need for robust cyber defenses, especially as AI technologies evolve. The…
The Hacker News -
CISA Uses Anthropic’s Mythos AI to Hunt Federal Software Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) is employing Anthropic's Mythos AI model to audit federal software for security vulnerabilities, aiming to identify and fix potential exploits. The initiative, led by CISA's Attack Surface…
SecurityWeek -
Cloudflare proudly joins the UK government's Cyber Resilience Pledge
Cloudflare has joined the UK government's Cyber Resilience Pledge, a voluntary initiative aimed at improving cybersecurity governance and accountability among organizations. This pledge focuses on democratizing security, leadership accountability, and…
Cloudflare -
Judge revives Bojangles breach lawsuit tied to Russian hackers
Chase Jordan reports on a class-action lawsuit regarding a 2024 data breach affecting Bojangles employees, linked to Russian hackers. A North Carolina Business Court judge has allowed the case to proceed after it was previously dismissed in federal court.…
DataBreaches -
Jacksonville, Texas Takes Systems Offline After Cyber Incident
Jacksonville, Texas, took several city systems offline on July 3 after detecting suspicious network activity, indicating a cybersecurity incident. As a result, some online services remained unavailable as officials began investigating the issue.…
DataBreaches -
Cavern Manticore Uses SysAid Exploit to Target Israeli Firms
An Iran-linked APT actor, tracked as Cavern Manticore, has been utilizing a modular command-and-control (C&C) framework in recent cyberattacks on Israeli organizations. This group appears to have connections to Iran's Ministry of Intelligence and Security…
SecurityWeekCavern Manticore -
Tarah Wheeler’s Journey from Social Science to CISO Role
Tarah Wheeler, CISO at TPO Group and a seasoned cybersecurity professional, discusses her unconventional path into the industry, emphasizing her background in social science and writing. She transitioned through various roles, acquiring experience in red…
SecurityWeek -
AI boosts dev speed but opens supply chain to new threats
The article discusses the implications of incorporating AI in the software supply chain. Key points include the potential for increased efficiency and speed in code development, alongside significant security risks. It emphasizes the need for robust…
The Hacker News -
Anthropic’s Claude Code secretly logged users time zone data
Anthropic's Claude Code was found to have a hidden tracking marker embedded within its code, which was described as an "experiment" aimed at preventing account abuse from unauthorized resellers and understanding Chinese distillation attacks. The marker…
Malwarebytes -
Q1 2026 ICS malware infections fall to 19.6%, three year low
The Q1 2026 Industrial Threat Report reveals a decrease in the percentage of Industrial Control System (ICS) computers affected by malicious objects, dropping to 19.6%, the lowest in three years. Regional variations show 9.1% in Northern Europe to 27.4% in…
securelist.com
