News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 13 Jul· 72 articles
-
Fake crypto gift card sites trick users with realistic fakes
The article discusses the rising sophistication of fake cryptocurrency gift card websites, which mimic legitimate platforms to deceive users. These scams often feature polished designs, trust badges, and appealing prices, making them hard to distinguish from…
Malwarebytes -
AI Generated PowerShell Script Used to Map Active Directory
The article discusses a recent incident where an attacker utilized a suspected AI-generated PowerShell script to map an Active Directory. This incident illustrates the growing threat of AI in cybersecurity, as malicious actors increasingly leverage AI…
The Hacker News -
Krybit Ransomware Sparks Double Extortion Threats in 43 Countries
Krybit Ransomware is a new player in the Ransomware-as-a-Service (RaaS) landscape, first detected in March 2026, employing a double-extortion strategy to target organizations for financial gain. Following its launch, Krybit was involved in a notable public…
SOCRadarKrybit -
UK, EU sanction Russian hackers using weak SNMP router passwords
Cybersecurity agencies from 12 countries have warned that a Russian state-sponsored cyber unit, known as FSB Center 16 or by various names like Berserk Bear, is targeting vulnerable routers globally. This advisory focuses on the use of weak SNMP passwords…
InfosecurityENERGETIC BEAR -
Critical CVE-2026-44963 Flaw Lets Attackers Run Arbitrary Code
The page discusses a critical vulnerability in Veeam Backup & Replication tracked as CVE-2026-44963, which has a CVSS score of 9.4. This flaw allows authenticated domain users to execute arbitrary code on the backup server. It affects versions prior to…
-
UK and Allies urge critical sectors to improve defences against Russian intelligence targeting
The UK and its international allies have issued an urgent advisory to critical infrastructure sectors, emphasizing the need to bolster defenses against Russian state intelligence targeting. The advisory highlights the exploitation of poorly configured…
ncsc.gov.ukCentre 16 -
Zimbra XSS flaw lets attackers take over accounts with zero click
A critical vulnerability has been discovered in Zimbra, a widely-used collaboration tool, that allows for zero-click code execution through specially crafted emails. Zimbra announced patches for this stored cross-site scripting (XSS) flaw affecting its…
SecurityWeek -
EU Targets Russian Intelligence Officers Accused of Running a Yearslong Cyber Spying Campaign
The European Union has imposed sanctions on Russian military intelligence officers, hackers, and companies over a long-running cyber espionage campaign aimed at destabilizing the EU. Targeting nine individuals and four entities, the EU accused them of…
SecurityWeek -
StatCounter corrects Windows market share after data error
StatCounter's June 2026 report inaccurately claimed a significant drop in Windows' market share from 79% to 56%. This prompted speculation about the rise of Linux among observers. However, subsequent investigations revealed that these statistics were…
SecurityOnline -
Armenian national pleads guilty in US Ryuk ransomware fraud case
An Armenian national, Karen Serobovich Vardanyan, extradited from Ukraine, pleaded guilty to conspiracy and computer fraud associated with the Ryuk ransomware gang in a U.S. federal court. He illegally accessed various organizations' computers between…
InfosecurityRyuk -
FSB Center 16 Targets Routers Across Critical Sectors
The FSB Center 16, linked to Russian state actors, is exploiting vulnerable routers worldwide by using weak SNMP configurations and default credentials. Over 20 cybersecurity agencies, including NSA, CISA, and FBI, issued a warning detailing the ongoing…
SecurityOnlineFSB Center 16 -
Dutch police seek local hackers in Odido breach affecting 6M
Dutch police suspect local hackers are involved in the Odido breach, where data from over six million customers was stolen. The breach occurred after a phishing attack by the cybercrime group ShinyHunters. The stolen data includes personal information such…
Security AffairsShinyHunters -
Unauthenticated RCE Flaws Hit Joomla Extensions Balbooa, iCagenda
Recent vulnerabilities affecting Joomla extensions Balbooa Forms and iCagenda have been exploited by threat actors, allowing unauthenticated remote code execution (RCE). The Balbooa flaw (CVE-2026-56291) enables file uploads without authentication, with a…
-
ACSC warns of CMS flaws driving webshell attacks on Aussie SMBs
Australia's cyber agency, ASD’s ACSC, has issued a warning about a large-scale campaign exploiting vulnerabilities in content management systems (CMS) like WordPress. Unattributed malicious actors are scanning websites for known plugin flaws, leading to the…
SecurityOnline -
Australian watchdog warns of CMS flaw wave hitting local SMEs
The Australian Cyber Security Centre (ACSC) has issued a warning regarding a global campaign targeting vulnerabilities in content management systems (CMS). The campaign, affecting many small and medium-sized businesses in Australia, involves malicious actors…
Infosecurity -
Progress Prompts ShareFile Storage Zone Controller Shutdown Amid Security Concerns
Progress Software has advised ShareFile customers to temporarily shut down their Storage Zone Controller servers due to a credible external security threat. This controller serves as a secure data storage solution for ShareFile users. Access to affected…
-
WorldLeaks hack exposes 540k patients' data at Centers Lab
The Centers Laboratory (Centers Lab NJ LLC), a healthcare diagnostics company, reported a data breach affecting over 540,000 individuals due to an intrusion discovered in August 2025. The breach, which involved limited access to the organization's IT…
SecurityWeekWorld Leaks -
Cavern Manticore APT Deploys Modular C2 Framework
The Cavern Manticore APT, suspected to be linked to Iran, is engaged in cyber-espionage targeting Israeli government and IT sectors via a modular command and control (C2) framework. This versatile system allows for undetected intrusions by abusing legitimate…
SecurityOnlineCavern Manticore APT -
Attackers can exploit WAGO I/O flaw via CVE-2026-4769
A critical vulnerability, identified as CVE-2026-4769, has been discovered in WAGO System I/O field devices, rated with a CVSS score of 9.8, indicating severe security risks due to unauthenticated access to internal diagnostic interfaces. This flaw allows…
-
Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
Australia's Signals Directorate has issued a warning about a large-scale exploitation campaign targeting content management systems (CMS) like WordPress and Joomla. Attackers are exploiting vulnerabilities to deploy webshells on affected websites, allowing…
Security Affairs -
Misconfigured Server Leaks Evilginx Phishing at Microsoft 365
The article discusses how a misconfigured server led to the exposure of three phishing campaigns orchestrated by Evilginx, specifically targeting Microsoft 365 users. This security incident was uncovered during a routine review, highlighting the…
The Hacker News -
Armored Likho uses AI phishing to spread BusySnake Stealer
The report discusses a new phishing campaign attributed to the Armored Likho APT group, targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan using the BusySnake Stealer malware. This campaign utilizes…
SecurityOnlineArmored Likho -
New Windows malware GigaWiper can remotely wipe user systems
The article provides a summary of cybersecurity news from July 6 to July 12, 2026. Key points include: A new Windows malware named GigaWiper that can remotely wipe users' systems. Recruitment tactics of mule betting scams targeting ordinary individuals. Two…
Malwarebytes -
AI agents fooled by SEO poison to steal crypto and site rankings
This article discusses the Indirect Prompt Injection (IPI) cyber attack targeting autonomous AI agents and large language models (LLMs). It details how threat actors manipulate web content through SEO poisoning and typosquatting to deceive AI systems into…
SecurityOnline -
Zero day flaws hit Joomla iCagenda and Balbooa Forms extensions
On July 13, 2026, it was reported that vulnerabilities in the iCagenda and Balbooa Forms Joomla extensions are being exploited as zero-day attacks, posing serious risks to users. The flaws enable unauthorized access and potential data breaches, highlighting…
The Hacker News -
Internetwide scan targets AI assistant configs and MCP servers
The article discusses recent findings from scanning logs, revealing systematic probing for Model Context Protocol (MCP) servers, AI assistant configurations, and local LLM endpoints. Over a two-week analysis, unauthorized requests for these components were…
SANS ISC -
Hackers Use SpaceX, Starlink Accounts to Push Fake $SCATMAN Token
A recent breach of the SpaceX and Starlink social media accounts was orchestrated by a cryptocurrency syndicate during a public dispute involving Elon Musk and Sam Altman. The attackers compromised these accounts, hijacking them to promote a fraudulent…
SecurityOnline -
Cursor shifts to AI agent after Musk buyout, targets daily work
Cursor, an AI code editor acquired by Elon Musk for $60 billion, is transitioning from its developer roots to create a general-purpose AI agent, competing with Anthropic's Claude Cowork. The new agent aims to assist everyday knowledge work beyond coding,…
SecurityOnline -
Didier Stevens Handles Low Risk ISC Update, Points to SANS Class
The content outlines a post from the Internet Storm Center (ISC) for July 13, 2026, featuring Didier Stevens as the handler on duty. The current threat level is set to green, indicating low risk.
SANS ISC -
CISA Adds Six KEV Flaws, Including Joomla Extensions and AI Bugs
The weekly CVE report for July 6-12, 2026, highlights a total of 1,571 new vulnerabilities, including 125 critical and 510 high-rated issues. Six actively exploited vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog, all…
-
Mycelium AI as a Service Botnet Targets Enterprise Systems
The Mycelium Framework is a newly identified AI-as-a-Service botnet targeting enterprise infrastructure through automated exploits and brute-force attacks. Developed by unknown actors, it employs over 20 remote code execution modules aimed at various…
SecurityOnline -
Apache Log4j CVE-2026-49844 flaw can hide attacks via JSON logs.
The content discusses CVE-2026-49844, a security flaw in Apache Log4j affecting multiple versions (2.13.1, 2.26.0, and 3.0.0-alpha1). This vulnerability allows improper serialization of non-finite floating-point numbers in JSON output, which can disrupt log…
