News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 14 Jul· 82 articles
-
Microsoft Active Directory Federation Services5 articles this day · thezdi.com first
Microsoft patches 570 flaws, two zero days actively exploited · Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes
-
Microsoft patches 570 flaws, two zero days actively exploited
Microsoft's July 2026 Patch Tuesday addresses 570 vulnerabilities, including two zero-days being exploited in the wild: CVE-2026-56155 (Active Directory Federation Services) and CVE-2026-56164 (SharePoint Server). Federal agencies are required to patch these…
-
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday update is unprecedented, addressing 622 unique CVEs, including three zero-day vulnerabilities. Among these, two are actively exploited, while the third is a known but unexploited flaw. The update signals a significant…
-
CISA warns ADFS flaw allows local privilege escalation
On 14 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑56155 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft’s Active Directory Federation Services (ADFS) and is titled *Microsoft Active…
-
Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft announced its July 2026 Patch Tuesday, addressing 622 vulnerabilities, including two critical zero-day exploits in Active Directory (CVE-2026-56155) and SharePoint Server (CVE-2026-56164). These flaws could lead to privilege escalation attacks.…
-
Microsoft releases record 621 patches as Adobe updates key apps
The July 2026 Security Update Review discusses significant security patches released by Adobe and Microsoft. Adobe has shifted to a bimonthly release cycle, issuing patches for 12 products, addressing 88 CVEs, with Adobe ColdFusion and Adobe Commerce being…
-
-
Unrevoked firmware shims expose Microsoft Secure Boot flaw
Microsoft's Secure Boot, designed to protect Windows and Linux devices from firmware attacks, has been vulnerable for most of its 14-year existence. Researchers at ESET found that 11 defective firmware images, also known as shims, remained unrevoked despite…
Ars Technica -
Patch Tuesday - July 2026
In July 2026, Microsoft published 622 vulnerabilities, a record 416 of which are for Windows. Among the critical vulnerabilities are two exploited in the wild: CVE-2026-55040, an authentication bypass in SharePoint, and CVE-2026-56164, an elevation of…
-
xAI to Delete All User Data After Grok Build CLI Code Leak
xAI, founded by Elon Musk, is taking emergency measures due to a controversy involving unauthorized uploads of users' private code via the Grok Build CLI tool. The company announced it will permanently delete all uploaded user data for security reasons after…
DataBreaches -
Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month
In July 2026, Microsoft released its largest Patch Tuesday update, addressing 621 vulnerabilities (CVEs), surpassing all previous yearly totals. This includes critical flaws such as two actively exploited zero-days—CVE-2026-56155 in Active Directory and…
-
D1R2 articles this day · SecurityWeek first
D1R ransomware claims Synopsys breach, threatens 40k data leak · Synopsys refutes D1R ransomware claim of Bosch data breach
2 outlets-
D1R ransomware claims Synopsys breach, threatens 40k data leak
A new ransomware group named D1R has claimed responsibility for hacking Synopsys and Bosch. They allege that they exploited a vulnerability in Synopsys’ website to access a database containing 40,000 client entries and threaten to leak this data unless a…
DataBreaches -
Synopsys refutes D1R ransomware claim of Bosch data breach
Synopsys, a silicon-to-systems design firm, reported no evidence of a data breach despite claims from a new ransomware group, D1R, that they hacked into its systems and accessed sensitive data from Bosch, a major client. The cybercriminals alleged the…
SecurityWeek
-
-
Finnish Police Hunt Aleksanteri Kivimäki Over Vastaamo Breach
The Finnish police have issued a wanted notice for Aleksanteri Kivimäki, a convicted hacker, after the Supreme Court rejected his appeal, allowing authorities to proceed with his imprisonment for nearly seven years. Kivimäki was sentenced for hacking the…
DataBreaches -
U.S. offers $10 million bounty on Russian bulletproof host
Rewards for Justice announced a $10M reward for information regarding the Russian bulletproof hosting company Media Land and its affiliate ML.Cloud, including key staff members Aleksandr Alexandrovich Volosovik, Kirill Andreevich Zatolokin, and Yuliya…
DataBreaches -
Microsoft patches 622 flaws, two zero days exploited in the wild
On July 14, 2026, Microsoft announced it patched a record 622 vulnerabilities, including two zero-day flaws currently under active attack, highlighting the significant cybersecurity challenges faced by enterprises today. The article emphasizes the importance…
The Hacker News -
CISA Adds SonicWall SMA1000 Code Injection Flaw to KEV Catalog
CISA has added CVE‑2026-15410 to its Known Exploited Vulnerabilities catalogue, affecting SonicWall’s SMA1000 Appliances. The vulnerability is a code injection flaw that, under specific conditions, allows a remote authenticated attacker with administrator…
-
CISA KEV Catalog Highlights SonicWall SMA1000 Flaw CVE-2026-15409
CISA added CVE-2026-15409 to the KEV catalogue, identifying SonicWall’s SMA1000 Appliances as the affected product and naming the flaw SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability. The vulnerability is a server-side request forgery…
-
CISA KEV Flags SharePoint Privilege Escalation Bug CVE-2026-56164
CISA has added CVE‑2026-56164, named Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability, to its Known Exploited Vulnerabilities catalogue. The affected vendor is Microsoft and the product is SharePoint Server. The…
-
Researchers Warn of Flaws in 6 GHz WiFi Frequency Coordination
Research from Pennsylvania State University and Idaho National Laboratory highlights security vulnerabilities in 6 GHz Wi-Fi systems due to automated frequency coordination (AFC) trusting client-side data. Potential attacks include location spoofing that…
Dark Reading -
US sanctions VPN provider 1VPNS and hacker for ransomware aid
The U.S. Treasury has sanctioned a VPN provider, 1VPNS, and an individual, Yegeniy Vladimirovich Silayev, for facilitating ransomware operations that have resulted in billions of dollars in losses to U.S. businesses and critical infrastructure. The sanctions…
Security Affairs -
Microsoft patches 570+ flaws, AI drives surge in Windows updates
Microsoft has released updates addressing over 570 security vulnerabilities in its Windows operating systems and other software, nearly three times more than last month. Among these, 60 bugs are rated as 'critical,' allowing remote control over devices. The…
Krebs on Security -
Microsoft patches 622 flaws, 62 critical, three already exploited
The Microsoft Patch Tuesday for July 2026 addressed 622 vulnerabilities in its products, including 427 in Chromium affecting Edge. Notably, 62 vulnerabilities are rated critical, with three already exploited. The report highlights key vulnerabilities,…
SANS ISC -
Microsoft warns vishing attacks on misconfigured Salesforce access
Microsoft's Security Research Team identified threat actor activities between mid-2025 and mid-2026, highlighting tactics aligned with ShinyHunters, such as voice phishing (vishing), supply chain compromises, and exploitation of misconfigured guest access in…
DataBreachesShinyHunters -
SAP issues critical patch for NetWeaver ABAP flaw rated CVSS 9.9
SAP has released critical patches addressing a severe vulnerability in NetWeaver ABAP, rated CVSS 9.9, that poses risks of data exposure or modification. This flaw allows unauthorized access to data, potentially with serious implications for organizational…
The Hacker News -
Boards Can Tackle Third Party Vendor Risk With Clear Governance
The article discusses effective management of third-party vendor risk through structured governance strategies. It emphasizes the importance of measuring and understanding risks associated with vendor relationships, validating risks, benchmarking against…
Dark Reading -
Claude for Chrome flaw lets rogue extensions read your Gmail
The article discusses a security flaw in the Claude for Chrome extension that allows malicious extensions to read Gmail messages without user consent. This vulnerability poses significant privacy risks and highlights the need for improved browser security…
The Hacker News -
Welshman jailed for swatting spree after Doxbin admin role
Callum Dare, a 26-year-old Welshman, was sentenced to prison for his involvement in multiple swatting incidents across the UK, US, and Canada. As an administrator of Doxbin, a dark web site known for exposing personal information to facilitate harassment, he…
DataBreaches -
Adobe patches critical ColdFusion flaws in latest security update
Adobe released updates for 12 products addressing 88 vulnerabilities, including critical issues in ColdFusion, Commerce, Experience Manager, and Illustrator. Key vulnerabilities in ColdFusion could lead to arbitrary code execution and privilege escalation.…
SecurityWeek -
LabubaRAT malware poses as NVIDIA software to hijack Windows PCs
The article discusses the emergence of LabubaRAT malware, which disguises itself as legitimate NVIDIA software to control Windows hosts. This type of malware is indicative of a growing trend where cyber threats are increasingly employing sophisticated…
The Hacker News -
Tego AI flags security flaw in Anthropic’s Claude Tag Slack bot
Tego AI, a cybersecurity start-up, has identified a significant security vulnerability in Claude Tag, Anthropic’s integration with Slack. The risk arises from Claude Tag responding to messages with the text ‘@Claude’ without needing a proper Slack mention,…
SecurityOnline -
US States Enact AI Safety Laws as Ransomware Threats Rise
The article discusses the emergence of regulations surrounding frontier artificial intelligence (AI) as state governments in Illinois, New York, and California enact laws to ensure transparency and safety in AI deployment. Illinois has introduced the…
Dark Reading -
ClickFix turns malware as a service, dodging antivirus shields
The article discusses the evolution of ClickFix, a malware ecosystem that exploits social engineering techniques to effectively bypass traditional security defenses like antivirus and endpoint detection systems. Researchers highlight the need for new…
Dark Reading -
DoD halts CMMC Phase II, orders review of defence cyber standards
The US Department of Defense (DoD) announced the suspension of Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, initially scheduled for implementation on November 10, 2026. This decision comes as the DoD aims to review the program to…
Infosecurity -
Dell PowerProtect CVE-2026-53483 lets attackers hijack backups
Dell has disclosed multiple high-severity security vulnerabilities in its PowerProtect Data Domain appliances, allowing unauthenticated attackers to potentially gain complete control over backup systems. The highlighted vulnerabilities include…
-
Linux2 articles this day · SecurityOnline first
Linux Kernel Bug Lets Users Gain Root Access via Bad Epoll · Public Exploit and Details Released for Bad Epoll Root Flaw (CVE-2026-46242)
-
Linux Kernel Bug Lets Users Gain Root Access via Bad Epoll
Two serious vulnerabilities in the Linux kernel, CVE-2026-46242 (Bad Epoll) and CVE-2026-53362, have been identified with public proof-of-concept exploit code available. Bad Epoll allows an unprivileged user to gain root access through a use-after-free…
-
Public Exploit and Details Released for Bad Epoll Root Flaw (CVE-2026-46242)
The content discusses a critical vulnerability in the Linux kernel identified as CVE-2026-46242, which allows unprivileged users to escalate their privileges to root. The vulnerability, referred to as 'Bad Epoll', affects various Linux kernels (v6.4 and…
-
-
Critical X.Org flaws patched, CVE‑2026‑56000 scores 9.0
X.Org has released patches for two significant vulnerabilities affecting its server and Xwayland products. The most severe, CVE-2026-56000, is a use-after-free issue rated 9.0 on the CVSS scale, while CVE-2026-55999 is a heap buffer overflow rated 8.5. Both…
-
Broadcom fixes critical VMware Avi LB flaws, CVE-2026-47865
Broadcom has released updates for the VMware Avi Load Balancer to address seven serious vulnerabilities, including a critical authentication bypass (CVE-2026-47865) and others that allow arbitrary code execution or privilege escalation. Two researchers,…
-
RabbitMQ flaw leaks OAuth secrets, exposes tenant queue data
The article highlights vulnerabilities in RabbitMQ that could lead to the leakage of OAuth secrets and exposure of cross-tenant queue metadata. These flaws present potential security risks, allowing unauthorized access and information disclosure between…
The Hacker News -
Composer fixes CVE-2026-59948 flaw enabling arbitrary file writes
The report highlights a critical security alert regarding PHP Composer, the main dependency manager for PHP. Three vulnerabilities were identified, notably CVE-2026-59948, which allows arbitrary file writes outside the vendor directory with a CVSS score of…
-
Cursor IDE flaw lets hackers run code via poisoned repo
A vulnerability in the Cursor IDE allows execution of malicious code from poisoned repositories without users' consent or awareness. Discovered by Mindgard, this security flaw means that if a specific malicious file (named git.exe) is placed in the root of a…
Dark Reading -
Claude Chrome Extension Flaw Exposes Gmail to Malicious Scripts
AI security firm Manifold has reported that two vulnerabilities it identified in Anthropic's Claude for Chrome browser extension remain unaddressed in the latest version. These flaws allow malicious extensions to manipulate Claude, enabling unauthorized…
SecurityWeek -
Albanian .AL DNSSEC failure prompts Cloudflare to skip validation
On July 3, 2026, the Albanian communications authority (AKEP) experienced a DNSSEC key rollover failure in the .AL TLD, leading to widespread DNS resolution issues. Anyone attempting to access .AL domains via validating DNS resolvers encountered errors. In…
Cloudflare
