News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 15 Jul· 63 articles
-
Runtime Security for Third-Party GitHub Actions Runners: Bitrise, Blacksmith, Depot, Namespace, and Warp
The article discusses the integration of Harden-Runner, a security tool designed to protect third-party GitHub Actions runners, which now includes support for Bitrise macOS runners in version 2.20.0, along with Blacksmith, Depot, Namespace, and Warp. It…
StepSecurity -
Harden Runner v2.20.0 adds egress block mode to stop secret leaks
Harden-Runner v2.20.0 introduces egress block mode for macOS and Windows GitHub-hosted runners, enhancing security by preventing secret exfiltration across all supported operating systems. Previous attacks exposed vulnerabilities where compromised workflows…
StepSecurity -
Device Policy secures VS Code extensions with MDM and Terraform
The article introduces Device Policy, a new feature that allows security teams to enforce a list of approved VS Code extensions across their organization using tools like Intune, Jamf, or the DMG agent. Key points include: 1. **Functionality**: Device Policy…
StepSecurity -
CISA alerts on active KNX flaw CVE‑2023‑4346, urges action
On 15 July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2023‑4346 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects the KNX Association’s KNX Protocol Connection Authorization Option 1. It is an overly…
-
CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV
CISA has added CVE‑2026‑46817 to its Known Exploited Vulnerabilities catalogue, affecting Oracle’s E‑Business Suite. The vulnerability, named Oracle E‑Business Suite Improper Privilege Management Vulnerability, allows an unauthenticated attacker with network…
-
ESET Finds 11 UEFI Shim Bootloaders Undermining Secure Boot Trust
The article discusses the discovery of 11 vulnerable UEFI shim bootloaders that have been trusted for years, exposing a critical blind spot in Secure Boot systems. These bootloaders, discovered by ESET, could allow attackers to bypass Secure Boot protections…
Dark Reading -
Identity Attacks Now Drive Most Ransomware, Phishing Tops List
A recent report by Sophos reveals that identity attacks are now the leading cause of ransomware, surpassing previous reliance on software vulnerabilities. Key findings show that malicious emails (26%) and phishing (24%) constitute the top exploit methods,…
Dark Reading -
HiveLegacy exploit lets users hijack Windows admin accounts
Following a record number of security patches released by Microsoft, a researcher published an exploit called HiveLegacy that allows low-privileged Windows accounts to modify administrator accounts. The exploit targets vulnerabilities in the Windows User…
Ars Technica -
TELEPUZ spreads via ClickFix-VIDAR social engineering attack
TELEPUZ is a new modular malware discovered spreading through CLICKFIX-VIDAR attacks. It is lightweight and under active development with a growing presence on VirusTotal. The infection process starts with social engineering tactics that prompt users to…
elastic.co -
Western Allies Warn of Russian APT Router Attacks Globally
The US and allied governments have issued warnings regarding Russian state-sponsored Advanced Persistent Threat (APT) groups targeting poorly secured network devices, particularly routers, to compromise critical infrastructure globally. These threats are…
Security AffairsRussian FSB Center 16 -
Calgary 911 Worker Charged with Breach of Trust Over Data Leak
Calgary police charged a City of Calgary 911 employee after an investigation into unauthorized disclosure of confidential information. The investigation, which began in January, revealed that the employee allegedly accessed and shared sensitive emergency…
DataBreaches -
LLM Powered TuxBot v3 Raises Stakes for IoT Security
The article discusses the evolution of TuxBot v3, a notable development in IoT botnet capabilities powered by large language models (LLMs). It highlights the implications of this evolution for cybersecurity, particularly in risk containment and the…
The Hacker News -
Dark Reading launches DR Global Europe to tailor EU cyber intel
Dark Reading has launched a new section called DR Global Europe, targeting cybersecurity professionals in the EU and UK. This initiative aims to provide tailored intelligence and insights specific to Europe's unique cybersecurity landscape, which experiences…
Dark Reading -
Law Firm Sued Over May Data Breach Negligence Claim
A class action lawsuit has been filed against Wilmer Cutler Pickering Hale & Dorr in the US District Court for the District of Columbia, alleging negligence and contract damages for failing to protect the personal information of clients during a May data…
DataBreaches -
World Leaks Ransomware Group Exposes Kudankulam Nuclear Plant Data
Ransomware group World Leaks has leaked a significant amount of data on the dark web related to India’s largest nuclear plant, the Kudankulam Nuclear Power Plant. This includes alleged blueprints and supplier details from Reliance Group, a contractor…
DataBreachesWorld Leaks -
UK pushes for sovereign AI defence amid US model restrictions
The article discusses increasing concerns in the UK regarding technological sovereignty in the face of US restrictions on AI models from companies like Anthropic and OpenAI. The UK government, alongside the private sector, is advocating for reduced reliance…
Dark Reading -
LegacyHive Windows zero day enables privilege escalation
Chaotic Eclipse has revealed a new Windows zero-day exploit named LegacyHive that targets the Windows User Profile Service, allowing privilege escalation on fully patched Windows systems. This vulnerability does not yet have a CVE and requires valid user…
Security Affairs -
SonicWall SMA1000 flaws exploited, urgent patch advised
On July 14, 2026, SonicWall disclosed two critical vulnerabilities affecting its SMA1000 Series remote access appliances: CVE-2026-15409 (server-side request forgery, CVSS 10.0) and CVE-2026-15410 (code injection). Both vulnerabilities allow unauthenticated…
-
Microsoft Launches Tailored Threat Intelligence and MDR Services
Microsoft has announced new services aimed at enhancing cybersecurity through better threat intelligence and expert support. The key offerings include Microsoft Defender Experts Threat Intelligence, which provides tailored insights on emerging threats based…
Microsoft -
OkoBot Malware Tricks Ledger/Trezor Users to Reveal Seed Phrases
The article discusses the OkoBot malware framework, which targets users of cryptocurrency hardware wallets by injecting phishing prompts for seed phrases into Ledger and Trezor applications. This new threat emphasizes the importance of cybersecurity measures…
The Hacker News -
PromptFiction Flaw in Claude Desktop Enables Silent Data Theft
The article discusses a critical vulnerability found in Anthropic's Claude Desktop application, known as "PromptFiction." This flaw allowed attackers to submit malicious prompts to the AI assistant without any user interaction, potentially leading to severe…
Dark Reading -
Microsoft, SonicWall bugs found; RabbitMQ patches auth flaws
The article discusses the detection of four critical vulnerabilities in cybersecurity: 1. CVE-2026-56155 (Microsoft Active Directory Federation Services): Insufficient access control. 2. CVE-2026-56164 (Microsoft SharePoint Server): Missing authentication…
-
SeasonalInvite uses fake eCards to deliver RMM malware
A phishing campaign named SeasonalInvite has been active since January 2026, targeting Windows and macOS users by disguising remote monitoring and management (RMM) tools as legitimate eCards. The campaign uses themes that rotate with the calendar, employing…
Infosecurity -
Cursor AI IDE Allows Code Execution via Malicious git.exe
A significant vulnerability has been identified in Cursor, an AI-assisted development environment with over 7 million users, allowing for code execution through a malicious git.exe binary when users open a repository. Discovered by Mindgard, this flaw does…
SecurityWeek -
ClaudeBleed flaw lets rogue Chrome extensions hijack Gmail access
The article discusses a vulnerability in the 'Claude for Chrome' browser extension, known as ClaudeBleed, which could allow malicious extensions to control the assistant and access users' Gmail and other services without their knowledge. This flaw enables…
Malwarebytes -
CISA urges swift patching of SharePoint after zero day exploits
The US Cybersecurity and Infrastructure Security Agency (CISA) has urged immediate strengthening of Microsoft SharePoint servers following the discovery of zero-day vulnerabilities, notably CVE-2026-56164, which allows remote privilege escalation without…
-
Malicious NuGet Package Steals Payment Data From .NET Developers
The page details four critical cybersecurity vulnerabilities detected today, including issues in Microsoft Active Directory and SharePoint Server, as well as vulnerabilities in SonicWall appliances. It also highlights a malicious NuGet package named…
SecurityOnline -
Microsoft pulls decade old UEFI shims after Secure Boot bypass
Researchers from ESET have discovered that 11 vulnerable UEFI shim bootloaders, which have been signed by Microsoft and date back over a decade, can permit attackers to bypass the UEFI Secure Boot feature on many systems. The vulnerabilities allow untrusted…
Infosecurity -
Google Cloud Run bugs let attackers read files and run commands
The article highlights vulnerabilities in publicly exposed serverless applications, focusing on the security risks associated with Google Cloud Run services. Key points include: 1. **Vulnerability Exposure**: Serverless applications can be compromised…
Google Cloud -
Firefox, Chrome, Adobe and VMware roll out urgent security patches
The article discusses significant updates from Firefox, Chrome, Adobe, and VMware that address multiple critical security vulnerabilities. Highlighting the importance of timely software updates for maintaining cybersecurity, it notes that these updates were…
The Hacker News -
Cursor AI flaw lets hackers run commands via two click attack
The article discusses a security vulnerability in Cursor AI, an AI coding tool used by developers. Researchers revealed that malicious actors can exploit this 2-click vulnerability to execute arbitrary commands on developers' environments by disguising their…
Dark Reading -
Attackers abuse Windows bind links to hide malware from EDR tools
Bitdefender's research reveals three attack techniques exploiting Windows bind links to evade endpoint detection and response (EDR) systems. Bind links, used for mapping file paths, can be manipulated by attackers to redirect to malicious files, effectively…
SecurityWeek -
Cloud & Data Security Summit 2026 Sets AI, Identity Focus July 15
The article promotes the **2026 Cloud & Data Security Summit** taking place on July 15th, aimed at sharing strategies and best practices for cloud security. Key topics include identity security, AI application security, and overcoming challenges in cloud…
SecurityWeek -
Compromised Logins Fuel 79% of Ransomware Attacks, Sophos Reports
A recent report by Sophos reveals that compromised logins have become the leading entry point for ransomware attacks, accounting for 79% of incidents. Initially, malicious emails were the entry point in 26% of cases, a rise from 19% in 2025. Phishing…
Infosecurity -
Nayax refutes Syndicate breach claims after SEC filing
The article discusses a significant cybersecurity incident involving Israeli fintech company Nayax and a hacking group called The Syndicate, which claims to have exfiltrated over 100 TB of sensitive data, including 1 billion card records and KYC data. Nayax…
DataBreachesThe Syndicate -
Microsoft patches 622 flaws, fixes three critical zero day bugs
In July 2026, Microsoft addressed a significant security update during Patch Tuesday, fixing 622 CVEs, including three critical zero-day vulnerabilities—CVE-2026-50661, CVE-2026-56155, and CVE-2026-56164. These updates highlight a trend towards larger…
-
Progress restores ShareFile Storage Zones after four day alert
Progress Software has restored access to its ShareFile Storage Zones Controller after a four-day suspension due to a credible external security threat that was identified on July 10, 2026. The threat was linked to the exploitation of a high severity path…
Infosecurity -
CISA issues guide on coordinated vulnerability disclosure
The publication titled "Establishing a Coordinated Vulnerability Disclosure Program to Work With Security Researchers" was developed by CISA and the NSA, along with international partners. It provides best practices for software manufacturers and online…
CISA -
US DOJ charges Russians over bulletproof hosting cybercrime ring
The US Justice Department has indicted three Russian nationals—Aleksandr Volosovik, Kirill Zatolokin, and Yulia Pankova—and two companies, ML.Cloud and Media Land, for allegedly facilitating cybercrime services. These services provided 'bulletproof' hosting…
SecurityWeek -
AsyncAPI npm breach spreads info stealing malware via IPFS
A supply chain attack on AsyncAPI npm packages has been disclosed, affecting four packages with over 2 million weekly downloads. The malware, which includes capabilities for info-stealing, crypto-theft, and remote access, was injected into packages widely…
Security Affairs
