News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Tue 21 Jul· 80 articles
-
Seoul will warn 4.62 million of Ttareungyi bike share data breach
The Seoul Metropolitan Government will notify approximately 4.62 million citizens about a data breach involving their membership information from the Ttareungyi bike-sharing service. Notifications will include specific leaked information and compensation…
DataBreaches -
Empirical secures $25m Series A to boost AI cyber risk tools
Empirical, a Chicago-based cybersecurity startup founded in 2024, has secured $25 million in Series A funding, increasing its total funding to $37 million. The investment, led by Brightmind Partners, will expedite the development of its key products:…
SecurityWeek -
SecurityWeek launches merit based Critical Impact Awards program
SecurityWeek recently introduced the Critical Impact Awards, a program recognizing significant contributions in industrial cybersecurity. Unlike traditional awards, these honors are based on merit and independent reviews by a panel of cybersecurity experts.…
SecurityWeek -
FBI warns of deepfake IC3 scams luring victims to fake sites
The FBI has issued a warning regarding an increase in deepfake videos being used by scammers to impersonate leadership from the Internet Crime Complaint Center (IC3). These videos, combined with spoofed IC3 websites, aim to defraud previous victims by making…
Infosecurity -
ClickLock Stealer hijacks Macs with Cloudflare password prompts
The article discusses the newly discovered ClickLock Stealer, a macOS infostealer designed to lock a victim's Mac until they provide their password. Delivered through phishing pages resembling Cloudflare verification, the malware utilizes a shell script to…
Malwarebytes -
Android AI agents leak invisible text that runs PC code
The article discusses a serious security vulnerability posed by open-source Android AI agents, which could allow invisible screen text to execute code on host PCs. This vulnerability highlights the need for enhanced safeguards within the AI software supply…
The Hacker News -
HollowGraph malware hijacks Microsoft 365 calendar for covert C2
A newly identified malware called HollowGraph utilizes the Microsoft 365 calendar for command-and-control communication, as reported by Group-IB. This malware, linked to the Iran-nexus threat actor Cavern Manticore, obscures its activities by hiding within…
SecurityWeekCavern Manticore -
Exploits now strike in hours, rendering patching ineffective
The article "N-day is Becoming N-Hour. Patching Faster Won't Save You" discusses the increasing urgency of addressing cybersecurity vulnerabilities. It emphasizes that traditional methods of patching systems are becoming ineffective against rapidly evolving…
The Hacker News -
FBI Alerts to Fake Agent Scams Targeting Past Cybercrime Victims
The FBI's Internet Crime Complaint Center (IC3) warns against scammers impersonating FBI agents on social media and messaging apps, especially targeting previous cybercrime victims. These fraudsters create convincing fake accounts and offer recovery services…
Malwarebytes -
Körber AG CISO Andreas Gaetje Shares His Cybersecurity Journey
The article features Andreas Gaetje, the CISO of Körber AG, discussing his unconventional journey into cybersecurity. He began his career focused on economics and public services before transitioning to IT and cybersecurity. Gaetje emphasizes that the…
SecurityWeek -
Bit2Watt attack lets cloud users threaten grid stability
A new attack, termed "Bit2Watt," poses a significant threat to cloud infrastructure, enabling cloud tenants to potentially disrupt power grids without exploiting a vulnerability. This emerging threat emphasizes the need for enhanced security measures in cloud…
The Hacker News -
Estée Lauder alerts staff after Oracle EBS flaw leaks 870GB
Cosmetics company Estée Lauder has notified employees about a data breach involving their personal information, which was stolen in August 2025 due to a vulnerability in Oracle E-Business Suite (EBS) exploited by the Cl0p cybercrime group. The breach leaked…
SecurityWeekCl0p -
ServiceNow AI Platform3 articles this day · Security Affairs first
CVE-2026-6875 Hits ServiceNow AI Platform · ServiceNow patches AI sandbox flaw CVE-2026-6875 as exploits rise
-
CVE-2026-6875 Hits ServiceNow AI Platform
CVE-2026-6875 is a critical pre-authentication vulnerability in the ServiceNow AI Platform that allows unauthenticated attackers to execute code under specific conditions. The vulnerability stems from a sandbox escape, threatening the security of ServiceNow…
-
ServiceNow patches AI sandbox flaw CVE-2026-6875 as exploits rise
A critical remote code execution vulnerability, tracked as CVE-2026-6875, has been patched in the ServiceNow AI platform but is reportedly being exploited in the wild. It is described as a sandbox escape issue that allows unauthenticated attackers to execute…
-
Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875
Researchers have identified a critical remote code execution (RCE) vulnerability in ServiceNow, tracked as CVE-2026-6875, allowing attackers to execute arbitrary code on self-hosted instances. Disclosed by Searchlight Cyber on July 14, 2026, the flaw was…
-
-
Researcher pockets $78k Meta bounty for support data flaw
A security researcher, Rony K Roy, received a $78,000 bug bounty from Meta after uncovering a critical vulnerability that exposed customer support data while initially reporting a less severe authorization issue in January 2026. The flaw, which was more…
SecurityWeek -
SF Sues Apple, Google to Pull Nudify Apps After Deepfake Worries
The article discusses legal actions taken by San Francisco against Apple and Google regarding 'nudify' apps that create non-consensual nude images from photos. On July 17, 2026, San Francisco's City Attorney David Chiu sent cease-and-desist letters to both…
Malwarebytes -
Craneware breach exposes healthcare data amid investigation
Craneware, a healthcare finance software provider, has reported a cyber incident involving unauthorized access to its data environment, resulting in the theft of numerous file names and some employee and customer data. Although most stolen data was…
Infosecurity -
Clover Health breach leaks data after social engineering attack
Clover Health Investments has reported a data breach affecting customers' personal and health information due to a social engineering attack on July 4, which compromised the accounts of three non-managerial employees. The company responded promptly by…
SecurityWeek -
North Korean hackers use fake crypto job offers to install RATs
Researchers at SOCRadar have uncovered a sophisticated social engineering campaign attributed to the North Korean hacking group Famous Chollima, targeting Web3 and cryptocurrency professionals. The campaign involves fraudulent job interviews and interactive…
InfosecurityWageMole -
CHRYSENE2 articles this day · securelist.com first
Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel · OilRig hides C2 commands inside Outlook calendar events
2 outlets-
Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel
Project CAV3RN is a cyberespionage framework, linked to the Iran-based group OilRig (APT34), targeting organizations in Israel, including an Israeli law firm. Discovered by Kaspersky, its new communication module uses Microsoft Outlook calendar events to…
SecurityOnline -
OilRig hides C2 commands inside Outlook calendar events
The article discusses Project CAV3RN, a cyberespionage framework linked to the OilRig group, now incorporating Microsoft Graph to communicate through Outlook calendar events. The previously used HTTP/WebSocket components were replaced by this new…
securelist.com
-
-
SonicWall SMA 1000 zero day used to spread KNUCKLEBALL
The article discusses critical vulnerabilities in SonicWall SMA 1000 appliances exploited in a zero-day attack campaign leading to the deployment of KNUCKLEBALL malware. The two primary vulnerabilities, CVE-2026-15409 and CVE-2026-15410, allow attackers…
-
WordPress wp2shell exploit fuels surge in site scans and attacks
The article discusses the increasing exploitation of the WordPress vulnerability known as wp2shell, which has led to widespread scanning and attacks on WordPress sites. It emphasizes the urgency for website administrators to secure their platforms against…
The Hacker News -
UEFI CA 2023 Shift Causes Update Blocks on Enterprise PCs
Microsoft held a technical community exchange regarding the UEFI CA 2023 certificate update, attended by major hardware manufacturers. The transition from the expired UEFI CA 2011 certificate to the new one has raised concerns among enterprise IT…
SecurityOnline -
OVH rolls out emergency patch for KVM flaw CVE-2026-53359
OVH, a European cloud provider, executed an emergency patch to resolve a critical security flaw (CVE-2026-53359) in KVM virtualization, affecting tens of thousands of servers and around a million virtual machines within ten days. This flaw, a use-after-free…
-
Zimbra fixes critical command injection, XSS flaws in ZCS 10.1.20
Zimbra has announced critical patches for several vulnerabilities, including a command injection bug affecting its collaboration suite if specific services are enabled. The security update, Zimbra Collaboration Suite (ZCS) version 10.1.20, addresses…
SecurityWeek -
TuxBot v3 Evolution — an IoT Botnet Built With LLM Help
The TuxBot v3 Evolution is a newly discovered IoT botnet framework, identified by Palo Alto Networks' Unit 42. It primarily targets IoT devices through methods such as Telnet brute-force attacks, leveraging over 1,400 credential pairs. The botnet is part of…
SecurityOnline -
Nextcloud phishing redirect
Nextcloud, an open-source cloud software, experienced a cyberattack on July 20th, resulting in a phishing redirect to a fraudulent site named Cloudbox. Initial investigations linked the breach to a potential WordPress vulnerability known as wp2shell, raising…
SecurityOnline -
Anthropic cuts Claude Team plan minimum to two seats
Anthropic has updated its Claude Team plan, reducing the minimum seat count from five to two, making it more accessible for small teams like startups and agencies. The pricing remains unchanged, but the new requirement allows for smaller groups to utilize…
SecurityOnline -
ENCFORGE Ransomware Hunts AI Models Through Langflow RCE
The article discusses a new ransomware variant called ENCFORGE, which specifically targets AI model files during Langflow Remote Code Execution (RCE) attacks. It highlights the increasing threat posed by ransomware to AI software and emphasizes the need for…
The Hacker News -
AI Botnet by Bandcampro Hits Dental Clinic, Migrates Fast
The article discusses the activities of a Russian-speaking threat actor, known as "bandcampro", who utilized AI to manage a botnet. Researchers obtained 200 logs documenting the operation of an AI-powered command and control (C&C) botnet that targeted a…
SecurityOnlinebandcampro -
Critical ServiceNow AI flaw lets attackers run code without auth
The article discusses a critical vulnerability in the ServiceNow AI platform that allows for unauthenticated code execution. This flaw poses significant security risks, enabling attackers to exploit the system without proper authentication. The author…
The Hacker News -
ClickLock Stealer targets macOS crypto users with fake CAPTCHA
The ClickLock Stealer is a new macOS malware identified by Group-IB, specifically targeting macOS users, especially those holding cryptocurrencies. This malware exploits social engineering rather than needing exploits or elevated privileges. It operates via…
SecurityOnline -
White House launches GOLD EAGLE to speed up cyber repairs
The White House has launched the GOLD EAGLE initiative to streamline cybersecurity vulnerability coordination, involving key federal agencies such as the Treasury, DHS, and the Department of War. This program aims to expedite the identification and…
SecurityOnline -
Qilin ransomware exploits CVE-2026-0257 in Palo Alto firewall
In June 2026, Arctic Wolf Labs identified multiple ransomware incidents linked to the Qilin ransomware, attributed to an exploitation of the CVE-2026-0257 vulnerability in Palo Alto Networks' GlobalProtect firewall. This authentication bypass allowed…
-
AI flags 440 Linux kernel bugs, CVE-2026-53362 highlighted
Artificial intelligence has accelerated the identification of vulnerabilities, leading to 440 new CVE advisories for the Linux kernel within 24 hours. This influx of advisories includes 431 on July 19 and 9 additional on July 20, with most vulnerabilities…
-
LG Monitors Auto-Install Adware Through Windows Device Metadata
Recent complaints have emerged from owners of LG monitors about unwanted pop-up ads for McAfee installed via companion software that downloads automatically on Windows devices without user consent. This practice began in July 2025 and is a product of…
SecurityOnline -
Johannes Ullrich Hosts SANS Stormcast as Threat Level Stays Green
The content features a handler on duty, Johannes Ullrich, with the current threat level being reported as green. There is a mention of the ISC Stormcast for July 21, 2026. Additional resources and links are provided for further information on classes taught…
SANS ISC -
Critical WordPress Bug Lets Attackers Run Code Remotely
This article addresses critical vulnerabilities in WordPress identified as CVE-2026-60137 and CVE-2026-63030, responsible for unauthenticated remote code execution (RCE). The CVSS score for CVE-2026-63030 is notably high at 9.8, indicating a severe security…
