News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 5 so far |
Mon 3 Aug· 75 articles
-
ShinyHunters leaks Brinks Home data after ransom refusal
The ShinyHunters extortion group has leaked over 41GB of data believed to be from Brinks Home, a Dallas-based physical security firm, after a cyberattack accessed its IT systems. The attack compromised over 4.9 million records from Brinks Home’s Salesforce…
SecurityWeekShinyHunters -
AI FOMO Surges as Claude Joins Security Operations Centres
The article discusses the implications of AI platforms, specifically Claude, in Security Operations Centers (SOC). It highlights the phenomenon of Fear of Missing Out (FOMO) that may arise as AI tools become more prevalent in cybersecurity. Key points…
The Hacker News -
HollowFrame loader evades Defender via fake Python in law firm
The article discusses the discovery of a new loader framework known as HollowFrame, which uses a counterfeit Python runtime to evade Microsoft Defender detection. This framework was utilized in a cyber intrusion targeting a law firm, initiated through a…
Infosecurity -
China Hackers Use Leaked DarkSword to Spread GhostBlade on iOS
A Chinese threat actor has reportedly utilized a leaked version of the DarkSword toolkit to deploy an advanced malware known as GHOSTBLADE on iOS devices. This represents a significant security concern as it highlights the vulnerabilities in mobile operating…
The Hacker News -
SonicWall SMA1000 Appliances2 articles this day · SecurityOnline first
INC Ransomware exploits CVE-2026-15409, gains root on SonicWall · SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks
-
INC Ransomware exploits CVE-2026-15409, gains root on SonicWall
The INC Ransomware group has been identified as the primary threat actor exploiting two significant vulnerabilities in SonicWall’s SMA1000 secure remote access appliances, designated as CVE-2026-15409 (CVSS 10) and CVE-2026-15410 (CVSS 7.2). These flaws…
-
SonicWall SMA Exploit Chain Now Fuels INC Ransomware Attacks
The content discusses an exploit chain affecting SonicWall SMA 1000 series VPN appliances, which allows unauthorized access leading to root privileges and the deployment of INC Ransomware. Key points include the identification of the malware families…
-
-
Google Passkey Weakness Lets Attackers Steal Synced Keys
The article from Palo Alto Networks' Unit 42 focuses on the security vulnerabilities in passwordless authentication systems, particularly highlighting risks associated with Google's synced passkey ecosystem. It outlines three novel attacks—"Pass-ta-key,"…
unit42.paloaltonetworks.com -
KT fined £38m after femtocell hack enables micropayment fraud
South Korea's largest telecommunications company, KT (Korea Telecom), has been fined $38 million by the Personal Information Protection Commission (PIPC) due to serious security failings that allowed hackers to defraud customers through unauthorized…
Infosecurity -
Russian hackers hijack public WiFi to steal Microsoft 365 logins
A Russian state-sponsored Advanced Persistent Threat (APT), identified as Storm-2945, is accused of conducting a credential theft campaign via compromised public Wi-Fi gateways, targeting employees in various sectors like finance and healthcare. Microsoft…
SecurityWeekStorm-2945 -
UK Police Database Leak Exposes Officers' Details on Dark Web
The article discusses a data breach involving the Police National Legal Database (PNLD) in the UK, which has resulted in sensitive contact details of police and government officials being exposed on the dark web. The breach raises serious concerns about…
The Hacker News -
Żabka data leak reveals source code and credentials for sale
The article discusses an alleged data breach involving Żabka Polska, Poland's largest convenience store chain, which has purportedly leaked significant data, including Jira issues, GitLab repository source code, and sensitive credentials. A seller claimed to…
Security Affairs -
Iranian hackers hit water plants in seven states, safety assured
Recent cyberattacks on the U.S. water sector have targeted at least seven states, primarily attributed to Iranian hackers. Minnesota reported attacks on over 30 water and wastewater facilities, with other states like Michigan and South Dakota also confirming…
SecurityWeek -
Coldcard Bitcoin Wallet Breach Exposes $89M in Stolen Funds
Coldcard, a popular Bitcoin hardware wallet, has experienced a significant security breach resulting in the theft of approximately $89 million worth of Bitcoin. This incident, initiated on July 30, involved automated attacks that exploited a firmware…
Infosecurity -
Alphabet Q2 2026 Profits Soar on AI Cloud Boom and Gemini Push
Alphabet's Q2 2026 results show a 24% increase in revenue to $119.8 billion, driven by a significant demand for AI infrastructure. Key highlights include: Operating income reached $40.77 billion, with net income doubling to $112.1 billion. Google Cloud…
SecurityOnline -
Thermo Fisher patches DNA data tampering vulnerability
The article discusses a recent security vulnerability discovered in Thermo Fisher technologies, which could potentially allow for DNA file tampering to go undetected. This flaw has been patched, highlighting the importance of constant vigilance in data…
The Hacker News -
Malicious npm Packages Hit Alibaba Devs with Spyware RAT
The article discusses a recent npm supply chain attack targeting Alibaba developers, specifically those from Taobao, Tmall, and Alibaba Cloud. The attack involves a cross-platform RAT (Remote Access Trojan) that is delivered through malicious npm packages…
SecurityOnline -
Developer runs Kimi K3 model via C99 engine on modest hardware
Developer FareedKhan has created a C99 inference engine to run the Kimi K3 model on standard hardware, processing at 20 seconds per token with 128GB RAM and 33 seconds per token with a constrained 8GB RAM. The project illustrates the Mixture-of-Experts (MoE)…
SecurityOnline -
Windows 11 Beta Adds Custom Taskbar Placement Options With Limits
Microsoft has initiated extensive testing for customizable Taskbar positioning in Windows 11, which allows users to place the Taskbar at any edge of the screen. This feature, now available to Beta Channel users, enhances personalization by enabling users to…
SecurityOnline -
Tengu Botnet Revives Mirai Threat with Telnet Brute Force Attacks
The Tengu botnet, disclosed by Nozomi Networks Labs on July 27, 2026, is a modernized variant of the Mirai IoT botnet, targeting internet-facing embedded Linux devices like routers and cameras. It employs Telnet brute-force attacks for initial access,…
SecurityOnline -
Malwarebytes adds Microsoft Store app as Fortnite scams surge
The article from Malwarebytes Labs discusses major security news from July 27 to August 2, 2026. Key highlights include reports of fake Fortnite rewards and Flash Player installations leading to account thefts, a lawsuit against Hims & Hers for privacy…
Malwarebytes -
N-able N-central servers breached despite recent fix
N-able reports that attackers have successfully taken over N-central servers despite a prior fix being in place, highlighting ongoing vulnerabilities in endpoint security. The news emphasizes the importance of robust cybersecurity measures and proactive…
The Hacker News -
Hugging Face Diffusers flaw lets models run arbitrary code
The article discusses vulnerabilities in Hugging Face's Diffusers that may allow model repositories to execute arbitrary code. The author emphasizes the importance of AI security in addressing such flaws to protect against potential attacks. It highlights…
The Hacker News -
Ruby on Rails fixes critical Active Storage bug CVE-2026-66066
Ruby on Rails has addressed a critical vulnerability (CVE-2026-66066) in its Active Storage framework that could allow unauthenticated attackers to read arbitrary files from servers, impacting applications that use the libvips image processor. This…
-
CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers
CastleLoader is a malware family that delivers various payloads such as NeedleStealer and NetSupport RAT, targeting Windows users and cryptocurrency wallets through fake software installers and ClickFix-style lures. The malware uses advanced techniques…
SecurityOnline -
Debian patches critical kernel flaws, including CVE-2026-64530
The Debian project has released security advisory DSA-6405-1 for Debian 13, addressing 68 kernel vulnerabilities, including four critical ones that result in use-after-free flaws in various subsystems such as net/sched, NVMe/TCP, and SMC-R. Users are urged…
-
ColdCard Wallet Bug Lets Hackers Steal Nearly $100 Million
The ColdCard wallet hack has led to significant losses for Bitcoin investors, with nearly $100 million siphoned due to a firmware vulnerability. This vulnerability allows hackers to exploit a flawed private key generation process linked to a predictable…
SecurityOnline -
OpenAI Astra Math Breakthrough: A New Era of Scientific Discovery
On August 1st, OpenAI released their advanced AI model, Astra, which tackled ten significant mathematical problems across various fields, including high-dimensional geometry and quantum complexity. Unlike previous models, Astra is not publicly accessible for…
SecurityOnline -
COLD CARD flaw exposes 1,367 BTC theft after flawed RNG
The COLDCARD hardware wallet has experienced a significant security breach resulting in the theft of 1,367 BTC, valued at approximately $88.6 million, from 4,585 wallets. This exploit occurred in three waves beginning on July 30, 2026, with the first wave…
SecurityOnline -
ICANN delegates .web to Verisign, registrations open late 2026
.web top-level domain (TLD) has been delegated to the global DNS root by ICANN after a decade of legal disputes, with registration expected to open in late 2026. Verisign, the largest domain registry operator, will manage .web, which should mitigate…
SecurityOnline -
Chrome gains dynamic updates on Mac, but needs all windows closed
Google is implementing dynamic patching technology for Chrome, allowing automatic updates without a full browser restart. This system updates background sub-processes, such as renderer and GPU processes, while users remain online. Currently, this feature is…
SecurityOnline -
Fedora 46 Enables Shadow Stack Protection to Thwart ROP Attacks
Fedora plans to enable shadow stack protection by default in version 46, targeting 64-bit x86 systems to enhance security against return-oriented programming (ROP) attacks. This feature was originally intended for Fedora 45 but was delayed due to…
SecurityOnline -
ISC Stormcast August 2026: Green threat level, SANS tools shared
The ISC Stormcast for August 3rd, 2026, hosted by Brad Duncan, discusses the current threat level, which is green. The page provides links to related resources, including educational opportunities offered by Dr. Johannes Ullrich at SANS, and invites users to…
SANS ISC -
Attackers Exploit VMware, WordPress Zero Days in New CVE Wave
Between July 27 and August 2, 2026, the CVE WATCHTOWER reported 2,077 new vulnerabilities, with 273 classified as Critical and 624 as High. Notably, 14 vulnerabilities scored a maximum CVSS of 10.0. The most impacted vendor was Google, followed by WordPress…
-
TPLink fixes CVE-2026-12935 bug in TLWR940N routers
TP-Link has released a patch for a critical vulnerability in the TL-WR940N router, identified as CVE-2026-12935, which allows unauthenticated remote code execution via a stack buffer overflow in the RTSP connection tracking module. The vulnerability has a…
-
Critical SQLi Bug in Weidmüller PROCONWEB SCADA Threatens OT
A critical SQL injection vulnerability, tracked as CVE-2026-16462, has been identified in Weidmueller's PROCON-WEB SCADA software, scoring 9.8 on the CVSS scale. This flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands via an…
