News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 20 so far |
Articles per day
The last 14 days and today so far (UTC)Dashed line: average of the 14 complete days. Totals above each bar.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 12 Oct | 56 | 6 |
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Today, Mon 26 Oct | 20 so far | 1 |
Fri 21 Aug· 72 articles
-
Cloudflare launches Bot Preference Sync for AI traffic control
Cloudflare has introduced a new feature called **Bot Preference Sync** to help website owners manage their bot traffic preferences more efficiently. This feature automatically updates a site's robots.txt file to reflect the configured preferences for AI bot…
Cloudflare -
Developers Face Rising Supply Chain Threats Targeting Code Tools
The article from Palo Alto Networks' Unit 42 discusses the increasing threats to the software development lifecycle (SDLC) supply chain, highlighting how attackers have shifted their focus from exploiting finished software to targeting the tools and code…
unit42.paloaltonetworks.com -
TSN protocol flaws risk industrial control systems security
This article discusses the security risks associated with Time-Sensitive Networking (TSN) protocols in Operational Technology (OT) environments, highlighting vulnerabilities that could allow attackers to manipulate industrial processes. Key insights include:…
Dark Reading -
Trojan npm packages deliver RedC2 4.0 Linux backdoor to devs
The article discusses the emergence of 14 Trojanized npm packages that install the RedC2 4.0 Linux backdoor, highlighting concerns about malware's increasing sophistication and the role of AI in command-and-control (C2) systems. It underscores the importance…
The Hacker News -
Expired Visa Cards Still Work After Date Tampering, Study Finds
Researchers from UMass Amherst have demonstrated that expired Visa contactless credit cards can still make valid purchases by exploiting a vulnerability in Visa's EMV payment protocol. The study, presented at USENIX Security 2026, reveals that a…
Security Affairs -
CISA Adds High Zimbra SMTP Flaw CVE‑2026‑73570 to Exploit List
CISA has added CVE-2026-73570 to its Known Exploited Vulnerabilities catalogue. The flaw affects Synacor’s Zimbra Collaboration Suite (ZCS) and is an OS command injection vulnerability that allows an unauthenticated attacker to execute arbitrary operating…
-
CISA flags Entra ID flaw CVE‑2026‑69836 in KEV list
On 21 August 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2026‑69836 to its Known Exploited Vulnerabilities (KEV) catalogue. The flaw affects Microsoft Entra ID (formerly Azure Active Directory) and is named the Microsoft Entra…
-
OWASP Flags Top AI Skill Risks in New Security Blueprint
The Open Worldwide Application Security Project (OWASP) has launched a new top 10 security list for AI skills, highlighting the risks associated with 'Malicious Skills' and 'Supply Chain Compromise' at the forefront. A recent incident demonstrated…
Dark Reading -
Critical SPIP flaw CVE-2026-77806 lets hackers run code remotely
The page discusses a critical security vulnerability identified as CVE-2026-77806, which affects the SPIP content management system (CMS). This unauthenticated remote code execution (RCE) vulnerability has a CVSS score of 9.8, indicating its severity. It…
-
VMware fixes high severity Spring flaws after August 2026 alert
VMware disclosed four high severity vulnerabilities in Spring frameworks affecting Spring Data REST and Spring AI on August 20, 2026. These vulnerabilities include a JSON Patch Property Mutation allowing privilege escalation, a session exhaustion flaw…
-
Router flaw lets attackers bypass authentication via UPnP
A critical vulnerability (CVE-2026-75501) has been identified in the Calix GS7 XGS GS5239XG router, related to missing authentication in its UPnP service. This flaw allows remote attackers to access the router's critical functions without authentication,…
-
Troutman Pepper Locke Suffers Second Silent Ransom Attack
Troutman Pepper Locke (TPL), a prominent law firm with over 1,600 attorneys, has faced multiple data breaches attributed to the Silent Ransom Group (SRG). In April 2025, SRG conducted a physical intrusion leading to the compromise of TPL's data, though TPL…
DataBreachesLuna Moth -
Former NSA Chief Nakasone Starts Global Security Advisory Firm
Retired U.S. Army General Paul M. Nakasone has launched the Nakasone Group, a national security advisory firm focused on cybersecurity, geopolitical, and personal security risks. The firm aims to provide high-caliber security counsel to government leaders,…
SecurityWeek -
Pods WordPress flaw (CVE-2026-19598) lets attackers hijack sites
The content discusses a critical security vulnerability (CVE-2026-19598) in the Pods WordPress plugin, which allows unauthenticated attackers to escalate privileges and gain complete control over affected sites. This flaw has a high CVSS score of 9.8 and…
-
Apache CloudStack patches critical KVM RCE flaw CVE-2026-50112
The page discusses critical vulnerabilities detected in Apache CloudStack, particularly highlighting CVE-2026-50112, which allows for cross-tenant remote code execution on KVM hypervisor hosts. The recent releases, 4.20.3.1 and 4.22.1.1, address a total of…
-
Defender driver flaw lets attackers disable security at boot
The article discusses the vulnerabilities in Microsoft Defender's driver that can be exploited by attackers to remove security software during system boot. This raises significant concerns about endpoint security and threat detection protocols. It highlights…
The Hacker News -
Silver Fox malware network adapts, uses cloud to launch attacks
The article discusses ongoing activities of the Silver Fox malware delivery network, known for targeting Chinese-speaking users with typo-squatted domains and malware designed to imitate trusted software. Even after the arrest of several operators in June…
dti.domaintools.comVoid Arachne -
Android Car Malware Hijacks Updates for Ad Fraud, Proxy Botnets
The article discusses the rise of a new Android car malware that exploits built-in software updaters to engage in ad fraud and build proxy botnets. The malware spreads through legitimate update processes, compromising vehicle systems and potentially leading…
The Hacker News -
CISA warns agencies as Ray flaw lets attackers inject code
The SecurityWeek news roundup covers significant developments in cybersecurity, focusing on various vulnerabilities and incidents: 1. **CISA and Ray Vulnerability**: CISA alerts federal agencies about a critical code injection vulnerability in Ray-Project…
SecurityWeek -
Cryptographic Context Injection Threat Hits Grok and Gemini AI
Researchers at Adversa AI revealed a new attack method called "Cryptographic Context Injection," which poses a significant threat to AI systems like xAI's Grok and Google’s Gemini. The technique involves delivering an encrypted payload to manipulate the AI…
SecurityWeek -
New Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
The article discusses iAuthFlow V2, a sophisticated phishing toolkit offering persistent access to victims' accounts, even after password resets. Sold for $10,000, it operates by tricking victims into entering credentials on attacker-controlled pages, while…
SecurityWeek -
Visa Zombie Card Bug Allows Expired Cards to Work Contactless
The article discusses the potential security risk of using expired Visa credit cards, termed "Zombie Cards," which can still be used for purchases due to a flaw in contactless payment systems. Researchers from the University of Massachusetts Amherst…
Malwarebytes -
IBM issues patches for critical CVEs in AIX and PowerVM VIOS
IBM has released security patches for a series of vulnerabilities in IBM AIX and PowerVM VIOS, published on August 15, 2026. The patch addresses seven critical CVEs, including three command injection flaws and multiple memory-related bugs, all with CVSS…
SecurityOnline -
Housing Authority Loses £1M as Cybercriminals Evade Detection
The article by Darshan Tiwari emphasizes the urgent need for cybersecurity professionals to support local government agencies, particularly those with limited budgets. It recounts an instance where a local housing authority lost nearly a million dollars to…
Dark Reading -
Local exploit found in uutils stdbuf tool via LD_PRELOAD handling
A critical vulnerability has been identified in the uutils coreutils stdbuf tool, allowing local users on shared systems to execute arbitrary code due to its handling of the LD_PRELOAD environment variable. The stdbuf tool creates a world-writable library,…
SecurityOnline -
OpenAI boosts AI model defences after Hugging Face breach
OpenAI has introduced new security controls following a breach involving its AI models at Hugging Face. These changes are designed to enhance safeguards against potential cybersecurity risks associated with advanced AI capabilities. The measures include a…
Dark Reading -
RDK-B WebUI Vulnerabilities Let Attackers Bypass Login
The content outlines critical security vulnerabilities in the RDK-B WebUI, with five flaws disclosed by CERT/CC on August 19, 2026. The most severe vulnerability, CVE-2026-19505, allows unauthenticated remote attackers to bypass login and gain admin control…
-
NYPD issues alert over video call scam posing as AmEx and police
Eddie received a call from a scammer posing as an American Express employee, claiming his identity was involved in a fraudulent firearm purchase. After being transferred through what seemed like legitimate NYPD officers, Eddie was convinced of their…
DataBreaches -
North Korean Hackers Exploit Crates.io to Infect Rust Builds
A recent supply chain attack linked to North Korean hackers impacted the Rust programming ecosystem, specifically targeting the official Rust package registry, crates.io. The attack exploited a compromised maintainer's account to embed backdoors in popular…
Infosecurity -
Cisco patches critical flaws in Crosswork and Secure Workload
Cisco has released security patches addressing nine critical vulnerabilities discovered during internal testing, including six rated with a maximum CVSS score of 10.0. These vulnerabilities impact various products within Cisco's Crosswork and Secure Workload…
Security Affairs -
Node.js isolated VM bug lets attackers run code remotely
A critical vulnerability has been found in the isolated-vm library of Node.js, which allows for a type confusion that can lead to remote code execution (RCE) on host systems. This vulnerability stems from the ExternalCopy function that transfers data across…
SecurityWeek -
AI Agents Overstep: Bailment Doctrine and
The page discusses the doctrine of bailment in the context of AI and data security as highlighted by a legal commentary from Jake L. Ramsey of Offit Kurman, following a presentation by OpenAI engineers about the Hugging Face incident. The engineers noted…
DataBreaches -
Agent Tesla v4 Uses Emoji Obfuscation to Steal Credentials
A new variant of the Agent Tesla malware, identified as version 4, features enhanced evasion capabilities specifically designed to steal credentials without detection. This malware utilizes innovative obfuscation techniques, including embedding Unicode emoji…
Infosecurity -
CareCloud breach exposes 3.75M patients' personal, medical data
The CareCloud data breach, one of the largest in healthcare this year, impacted over 3.75 million individuals. Unauthorized access occurred between March 10 and March 16, 2026, revealing sensitive data, including names, Social Security numbers, medical…
Malwarebytes -
Wazuh Boosts SOC Efficiency with AI Powered Threat Detection
The article discusses the integration of Wazuh and artificial intelligence (AI) to enhance Security Operations Center (SOC) workflows. It highlights the benefits of using AI to automate and improve threat detection, incident response, and overall efficiency…
The Hacker News -
Russian State Hackers Use OAuth Phishing to Target Diplomats
Google's Threat Intelligence Group has identified three Russian-linked cyber espionage clusters—UNC6293, UNC7005, and UNC5976—that target researchers, diplomats, and defense personnel. They exploit legitimate authentication tools through phishing and social…
Security AffairsUNC6293 -
Cisco Patches Nine Vulnerabilities, Five Critical in Crosswork
Cisco has released patches for nine vulnerabilities affecting its Crosswork and Secure Workload platforms, with five of these vulnerabilities rated CVSS 10.0, indicating critical severity. The updates aim to enhance security against potential exploits that…
The Hacker News -
GitLab GraphQL Vulnerability CVE-2026-19478 Actively Exploited
GitLab has reported an active exploitation of a critical GraphQL vulnerability identified as CVE-2026-19478, which has a high CVSS score of 9.4. This flaw allows unauthenticated attackers to remotely modify or delete public projects and user data. Following…
-
Over 64,000 AWS keys leaked in public repositories
Security researchers have detected significant leaks of corporate AWS access keys and credentials, affecting over 9,900 AWS accounts, including 768 corporate environments. A total of 64,024 AWS access key pairs were identified, with 10,625 being root account…
SecurityOnline -
North Korean hackers breach Rust supply chain via crate arrayref
A new supply chain attack linked to North Korean hackers targeted the Rust programming ecosystem, specifically a popular crate called 'arrayref.' The malicious version, 'arrayref@0.3.10,' was published from the original maintainer's account on August 20,…
SecurityWeekSTARDUST CHOLLIMA
