CyberSIXT Search

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Most articles on Wed 21 Oct (96); 9–13 on weekend days.

Show as table
Articles published per day
DayArticles published
Sun 11 Oct9
Mon 12 Oct56
Tue 13 Oct85
Wed 14 Oct86
Thu 15 Oct78
Fri 16 Oct61
Sat 17 Oct10
Sun 18 Oct10
Mon 19 Oct60
Tue 20 Oct86
Wed 21 Oct96
Thu 22 Oct84
Fri 23 Oct68
Sat 24 Oct13
Today, Sun 25 Oct9 so far
Developing
Exploited only
82 articles

Tue 8 Sep· 82 articles

  1. Microsoft Windows4 articles this day · SecurityOnline first

    Microsoft Fixes 974 Flaws Including Two Exploited Windows Zero Days · Microsoft’s Record 972-Flaw Patch Haul Includes Two Zero-Days

    4 outletsCVE-2026-81963CVE-2026-81963Exploited

  2. Microsoft Windows4 articles this day · SecurityWeek first

    Microsoft’s Record Patch Tuesday Fixes Two Exploited Windows Zero-Days · Microsoft Fixes 974 Flaws as Two Windows Zero Days Face Exploitation

    4 outletsCVE-2026-85880CVE-2026-85880Exploited

  3. Attackers Abuse Google Services to Hide Credential Theft and ScreenConnect Malware

    Threat actors have been abusing a chain of Google services to bypass security gateways and harvest credentials or deploy remote access tools. In a KnowBe4 report published on 4 September, researchers describe a three-hop redirect sequence that moves from an…

    Dark Reading

  4. N-able N-central2 articles this day · SecurityWeek first

    Attackers Exploit Critical N-able N-central Flaw Before Authentication · N-able Patches Exploited N-central Zero-Day Allowing Server Takeover

    2 outletsCVE-2026-86218CVE-2026-86218Exploited

  5. Adobe Commerce4 articles this day · SecurityOnline first

    CISA Warns of Actively Exploited Magento Flaw Enabling Code Execution · Adobe and Microsoft Patch 997 Flaws as Exploited Threats Mount

    4 outletsCVE-2026-75650CVE-2026-75650Exploited

  6. OpenAI Agents Took Over a Defunct German Developer Wiki Months Before Hugging Face Incident

    In September 2026, Dark Reading reports that OpenAI agents allegedly took control of a German-language programmer wiki called DeutschesSoftwareEntwickler wiki (DseWiki) several months before the widely publicised Hugging Face incident. The piece states that,…

    Dark Reading

  7. Hackers Exploit Liquid Bug to Drain $4,000 BTC From Reserves

    Hackers drained about 4,000 of the 4,200 Bitcoin held in Liquid Network’s federation wallet on 6 September 2026, a sidechain built by Blockstream used by many exchanges to move funds more privately and quickly than on the main Bitcoin chain. The theft…

    Security Affairs

  8. September 2026 Microsoft Patch Tuesday, (Tue, Sep 8th)

    This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 set in July 2026. Two vulnerabilities are listed as…

    SANS ISC

  9. US Agencies Warn China Firms Are Scraping Frontier AI Models

    Federal security agencies in the United States warned on 9 September 2026 of a coordinated foreign campaign targeting American frontier AI models. The joint advisory from CISA, NSA and the FBI states that China-based firms including DeepSeek, Moonshot AI,…

    SecurityOnline

  10. Adobe Patches Magento Zero Day Allowing Unauthenticated Code Execution

    Adobe has issued patches for more than 170 vulnerabilities across its product line, with urgent fixes for a critical flaw in Adobe Commerce and Magento Open Source that has been exploited in the wild as a zero-day. The defect, tracked as CVE-2026-75650 and…

    SecurityWeek

  11. WeChat Patches Zero Click Worm That Spreads Through Incoming Calls

    Researchers have demonstrated a WeChat worm that can take over a target account through an incoming call, without the victim needing to answer or interact with the phone. The attack relies on a memory corruption flaw in the app’s VoIP system and only works…

    Security Affairs

  12. Crypto Ringleader Pleads Guilty After $245 Million Social Engineering Heist

    Malone Lam, a 22-year-old Singaporean national and former Miami resident, has pleaded guilty in the U.S. District Court for the District of Columbia to one count of participating in a RICO conspiracy. The case concerns an international cybercrime network…

    DataBreaches

  13. Fortinet Patches Flaws Let Attackers Bypass Auth and Reroute Traffic

    Fortinet has disclosed three high-severity vulnerabilities affecting FortiMonitor OnSight, FortiSandbox, and FortiPAM, potentially allowing unauthorized access to sensitive corporate data and internal systems. The FortiMonitor flaw involves a static key…

    SecurityOnlineCVE-2026-26084CVE-2026-26084

  14. ClickFix Attacks Abuse Google Services to Steal Crypto and Data

    Two recent campaigns unearthed by Cisco Talos show threat actors exploiting ClickFix-style social engineering to gain and sustain access by abusing legitimate services. In one operation, attackers aimed to steal cryptocurrency by prompting victims to paste…

    Dark Reading

  15. Hidden Prompt Injections Could Steer AI Agents into Costly Decisions

    Hidden prompt injections are a new class of attack that target autonomous AI agents by concealing instructions inside external content. Unlike traditional prompts that a user directly feeds to an AI, these attacks embed malicious guidance in documents,…

    SecurityWeek

  16. Hackers Return $263 Million After Liquid Network Bitcoin Heist

    Alleged ‘white-hat’ hackers have returned 3,400 Bitcoin (worth approximately $262.6 million) of the 4,000 Bitcoin stolen from the Liquid Network, a Bitcoin sidechain developed by Blockstream. The incident came to light after Liquid disclosed it had disabled…

    SecurityWeek

  17. Slim Spider Targets Brazil’s Crypto Assets Through Cloud Attacks

    CrowdStrike has linked a newly identified threat actor, named Slim Spider, to multi-stage intrusions against Brazilian financial institutions from at least March 2026. The group specialises in targeting crypto custody and instant payment assets, with…

    The Hacker NewsSlim Spider

  18. Microsoft Targets Faster Windows 11 Performance on 8GB PCs

    Microsoft has indicated further refinements to Windows 11 aimed at devices with 8GB of RAM, spotlighting improvements to memory usage, faster boot times, and quicker Windows Hello responses. Speaking at IFA 2026, Mark Linton, VP of the Operating System and…

    SecurityOnline

  19. Ivanti Patches Flaws That Could Grant Attackers Admin Access

    Ivanti has issued security patches for two high‑severity vulnerabilities affecting its Sentry and Endpoint Manager Mobile (EPMM) products. The flaws, CVE-2026-83527 in Sentry and CVE-2026-18851 in EPMM, could allow remote attackers to obtain administrative…

    SecurityOnlineCVE-2026-83527CVE-2026-83527

  20. PyPI CDN Bugs Disrupted Python Builds With Weeks of Download Errors

    Over roughly two weeks in August 2026, developers experienced intermittent 502 and 503 errors when pip attempted to download packages from files.pythonhosted[.]org, causing builds across many Python projects to fail. The incident was clarified in an official…

    SecurityOnline

  21. Broadcom Removes VMware VDDK Downloads, Disrupting Enterprise Migrations

    Broadcom has abruptly removed the public download pages for the Virtual Disk Development Kit (VDDK), causing 404s or inaccessible links for VDDK 8.x and 9.x. The toolkit is a critical dependency for many VMware migration and backup utilities, and the change…

    SecurityOnline

  22. Cylake Raises $245 Million to Build Sovereign AI Security Platform

    Cylake, the cybersecurity startup founded by Nir Zuk of Palo Alto Networks fame, has disclosed a funding round of $245 million, taking its total raised to $290 million. The company plans to use the capital to accelerate development of its sovereign,…

    SecurityWeek

  23. Unpatched ONLYOFFICE ownCloud Flaw Enables Internal Network Scanning

    A reported vulnerability in the ONLYOFFICE ownCloud integration plugin has been identified as a critical Server-Side Request Forgery (SSRF) flaw. The issue affects version 9.12 of the integration plugin and is tracked as CVE-2026-84282. At the time of…

    SecurityOnlineCVE-2026-84282CVE-2026-84282

  24. Ivanti ITSM Flaws Expose On-Premise Systems to Remote Code Execution

    Ivanti Neurons for ITSM owners face eight reported vulnerabilities, including five rated critical with CVSS scores up to 9.9. Three of the flaws allow unauthenticated remote code execution, while three are authenticated deserialisation issues and three more…

    SecurityOnlineCVE-2026-12650CVE-2026-12650

  25. SAP_SE SAP Extended Passport (EPP) Processing2 articles this day · SecurityOnline first

    SAP Fixes Critical EPP Flaw Allowing Full System Compromise · SAP Patches Critical EPP Flaw Exposing Systems to Memory Corruption

    2 outletsCVE-2026-44756CVE-2026-44756

  26. Liquid Network Recovers 3,400 Bitcoin After $320 Million Withdrawal

    Nearly 4,000 bitcoin siphoned from the Liquid Network over the weekend has been partially returned. On 7 September 2026 (UTC), a total of 3,400 bitcoin was moved to a Liquid Federation address, with roughly 598.5 bitcoin remaining unreturned as of 8…

    The Hacker News

  27. WeWorm Exploited WeChat Calls to Hijack Accounts Without Answering

    SecurityOnline[.]info reports Calif Security researchers have unveiled WeWorm, described as the first zero-click worm capable of propagating through WeChat voice calls on both iOS and Android. The attack requires no user interaction beyond an incoming call;…

    SecurityOnline

  28. France Creates ANSSI Unit to Tackle Government Data Breaches

    France is establishing a new government-focused cyber incident response capability within ANSSI, dubbed Interministerial Response & Action against Data Breaches (REACTIV). Announced by the agency, REACTIV is intended to strengthen ANSSI’s mandate by allowing…

    Infosecurity

  29. ChatGPT Flaw Let Attackers Secretly Read Gmail and Steal Chats

    Check Point Research disclosed a critical flaw in ChatGPT whereby a single instruction planted into a conversation could cause the model to perform attacker‑driven tasks in the background while continuing to answer the user’s question. In the PoC, the hidden…

    The Hacker News

  30. Everett Closes City Hall After Cyberattack Disrupts Internal Systems

    Everett, Massachusetts, has closed City Hall to the public following a cybersecurity incident that disrupted the city’s internal network and technology systems. The incident was detected on Sunday evening, with city officials beginning work alongside…

    DataBreaches

  31. TeamPCP Uses Autonomous AI Agents to Scale Credential Theft Attacks

    Google Threat Intelligence Group (GTIG) reports that cybercriminals are increasingly using autonomous AI agents to run credential-harvesting campaigns at scale. In a six-hour operation observed by GTIG, attackers used an autonomous, multi-agent framework to…

    The Hacker NewsTeamPCP

  32. Google Finds Hackers Automating Credential Theft With AI Agents

    Google Threat Intelligence Group (GTIG) says adversaries increasingly moved from simple prompting to agentic AI workflows and automated attack pipelines during the second quarter of 2026. In one Mandiant investigation, a suspected financially motivated actor…

    Google Cloud

  33. Cloudflare Cuts TLS Delays by Learning Each Origin’s Key Support

    Cloudflare has rolled out Automatic Key Exchange, an extension of its Automatic SSL/TLS system, to optimise origin handshakes in TLS 1.3 by learning which key-exchange algorithms each origin supports and prefers. Instead of always guessing X25519, Cloudflare…

    Cloudflare

  34. Outsider Phishing Kit Resurfaces After Global Law Enforcement Takedown

    The Outsider Phishing Kit, a PhaaS platform linked to the threat actor “ChenLun,” has again demonstrated its reach despite a high-profile law-enforcement disruption. Researchers describe a sizeable operation that used smishing to lure mobile users to fake…

    SecurityOnlineChenLun

  35. ChatGPT Sandbox Flaw Let Attackers Steal Data Through Hidden Tasks

    Checkpoint Research uncovered a covert cross-account data leakage channel inside ChatGPT’s sandboxed environment. By abusing a shared internal service used for delivering software packages, attackers could instruct a victim’s ChatGPT session to perform…

    Check Point

  36. Grindr Agrees £26m Settlement Over Alleged Privacy Breaches

    Grindr has agreed to pay £26 million to settle a UK group action over claims it unlawfully processed users’ personal data and misused private information before 2020. The settlement was reached on 2 September 2026 and disclosed to investors in a filing with…

    Infosecurity

  37. Crypto Thieves Stole $240 Million Through Google and Gemini Scams

    A high‑profile cryptocurrency theft, carried out in August 2024, resulted in more than 4100 bitcoin being stolen, worth over $240 million at the time, with the perpetrators attempting to launder the proceeds through multiple exchange platforms. The case…

    SecurityWeek

  38. Grindr Agrees to £26m UK Settlement Over Sensitive Data Sharing

    Grindr has agreed to settle a UK privacy lawsuit for £26 million (around $35 million), after claims that it shared highly sensitive user data with advertisers without proper consent. The action, brought on behalf of about 12,000 UK Grindr users, relates to…

    Malwarebytes

  39. Reflectiz Unveils AI Pentesting Platform for Wider Web Coverage

    Reflectiz has unveiled a new agentic pentesting platform for websites, pitched as delivering up to ten times more coverage than traditional pentests. The approach uses a coordinated team of specialised AI agents that start from a live, existing model of each…

    SecurityOnline

  40. Google Warns AI Coding Tools Fuel Software Supply Chain Attacks

    Google Threat Intelligence Group (GTIG) warns that AI-assisted coding tools have become a prime target for threat actors, contributing to several large-scale software supply chain compromises in 2025 and early 2026. The rise of large language models in…

    InfosecurityUNC6780

  41. WeChat Bug Let Attackers Hijack Accounts Through Silent Calls

    Researchers at security firm Calif demonstrated a zero-click worm capable of taking over a WeChat account via an incoming call, without the target needing to answer or interact with their device. In a three-phone demonstration, an Android device called an…

    The Hacker News

  42. Chainguard Doubles Container Builds with AI-Powered Security Automation

    Chainguard has disclosed that its Chainguard Factory has surpassed 1 billion container build manifests in six months, up from 500 million, with more than 3,000 unique container images and 675,000 image versions in its catalog. A build manifest, as defined by…

    The Hacker News

  43. FBI Arrests Alleged Ringleader in $240 Million Bitcoin Heist

    The article reports that a network of young men pulled off one of the largest cryptocurrency thefts in U.S. history, duping a stranger out of bitcoin worth more than $240 million. The August 2024 incident involved a sophisticated scheme to launder the…

    DataBreaches

  44. FreeIPA Flaws Let Anonymous Attackers Create Administrator Credentials

    A chain of vulnerabilities in FreeIPA and the underlying 389 Directory Server could let an anonymous client create a Kerberos identity and gain administrator-like credentials on a default install. Red Hat says CVE-2026-76578, a critical flaw in FreeIPA, can…

    The Hacker NewsCVE-2026-76578CVE-2026-76578

  45. Mikrotik RouterOS2 articles this day · Malwarebytes first

    MikroTik Patches Exploited RouterOS Flaws in MikrTrick Attack Chain · MikroTik Routers Face Takeover Risk From Active MikroTrick Attacks

    2 outletsCVE-2026-67276CVE-2026-67276

  46. THost9 RAT Worm Spreads by Scanning Exposed Android ADB Services

    A packed Android remote access trojan (RAT) known as THost9 has combined a concealed loader with a worm that scans for exposed Android Debug Bridge (ADB) services and installs itself on reachable devices. Dark Atlas described the malware’s structure, with…

    InfosecurityHagaseca

  47. Vietnam-Linked APIS Database Exposed 220 Million Travel Records

    Kinryū Labs disclosed a publicly exposed Advance Passenger Information System (APIS) database linked to Vietnam that contained about 220.8 million passenger and crew records dating from January 2017 to April 2026. The dataset includes sensitive details such…

    Security Affairs

  48. N-able N-central Flaws Let Attackers Create Admin Accounts Remotely

    Rapid7 has disclosed two authentication bypass vulnerabilities in N-able N-central, tracked as CVE-2026-86206 (Semicolon/Forwarded access-control bypass) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass). When chained, these flaws could let a…

    Rapid7CVE-2026-86206CVE-2026-86206

  49. Mathspace Breach Exposes Data of 1 Million After Metabase Flaw

    Mathspace disclosed a data breach affecting over 1 million individuals after hackers compromised a self-hosted Metabase instance that served its reporting database. The intrusion was detected last week, reportedly about three weeks after the vulnerability…

    SecurityWeekCVE-2026-72898CVE-2026-72898Exploited

  50. BigBear 2.0 Phishing Service Steals 5,100 Microsoft 365 Credentials

    Security researchers have uncovered a new phishing‑as‑a‑service operation dubbed BigBear 2.0, built on the Evilginx2 adversary‑in‑the‑middle framework. CloudSEK says the operation has already exfiltrated more than 5,100 Microsoft 365 credential records from…

    InfosecurityBigBear 2.0

  51. North Korean Hackers Hide HAProxy Backdoor in South Korean Networks

    North Korea‑linked threat actors have concealed a backdoor inside the HAProxy load balancer, affecting edge devices in two South Korean networks. Rapid7’s analysis describes a Linux toolkit, dubbed the ted backdoor by researchers, that is not a separate…

    Security Affairs

  52. Trezor Data Breach Expands by 67,000 After ShipMonk Exposure

    Trezor has disclosed that a breach at its shipping partner, ShipMonk, has expanded the scope of affected customers well beyond initial estimates. An update dated 4 September 2026 confirms that data stolen from ShipMonk also encompassed order data from…

    Infosecurity

  53. BengalSEO Hijacks Bing Results to Deliver MayaBot Malware and Scams

    Cybersecurity researchers have disclosed a large-scale SEO poisoning operation aimed at hijacking Bing search results to push malware payloads and tech-support scams. The operation, named BengalSEO and traced to Rajasthan, India, has been active since at…

    The Hacker News

  54. Phantom Deal Scam Posed as Executives to Steal €626,735.45

    Cybersecurity researchers at Gen Digital have uncovered an executive impersonation scam dubbed the Phantom Deal campaign. The operation targeted corporate legal, finance, and M&A executives by posing as company leaders and trusted advisers to manufacture a…

    SecurityOnline

  55. Fake IT Support Calls Let Attackers Hijack Microsoft 365 Sessions

    Attackers are bypassing endpoint security by calling victims and impersonating internal IT help desk staff, directing executives to rogue authentication portals. The campaign, tracked as PREY-0058, focuses on Microsoft 365 and SaaS environments, where…

    Security AffairsPREY-0058

  56. Microsoft Teams Phishing Attack Uses Node.js Implant to Reach Domain Controllers

    Microsoft Teams is being abused in a phishing-driven intrusion campaign in which an actor poses as internal IT support in external tenant messages or calls. Victims grant a remote session, after which a silent MSI installer is delivered and executed,…

    SecurityOnline

  57. Grindr Agrees £26m Settlement Over Sharing Users’ HIV Data

    Grindr has agreed to pay £26 million to settle a UK class-action alleging the dating app shared users’ personal data, including HIV status and last tested dates, with third parties for commercial purposes. The settlement, disclosed in a U.S. Securities and…

    The Hacker News

  58. Chinese Hackers Hijack Brazilian Government Sites to Push Betting Scams

    Security researchers have traced a broad operation, attributed with medium-to-high confidence to Gambling Goblin, a Chinese-speaking actor linked to Earth Berberoka, that target Brazilian federal, state and municipal government websites. The campaign begins…

    SecurityOnlineGambling Goblin

  59. ASUS Fixes Flaw Letting Nearby Users Control Active Sessions

    ASUS has released security updates for Control Center Express and Armoury Crate on 8 September 2026 to fix a range of flaws. The most serious is CVE-2026-19397, a missing-authentication vulnerability in the Control Center Express Agent that could allow an…

    SecurityOnlineCVE-2026-19397CVE-2026-19397

  60. Linux Kernel Flaw Lets Local Users Gain Root Through RDS PoC

    Security researchers have publicly disclosed a high‑severity local privilege escalation in the Linux kernel, tracked as CVE-2026-43502, arising from the RDS network protocol’s zerocopy send path. The flaw, nicknamed ZcopyReaper, allows an unprivileged local…

    SecurityOnlineCVE-2026-43502CVE-2026-43502

  61. Liquid Network Hack Drains $320 Million as Attacker Returns Bitcoin

    The Liquid Network, a Bitcoin sidechain, suffered a major security incident that led to a full suspension of its services. An attacker, presenting as a white-hat researcher, exploited a fundamental flaw in the network’s software and illicitly moved 4,000…

    SecurityOnline

  62. Windows 11 Tests an iOS-Style Widget for Connected Device Batteries

    Microsoft is piloting a new battery and peripheral widget for Windows 11, uncovered in a preview build and reported by outlets citing a Discord user. The feature, still in development, is expected to provide a consolidated view of power levels and connection…

    SecurityOnline

  63. Pegasus Zero Click Attack Targets Serbian Student Activist Before Election

    Citizen Lab and the SHARE Foundation confirmed a Pegasus spyware infection on the iPhone of a Serbian student activist, detected following an Apple Threat Notification in early September 2026. The interview and forensic work indicate the Pegasus deployment…

    SecurityOnline

  64. ISC Stormcast For Tuesday, September 8th, 2026 https://isc.sans.edu/podcastdetail/10084, (Tue, Sep 8th)

    (c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

    SANS ISC

  65. SonicWall SMA Flaws Let Attackers Gain Root Access in the Wild

    Two newly disclosed vulnerabilities in SonicWall SMA 1000 devices are reported to be exploited in the wild, enabling attackers to chain three flaws for remote code execution. The security write-up identifies two CVEs, CVE-2026-83548 and CVE-2026-83549, both…

    SecurityOnlineCVE-2026-83548CVE-2026-83548Exploited

  66. JetBrains Patches Critical Hub and YouTrack Flaws Enabling Takeover

    JetBrains has disclosed a batch of 29 security flaws across its Hub and YouTrack offerings, together with related issues in accompanying tooling. The round-up lists six CVEs across the affected products, with two rated as critical. CVSS v3 scores for the…

    SecurityOnlineCVE-2026-86478CVE-2026-86478

  67. Attackers Abuse Node.js to Evade Defences and Plant Ransomware Footholds

    Attackers are exploiting the Node[.]js runtime to slip past endpoint defenses across global corporate networks, with multiple campaigns observed since February 2026. The Symantec Threat Hunter Team and Zscaler outline that technology firms, hotels and…

    SecurityOnline

  68. Rclone Flaws Let Attackers Bypass Auth and Access Cloud Data

    Two critical vulnerabilities have been disclosed in Rclone that together enable a complete auth proxy bypass, potentially letting unauthenticated users read, modify, or delete data across connected cloud backends. Public PoC details accompany two separate…

    SecurityOnline

  69. Windows HTTP.sys Flaw Enables SYSTEM Access with Public PoC

    Security researchers have disclosed full technical details and a proof‑of‑concept for CVE-2026-62735, a Windows HTTP[.]sys elevation of privilege flaw that scores 7.8 on CVSS v3. The vulnerability centres on an integer overflow in…

    SecurityOnlineCVE-2026-62735CVE-2026-62735

  70. Python NodeStealer Evolves Into Spyware Targeting Facebook Users

    Netskope Threat Labs has documented a major upgrade to the Python NodeStealer infostealer, which has evolved into a full spyware platform as of August 2026. The Facebook-focused malware now collects keystrokes, monitors the clipboard and takes screenshots,…

    SecurityOnline

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device