News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Tue 8 Sep· 28 articles
-
US Agencies Warn China Firms Are Scraping Frontier AI Models
Federal security agencies in the United States warned on 9 September 2026 of a coordinated foreign campaign targeting American frontier AI models. The joint advisory from CISA, NSA and the FBI states that China-based firms including DeepSeek, Moonshot AI,…
SecurityOnline -
Microsoft Patches Two Windows Zero Days Exploited in Attacks
Microsoft’s September 2026 Patch Tuesday fixes 996 vulnerabilities, but two zero-day flaws had already been exploited in the wild. Both are Windows elevation-of-privilege issues that allow attackers to gain higher access after already compromising a…
-
Fortinet Patches Flaws Let Attackers Bypass Auth and Reroute Traffic
Fortinet has disclosed three high-severity vulnerabilities affecting FortiMonitor OnSight, FortiSandbox, and FortiPAM, potentially allowing unauthorized access to sensitive corporate data and internal systems. The FortiMonitor flaw involves a static key…
-
Microsoft Targets Faster Windows 11 Performance on 8GB PCs
Microsoft has indicated further refinements to Windows 11 aimed at devices with 8GB of RAM, spotlighting improvements to memory usage, faster boot times, and quicker Windows Hello responses. Speaking at IFA 2026, Mark Linton, VP of the Operating System and…
SecurityOnline -
Ivanti Patches Flaws That Could Grant Attackers Admin Access
Ivanti has issued security patches for two high‑severity vulnerabilities affecting its Sentry and Endpoint Manager Mobile (EPMM) products. The flaws, CVE-2026-83527 in Sentry and CVE-2026-18851 in EPMM, could allow remote attackers to obtain administrative…
-
PyPI CDN Bugs Disrupted Python Builds With Weeks of Download Errors
Over roughly two weeks in August 2026, developers experienced intermittent 502 and 503 errors when pip attempted to download packages from files.pythonhosted[.]org, causing builds across many Python projects to fail. The incident was clarified in an official…
SecurityOnline -
Broadcom Removes VMware VDDK Downloads, Disrupting Enterprise Migrations
Broadcom has abruptly removed the public download pages for the Virtual Disk Development Kit (VDDK), causing 404s or inaccessible links for VDDK 8.x and 9.x. The toolkit is a critical dependency for many VMware migration and backup utilities, and the change…
SecurityOnline -
Unpatched ONLYOFFICE ownCloud Flaw Enables Internal Network Scanning
A reported vulnerability in the ONLYOFFICE ownCloud integration plugin has been identified as a critical Server-Side Request Forgery (SSRF) flaw. The issue affects version 9.12 of the integration plugin and is tracked as CVE-2026-84282. At the time of…
-
Ivanti ITSM Flaws Expose On-Premise Systems to Remote Code Execution
Ivanti Neurons for ITSM owners face eight reported vulnerabilities, including five rated critical with CVSS scores up to 9.9. Three of the flaws allow unauthenticated remote code execution, while three are authenticated deserialisation issues and three more…
-
WeWorm Exploited WeChat Calls to Hijack Accounts Without Answering
SecurityOnline[.]info reports Calif Security researchers have unveiled WeWorm, described as the first zero-click worm capable of propagating through WeChat voice calls on both iOS and Android. The attack requires no user interaction beyond an incoming call;…
SecurityOnline -
Outsider Phishing Kit Resurfaces After Global Law Enforcement Takedown
The Outsider Phishing Kit, a PhaaS platform linked to the threat actor “ChenLun,” has again demonstrated its reach despite a high-profile law-enforcement disruption. Researchers describe a sizeable operation that used smishing to lure mobile users to fake…
SecurityOnlineChenLun -
Reflectiz Unveils AI Pentesting Platform for Wider Web Coverage
Reflectiz has unveiled a new agentic pentesting platform for websites, pitched as delivering up to ten times more coverage than traditional pentests. The approach uses a coordinated team of specialised AI agents that start from a live, existing model of each…
SecurityOnline -
Phantom Deal Scam Posed as Executives to Steal €626,735.45
Cybersecurity researchers at Gen Digital have uncovered an executive impersonation scam dubbed the Phantom Deal campaign. The operation targeted corporate legal, finance, and M&A executives by posing as company leaders and trusted advisers to manufacture a…
SecurityOnline -
SAP Patches Critical EPP Flaw Exposing Systems to Memory Corruption
On 8 September 2026 SAP released 19 security notes and one update as part of its monthly Patch Day, addressing several high‑severity flaws across Extended Passport Processing, NetWeaver, and Cloud Application Programming. The advisory flags five CVEs in…
-
Microsoft Teams Phishing Attack Uses Node.js Implant to Reach Domain Controllers
Microsoft Teams is being abused in a phishing-driven intrusion campaign in which an actor poses as internal IT support in external tenant messages or calls. Victims grant a remote session, after which a silent MSI installer is delivered and executed,…
SecurityOnline -
Chinese Hackers Hijack Brazilian Government Sites to Push Betting Scams
Security researchers have traced a broad operation, attributed with medium-to-high confidence to Gambling Goblin, a Chinese-speaking actor linked to Earth Berberoka, that target Brazilian federal, state and municipal government websites. The campaign begins…
SecurityOnlineGambling Goblin -
ASUS Fixes Flaw Letting Nearby Users Control Active Sessions
ASUS has released security updates for Control Center Express and Armoury Crate on 8 September 2026 to fix a range of flaws. The most serious is CVE-2026-19397, a missing-authentication vulnerability in the Control Center Express Agent that could allow an…
-
Linux Kernel Flaw Lets Local Users Gain Root Through RDS PoC
Security researchers have publicly disclosed a high‑severity local privilege escalation in the Linux kernel, tracked as CVE-2026-43502, arising from the RDS network protocol’s zerocopy send path. The flaw, nicknamed ZcopyReaper, allows an unprivileged local…
-
Liquid Network Hack Drains $320 Million as Attacker Returns Bitcoin
The Liquid Network, a Bitcoin sidechain, suffered a major security incident that led to a full suspension of its services. An attacker, presenting as a white-hat researcher, exploited a fundamental flaw in the network’s software and illicitly moved 4,000…
SecurityOnline -
Windows 11 Tests an iOS-Style Widget for Connected Device Batteries
Microsoft is piloting a new battery and peripheral widget for Windows 11, uncovered in a preview build and reported by outlets citing a Discord user. The feature, still in development, is expected to provide a consolidated view of power levels and connection…
SecurityOnline -
Pegasus Zero Click Attack Targets Serbian Student Activist Before Election
Citizen Lab and the SHARE Foundation confirmed a Pegasus spyware infection on the iPhone of a Serbian student activist, detected following an Apple Threat Notification in early September 2026. The interview and forensic work indicate the Pegasus deployment…
SecurityOnline -
SonicWall SMA Flaws Let Attackers Gain Root Access in the Wild
Two newly disclosed vulnerabilities in SonicWall SMA 1000 devices are reported to be exploited in the wild, enabling attackers to chain three flaws for remote code execution. The security write-up identifies two CVEs, CVE-2026-83548 and CVE-2026-83549, both…
-
JetBrains Patches Critical Hub and YouTrack Flaws Enabling Takeover
JetBrains has disclosed a batch of 29 security flaws across its Hub and YouTrack offerings, together with related issues in accompanying tooling. The round-up lists six CVEs across the affected products, with two rated as critical. CVSS v3 scores for the…
-
Attackers Abuse Node.js to Evade Defences and Plant Ransomware Footholds
Attackers are exploiting the Node[.]js runtime to slip past endpoint defenses across global corporate networks, with multiple campaigns observed since February 2026. The Symantec Threat Hunter Team and Zscaler outline that technology firms, hotels and…
SecurityOnline -
Rclone Flaws Let Attackers Bypass Auth and Access Cloud Data
Two critical vulnerabilities have been disclosed in Rclone that together enable a complete auth proxy bypass, potentially letting unauthenticated users read, modify, or delete data across connected cloud backends. Public PoC details accompany two separate…
SecurityOnline -
Windows HTTP.sys Flaw Enables SYSTEM Access with Public PoC
Security researchers have disclosed full technical details and a proof‑of‑concept for CVE-2026-62735, a Windows HTTP[.]sys elevation of privilege flaw that scores 7.8 on CVSS v3. The vulnerability centres on an integer overflow in…
-
Python NodeStealer Evolves Into Spyware Targeting Facebook Users
Netskope Threat Labs has documented a major upgrade to the Python NodeStealer infostealer, which has evolved into a full spyware platform as of August 2026. The Facebook-focused malware now collects keystrokes, monitors the clipboard and takes screenshots,…
SecurityOnline -
Adobe Magento Flaw Enables Unauthenticated Code Execution in Attacks
Adobe has released an emergency hotfix for a critical flaw in Adobe Commerce and Magento, tracked as CVE-2026-75650, with a CVSS score of 10.0. The vulnerability, also known by researchers as StyleSmuggler, enables unauthenticated attackers to achieve…
