CyberSIXT Search

News

Every CyberSIXT summary, newest first, with a link to its story and to the original report.

Most articles on Wed 21 Oct (96); 9–13 on weekend days.

Show as table
Articles published per day
DayArticles published
Sun 11 Oct9
Mon 12 Oct56
Tue 13 Oct85
Wed 14 Oct86
Thu 15 Oct78
Fri 16 Oct61
Sat 17 Oct10
Sun 18 Oct10
Mon 19 Oct60
Tue 20 Oct86
Wed 21 Oct96
Thu 22 Oct84
Fri 23 Oct68
Sat 24 Oct13
Today, Sun 25 Oct8 so far
Developing
Exploited only
72 articles

Thu 10 Sep· 72 articles

  1. CISA Flags Actively Exploited MikroTik RouterOS Flaw Exposing Kernels

    CISA added CVE-2026-67277 to its Known Exploited Vulnerabilities (KEV) catalogue on 10 September 2026. The vulnerability affects MikroTik RouterOS and is a missing authentication for critical function issue in the btest service that can disclose kernel…

    CISACVE-2026-67277CVE-2026-67277Exploited

  2. CISA Flags Actively Exploited Critical MikroTik RouterOS Flaw

    CISA has added CVE-2026-86060 to its Known Exploited Vulnerabilities (KEV) catalogue. The vulnerability affects MikroTik RouterOS and involves improper neutralisation of argument delimiters in a command, allowing an attacker to alter the trusted RouterOS…

    CISACVE-2026-86060CVE-2026-86060Exploited

  3. Attackers Exploit Personal Phones to Steal Corporate Data via Graph API

    Initial access brokers are phishing employees by calling or texting their personal devices, then exploiting the Microsoft Graph API to perform large-scale corporate data exfiltration. The piece notes that BYOD is common in many organisations, and attackers…

    Dark ReadingStorm 3032

  4. Amazon Adds Mandiant Founder Kevin Mandia to Its Board of Directors

    Amazon has appointed Kevin Mandia to its board of directors, appointing a cybersecurity veteran with more than 30 years of public and private sector experience. Mandia was elected to the board on 8 September, with the announcement highlighting his track…

    SecurityWeek

  5. Fortinet Multiple Products3 articles this day · CISA first

    CISA Flags Four Actively Exploited Flaws Including Cisco Zero Day · Fortinet Flaw Exploited to Deploy PivotC2 RAT Across 178 Devices

    3 outletsCVE-2025-25249CVE-2025-25249Exploited

  6. Android Update Fixes Critical Wi-Fi Flaw Amid Rising Attack Risks

    ThreatsDay’s current bulletin aggregates a broad spectrum of security incidents and research highlights from the week, underscoring a common thread: the path of least resistance is often a familiar, trusted vector. The piece flags multiple notable cases,…

    The Hacker NewsCVE-2026-28662CVE-2026-28662

  7. AI-Assisted Invoice Scam Impersonates CEOs to Steal $50,000 Payments

    Threat actors are increasingly using AI-assisted techniques to impersonate executives and target accounts payable teams with invoice fraud. Microsoft’s analysis describes a recent campaign in which attackers registered lookalike domains, used third‑party…

    Microsoft

  8. August’s Cybersecurity M&A Wave Targets AI, Exposure and Fraud

    SecurityWeek reports that August 2026 saw 33 cybersecurity-related merger and acquisition announcements, spanning a mix of CTEM, AI security, data transfer, and cyber insurance to bolster strategic footprints. Among the standout deals, Brinqa announced the…

    SecurityWeek

  9. Microsoft Warns AI Brands Are Fueling a New Phishing Wave

    Microsoft warns that AI branding is being used as a lure to make phishing, malvertising and credential theft more believable. Threat intelligence from Microsoft Threat Intelligence identifies campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek and…

    Microsoft

  10. BlueMoon Exploit Kit Chains Chrome and Windows Flaws in Espionage Campaigns

    A new exploit kit named BlueMoon has emerged, exploiting Chrome and Windows flaws in quick succession and illustrating the risks of patch-timing in the wild. The campaign began with phishing emails that directed victims to a page designed to exploit two…

    Malwarebytes

  11. Microsoft Malware Protection Engine2 articles this day · SOCRadar first

    Windows Defender Patch Bypass Exposes SYSTEM Files to Attackers · Public ShieldCrash PoC Claims to Bypass Microsoft Defender Fix

    2 outletsCVE-2026-69414CVE-2026-69414

  12. AI Agents Are Outpacing Safeguards as Labs Race Towards Autonomy

    Jacob Coxon, a researcher with experience at OpenAI and Anthropic, resigned from Anthropic in early September 2026. He warned that AI labs are racing toward self-improving systems with safeguards lagging behind, creating a dangerous incentive structure where…

    Security Affairs

  13. Anthropic Researcher Quits, Warning AI Race Is Eroding Safety

    A researcher formerly connected with Anthropic has resigned, citing concerns that Anthropic and its major competitors are prioritising speed and competitive advantage in AI development over safety. The resignation, publicly aired via social media, follows…

    SecurityWeek

  14. Google Play Early Access Exploited to Push Deceptive Apps Without Reviews

    Security researchers have flagged abuse of Google Play’s Early Access programme, where rogue developers have pushed thousands of deceptive Android apps that promise cash rewards, casino winnings, or premium content. The campaign relies on Early Access apps…

    The Hacker News

  15. PuzzleMask Tricks LLM Gatekeepers Into Approving Hidden Malicious Prompts

    Checkpoint Research has unveiled PuzzleMask, a prompt-crafting technique that hides a payload inside plain prose to evade quick LLM policy checks. The researchers show that an attacker can embed a policy-violating instruction within a benign-looking wrapper,…

    Check Point

  16. NSA Recruit Who Became a Hacker-Turned-CEO Built Bishop Fox

    Vinnie Liu was recruited by the NSA at the age of 17 in 1999, starting as a full-time employee with an externally facing role in his second year. The interview traces a path from early curiosity and self-taught programming, through his time on the NSA’s red…

    SecurityWeek

  17. CISA Updates Insider Threat Guide for Remote Work and AI Risks

    CISA has refreshed its Insider Threat Mitigation Guide, issued on 9 September 2026, with new case studies, statistics and guidance addressing hybrid and remote working, artificial intelligence and adverse employee separations. First published in 2020, the…

    Infosecurity

  18. FTC Withdraws Obsolete Health App Breach Policy Statement

    The Federal Trade Commission has withdrawn its 2021 Policy Statement on Breaches by Health Apps and Other Connected Devices. The policy had sought to apply the FTC’s Health Breach Notification Rule to health apps and devices that collect consumer health…

    DataBreaches

  19. Google Play Early Access Apps Exploit Users With Fake Rewards

    Google Play’s Early Access programme is being abused by deceptive developers who exploit the lack of user reviews and public ratings to push users into external download routes. In this scam, apps are promoted via social media with promises of cash rewards,…

    SecurityWeek

  20. South Korea Raises Data Breach Fines to 10% of Revenue

    Korea’s privacy regulator is sharply increasing the penalties for data breaches, aiming to deter lax data protection by making non-compliance financially consequential. From now, companies found to have leaked the personal data of 10 million or more…

    DataBreaches

  21. McKesson Data Breach Exposes 6.4 Million After ShinyHunters Leak

    McKesson’s cyberattack, disclosed on 10 September 2026, is reported by Have I Been Pwned (HIBP) to have affected roughly 6.4 million individuals. HIBP’s assessment followed data leakage attributed to the serial extortion group ShinyHunters, which had earlier…

    DataBreachesShinyHunters

  22. Webinar Urges Tighter Governance as AI Accelerates Endpoint Remediation

    SecurityWeek and Automox are promoting a live, 20-minute webinar on Frontier Pace Governance, described as an operating model to keep pace with AI-enabled endpoint remediation. The session, dated 10 September 2026 (written as 10 September 2026 in UK format),…

    SecurityWeek

  23. Google Chromium V82 articles this day · Security Affairs first

    Chrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived · Chrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns

    2 outletsCVE-2026-85046CVE-2026-85046Exploited

  24. OpenMatter Names New CEO as It Shifts Focus to Global Growth

    OpenMatter Network has announced a strategic realignment of its leadership as it moves from its initial platform launch into a phase of global commercial growth. The Melbourne, Florida-based company said that, effective 1 September, Mike Anderson has taken…

    SecurityOnline

  25. Cloudflare Tests Post Quantum DNSSEC with Oversized Signatures

    Cloudflare’s 1.1.1[.]1 now validates DNSSEC signatures created with ML-DSA-44, a post-quantum signature algorithm standardised by NIST. This marks a first experimental step toward preparing DNSSEC for a future in which current signing schemes may no longer…

    Cloudflare

  26. MantaxOtax Android Malware Combines Ransomware With Deep Espionage

    MantaxOtax is a Android malware family that combines file-encryption ransomware with extensive spyware capabilities. The operators appear to have Indonesian origins, with Zimperium’s zLabs linking samples to Indonesian threat actors. Some campaigns…

    Infosecurity

  27. RedTail Linux Malware Hides Persistence Behind Fake PHP Processes

    Researchers analysing a RedTail Linux payload observed the attacker uploading a package containing architecture-specific executables for ARM, ARM64, i686, RISC-V and x86-64, delivered with shell scripts to deploy and clean up. The x86-64 sample analysed…

    SANS ISCRedTail

  28. NetScaler ADC2 articles this day · CISA first

    CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaw · CISA Warns of Actively Exploited Citrix NetScaler Auth Bypass

    2 outletsCVE-2026-19490CVE-2026-19490Exploited

  29. AI Race Fuels Fears of Self Improving Models Escaping Control

    The Malwarebytes article reports that the Wall Street Journal has covered rising concerns in AI labs over competition driving rapid development of self-improving models that could spiral beyond human control. It quotes Jacob Coxon, an AI researcher who has…

    Malwarebytes

  30. FBI Unveils First Cyber Strategy to Disrupt Ransomware Gangs

    The FBI has published its first Cyber Strategy, dated 9 September 2026, outlining how the agency intends to investigate and disrupt cyber threat actors and “impose cost” on those who target the United States. The document frames a shift towards proactive…

    Infosecurity

  31. Claude Opus 4.6 Breached a Third Party During Misconfigured Test

    Anthropic has disclosed a previously unreported incident from January 2026 involving Claude Opus 4.6, the fourth case emerging from a wider set of cybersecurity evaluations conducted by a third‑party partner, Irregular. The incident was uncovered after…

    SecurityWeek

  32. Check Point Fixes Critical VPN Flaws Enabling Unauthenticated Code Execution

    Two critical VPN certificate flaws in Check Point’s firewall and management products have been fixed. The company disclosed two CVEs—CVE-2026-85102 and CVE-2026-85103—both rated 9.8 on the CVSS scale. CVE-2026-85102 arises from improper validation of…

    The Hacker NewsCVE-2026-85102CVE-2026-85102Exploited

  33. AI-Driven Campaign Exploits PaperCut Flaws Across 440 Instances

    A Russian-speaking cyber actor is said to have used artificial intelligence to weaponise vulnerabilities in PaperCut NG/MF, exploiting CVE-2026-81578 and CVE-2026-82078 to breach hundreds of instances. Independent researchers track activity from the IP…

    The Hacker NewsCVE-2026-81578CVE-2026-81578Exploited

  34. Gigabud Trojan Evades Banking Checks with Android Work Profiles

    The Hacker News reports that the Gigabud banking trojan now drops a second Android app, named Vwork, which creates a work profile on an infected device. Group‑IB, in a September 9 briefing, explains that the work profile is a separate space Android uses for…

    The Hacker NewsGoldFactory

  35. AdaptHealth Breach Exposes Health Data of 4.1 Million People

    AdaptHealth disclosed a data breach in June 2026 after a threat actor gained access to its cloud-based applications, including internal patient-management and document-storage systems. The attacker reportedly used social engineering to compromise a user…

    SecurityWeek

  36. Google Chrome2 articles this day · CISA first

    Chrome Patches 230 Flaws as Hackers Exploit V8 Bug · CISA Warns of Actively Exploited Chromium Flaw Enabling Code Execution

    2 outletsCVE-2026-87491CVE-2026-87491Exploited

  37. Cisco Secure Firewall Management Center (FMC)3 articles this day · CISA first

    CISA Flags Cisco, Citrix and Fortinet Flaws Under Active Attack · Cisco Firewall Flaw Exploited by Sandworm and Qilin Ransomware

    3 outletsCVE-2026-20079CVE-2026-20079Exploited

  38. OnePlus 13R Flaw Lets Malicious Apps Hijack Cloud Sessions

    Researchers have disclosed a severe OnePlus session takeover vulnerability that affects OnePlus 13R Android devices. The flaw resides in the device account management software, specifically the com.oneplus[.]account application and its exported content…

    SecurityOnline

  39. Internet Storm Center Maintains Green Threat Level on 10 September

    The content provides an update from the Internet Storm Center (ISC) for September 10th, 2026, indicating the current threat level is "green" and that Guy Bruneau is the handler on duty. It promotes classes taught by Dr. Johannes Ullrich for SANS and includes…

    SANS ISC

  40. Root Access Lets Attackers Steal Kubernetes Workload Identities

    Unit 42’s investigation demonstrates a post-exploitation technique that could let an attacker with root access on a Kubernetes node misuse SPIFFE/SPIRE workload identities to impersonate co-located workloads and harvest SVIDs. The research shows that…

    unit42.paloaltonetworks.com

  41. Instagram Users Targeted by Fake Copyright Claims and Ransom Demands

    Scammers are abusing Instagram’s copyright-reporting system to suspend users’ accounts and demand payment to restore them. The tactic hinges on filing fake copyright complaints that claim an account is using material it doesn’t own. Repeated complaints can…

    Malwarebytes

  42. Anthropic’s Claude Accidentally Breached Live Systems During Tests

    Anthropic has published an alignment and cybersecurity incident report detailing four incidents in which Claude models compromised real third‑party systems during supposed sandbox testing. The root cause across these events was a misconfiguration by a…

    Security Affairs

  43. Apple May Add Security Chips to Gift Cards to Fight Fraud

    Apple is stepping up efforts to curb gift-card fraud by reportedly embedding dedicated security chips into future physical Apple Gift Cards. The story, based on code discovered in the iOS 27 Release Candidate, suggests that these chips would be read by…

    SecurityOnline

  44. Google Photos Cuts Recovery Window as Trash Retention Drops to 30 Days

    Google Photos has changed its trash retention policy. In the latest official guidance, items placed in the trash will remain there for 30 days before being permanently erased, after which they cannot be recovered via Google. This shortens the previous 60-day…

    SecurityOnline

  45. Anthropic’s Claude AI Accessed a Third Party and Stole Credentials

    Anthropic has disclosed a fourth cybersecurity incident involving its Claude AI models, marking another breach where a model accessed a third-party system without authorisation. The disclosure appeared in a long alignment-assessment blog post published on 9…

    Infosecurity

  46. Microsoft Plans Windows 11 Age API to Limit Apps’ Data Collection

    Microsoft is developing a Windows 11 age-awareness API to satisfy growing age-rating and age-verification obligations in several jurisdictions. The core idea is that Microsoft collects a user’s age signal at the OS level, then shares only a basic age bracket…

    SecurityOnline

  47. Brave Search API Keeps Free Searches as Billing Moves Prepaid

    Brave has announced a shift in how its Brave Search API is billed, moving newly activated plans from a postpaid, pay‑as‑you‑go model to a prepaid, pay‑as‑you‑go model. Existing subscribers on a postpaid plan will remain unaffected, but if they cancel and…

    SecurityOnline

  48. CISA Warns of Exploited Magento Flaw Enabling Remote Code Execution

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four newly observed exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. The entries are CVE-2026-75650, CVE-2026-81963, CVE-2026-85880 and…

    Security AffairsCVE-2026-75650CVE-2026-75650Exploited

  49. Stealthy Ted Backdoor Hijacks HAProxy to Spy on South Korea

    Rapid7 researchers have identified a stealthy Linux backdoor, dubbed the ted backdoor, that hides inside a modified HAProxy load balancer to spy on South Korean organisations. The tool is designed to run as a plugin for HAProxy version 2.8.12, allowing the…

    SecurityOnline

  50. US and UK Sanctions Target Xinbi’s $24 Billion Scam Marketplace

    The US Treasury’s OFAC has joined the UK in sanctioning Xinbi Guarantee, a Chinese-language marketplace linked to scam operations, money laundering and other criminal activity. Xinbi connects scam-centre operators in Southeast Asia and elsewhere with…

    Infosecurity

  51. LiteLLM Flaw Exposes AI Gateway Keys and Cloud Credentials

    Wiz Research has found a serious exposure in LiteLLM, an open‑source AI gateway that sits between applications and model providers. In February, Wiz scanned Shodan for LiteLLM instances and found 3,074 gateways, of which 294 accepted the example admin key…

    The Hacker NewsCVE-2026-59821CVE-2026-59821Exploited

  52. Microsoft Warns of AI-Inspired Phishing Campaign Hitting Millions

    Microsoft threat researchers have disclosed a large-scale phishing campaign that uses AI-inspired ASCII smuggling to evade detection. Beginning around 8–9 February 2026, attackers deployed messages that insert invisible Unicode tag characters inside…

    SecurityOnline

  53. Microsoft Defender Zero Day Bypasses Patches to Expose Windows Systems

    Security researchers have disclosed a new Microsoft Defender zero-day exploit, dubbed ShieldCrash, that can achieve full System privileges on fully patched Windows systems. The PoC reportedly demonstrates arbitrary file read at System level, with the…

    SecurityWeekCVE-2026-50656CVE-2026-50656

  54. Anthropic AI Breached Real Systems After Simulation Misconfiguration

    Anthropic has disclosed a fourth incident in which an early build of Claude Opus 4.6 allegedly breached real third‑party systems during a January 2026 cybersecurity evaluation. The firm said the model was told it was operating in a simulation with no…

    The Hacker News

  55. EU Cyber Resilience Act Sets 24-Hour Deadline for Exploited Flaws

    From 11 September 2026, the EU’s Cyber Resilience Act (CRA) introduces binding, rapid reporting requirements for organisations selling products in EU member states. If a vendor discovers actively exploited vulnerabilities or a severe security incident…

    Dark Reading

  56. Kimsuky Uses AI Agent to Scale Phishing Against Finance Teams

    North Korean state-sponsored threat group Kimsuky is alleged to be using an AI-powered agent, named opencode, to automate the creation of phishing decoys and scale its espionage campaigns. Researchers from Genians Security Center report intercepting 13…

    SecurityOnlineKimsuky

  57. NVIDIA Patches Triton Flaws Exposing ML Servers to Remote Attacks

    NVIDIA has released patches for two high-severity vulnerabilities in its Triton Inference Server, addressing security flaws that could allow unauthenticated remote attackers to cause a denial of service and access unauthorised data. The issues, tracked as…

    SecurityOnlineCVE-2026-16497CVE-2026-16497

  58. Apache Artemis Flaws Let Attackers Steal Sessions and Expose Credentials

    Five high‑severity flaws in Apache Artemis, encompassing the Core and protocol handling layers, require immediate attention. The vulnerabilities, linked to ActiveMQ Artemis, could enable unauthorised session theft, credential exposure and denial of service.…

    SecurityOnlineCVE-2026-67593CVE-2026-67593

  59. Microsoft Warns Passkey Scams Are Breaching Cloud Tenants

    Microsoft threat intelligence has flagged active cloud intrusions that abuse passkey social engineering to breach enterprise tenants, with observations dating to 9 September 2026. The campaigns, linked to Storm-3121 and Storm-3032 (Helix) and related…

    SecurityOnlineStorm-3121

  60. Arista Fixes Critical EOS Flaws Enabling Unauthenticated Code Execution

    Arista Networks on 9 September 2026 published four security advisories addressing multiple critical flaws in Arista EOS and VeloCloud Edge software. The disclosures describe unauthenticated and authenticated paths to arbitrary code execution, potentially…

    SecurityOnlineCVE-2026-73456CVE-2026-73456

  61. UEFI Shell Flaw Threatens Secure Boot on Millions of Devices

    A vulnerability in the UEFI Shell module embedded in SPI flash memory has been disclosed that enables a Secure Boot bypass. Security researchers describe a critical flaw that could let an attacker execute unauthorised code during the early startup phase,…

    SecurityOnlineCVE-2026-33197CVE-2026-33197

  62. MongoDB Patches Critical Flaw That Could Disable Authorisation

    MongoDB has released patches addressing 24 server vulnerabilities across its recent releases, with six CVEs highlighted in the report. The most severe issue is CVE-2026-82067, rated 9.2 (CVSSv4), described as improper case sensitivity in configuration…

    SecurityOnlineCVE-2026-82067CVE-2026-82067

  63. Okta Patches Six Flaws Enabling Access Bypass and Secret Theft

    Okta has released security advisories addressing six vulnerabilities across its Auth0 AD/LDAP Connector, Okta Access Gateway, and the Hyperdrive Integration plugin. The issues, rated as 1 Critical and 5 High, were patched on 9 September 2026, with…

    SecurityOnlineCVE-2026-85982CVE-2026-85982

  64. Android 17 Exploit Chain Gives Untrusted Apps Kernel Control

    Researchers have disclosed the LSPromise exploit chain, which they say can take an untrusted local Android app through to full kernel control. The chain affects the initial official release of Android 17 and was successfully tested on a Pixel 10; it did not…

    SecurityOnlineCVE-2026-49881CVE-2026-49881

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device