News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 16 so far |
Mon 28 Sep· 71 articles
-
Carbonato Botnet Hijacks Docker Hosts to Deploy AI Agent
The article discusses the Carbonato botnet, which compromises Docker hosts to deploy a Telegram-controlled Hermes AI agent. This security threat highlights vulnerabilities in cloud infrastructure, emphasizing the need for enhanced cybersecurity measures. The…
The Hacker NewsCarbonato -
DC Health Agency Exposes Data of 399,000 Medicaid Beneficiaries
The District of Columbia Department of Health Care Finance (DHCF) is notifying 399,086 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed. The affected people enrolled between 2023 and 2026. DHCF said the…
SecurityWeek -
ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass
Mandiant and the Google Threat Intelligence Group (GTIG) have warned that the ShinyHunters extortion group, tracked by Google as UNC6240, is conducting a fresh mass-exploitation campaign against Oracle PeopleSoft customers. PeopleSoft is used by large…
-
JadePuffer2 articles this day · The Hacker News first
Storm-3168 Used Stolen Azure Identities to Delete Cloud Data · JADEPUFFER Attackers Exploit Azure Identities to Delete Cloud Resources
2 outlets-
Storm-3168 Used Stolen Azure Identities to Delete Cloud Data
Microsoft has detailed an Azure attack attributed to Storm-3168, the group linked to the JADEPUFFER ransomware operation. The activity involved two compromised service principals—non-human identities used by applications—from the same tenant. One spent about…
Security Affairs -
JADEPUFFER Attackers Exploit Azure Identities to Delete Cloud Resources
The article covers a cybersecurity incident related to the JADEPUFFER-linked attackers, who exploited compromised service principals to delete Azure resources. This highlights the ongoing issue of identity security within cloud environments. The attackers'…
The Hacker News
-
-
New Mexico Jury Finds Meta Misled Users Over Cambridge Analytica Data
A New Mexico jury has found Facebook, owned by Meta, liable for deceiving users about privacy protections and misleading the public about investigations into third-party applications that harvested user data. Prosecutors said the case involved a personality…
SecurityWeek -
Nvidia Builds AI Agent Guardrails with OpenShell and Sentry
Nvidia has announced the Open Agent Safety Platform, combining open-source software with a reference system design intended to keep AI agents within defined boundaries from testing through deployment. Its two main components are OpenShell, a sandboxed…
SecurityWeek -
Citrix NetScaler ADC5 articles this day · SOCRadar first
Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks · CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws
-
Citrix NetScaler Zero Days Expose Appliances to Active RCE Attacks
Citrix disclosed eight vulnerabilities affecting NetScaler ADC and NetScaler Gateway on 27 September 2026, including two critical remote-code-execution flaws: CVE-2026-88771 and CVE-2026-88772. Both have a CVSSv4 score of 9.5 and were confirmed by the US…
-
CISA Warns of Active Exploitation in Critical Citrix NetScaler Flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Citrix NetScaler vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue: CVE-2026-88771 and CVE-2026-88772. Both have a CVSS score of 9.5. CVE-2026-88771 is…
-
Citrix NetScaler Zero Days Exploited in Attacks, Patch Now
Citrix has released updates for eight vulnerabilities in NetScaler ADC and NetScaler Gateway, including two critical zero-days exploited in the wild. In a 27 September bulletin, the vendor said the flaws have CVSS scores ranging from 7 to 9.5. CVE-2026-88771…
-
Citrix Patches NetScaler Zero Days Exploited in Global Attacks
Citrix has released emergency patches for two critical NetScaler ADC and NetScaler Gateway zero-day vulnerabilities being exploited in the wild. The flaws are part of an advisory covering eight vulnerabilities, including remote code execution, HTTP request…
-
Citrix Patches NetScaler Zero Days Exploited in Global Attacks
Citrix has issued emergency updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days being exploited in the wild. CVE-2026-88771 and CVE-2026-88772 both have CVSS v4.0…
-
-
Ox Security Finds 15,465 MCP Servers Operating Without Governance
Model Context Protocol (MCP) servers are creating a governance gap for organisations deploying AI, according to research by Ox Security. MCP lets AI applications connect to external tools and data, including APIs and databases, without developers writing…
Infosecurity -
Kiteworks Urges Shutdown Over Advanced Forms Flaw Threat
Kiteworks, the secure data-sharing provider formerly known as Accellion, advised customers to shut down on-premises and customer-hosted servers for a “nine-hour precautionary shutdown” after receiving credible threat intelligence from federal authorities.…
SecurityWeek -
OpenAI Reportedly Set to Reveal Persistent AI Agent Codenamed “O”
OpenAI is reportedly preparing to unveil a persistent AI assistant codenamed “O” at its DevDay conference in San Francisco on 29 September. The report attributes the claim to confidential sources and says it is not yet confirmed by OpenAI. The alleged…
SecurityOnline -
ShinyHunters2 articles this day · Malwarebytes first
Alleged FBI Medical Records Leak Exposes Employees’ Private Details · Malwarebytes Warns of AI Backdoors, ClickFix Traps and Phishing
1 outlet-
Alleged FBI Medical Records Leak Exposes Employees’ Private Details
The BBC reports that samples of allegedly stolen FBI employees’ medical examinations have been shown to journalists. The “fitness-for-work” reports appear to include agents’ names, addresses, phone numbers, badge numbers, job titles and information about…
Malwarebytes -
Malwarebytes Warns of AI Backdoors, ClickFix Traps and Phishing
Malwarebytes Labs’ weekly roundup, published on 28 September 2026, lists cybersecurity stories it covered between 21 and 27 September. The topics included LinkedIn checks intended to identify fake profiles and employment histories; Kothamine malware using…
Malwarebytes
-
-
Fake Crypto Wallet Delivers Elusive PamStealer to Mac Users
Jamf Threat Labs says it has identified an active campaign distributing PamStealer, a macOS information stealer, through websites impersonating cryptocurrency platforms. The lure is a fake multi-chain wallet called Wavel, delivered in a malicious DMG file.…
SecurityOnline -
CISA Warns Attackers Are Exploiting Critical Citrix NetScaler Flaws
CISA has reported that attackers are exploiting two critical vulnerabilities in Citrix NetScaler devices. These flaws pose significant risks to network security, especially for organizations using Citrix technology. The vulnerabilities allow unauthorized…
The Hacker News -
Android Banking Trojan RemControl Targets Customers Across Seven Countries
Group-IB researchers have identified a new Android banking trojan, RemControl, operated by a group they track as UNKK. The malware is being distributed through malicious adverts on Meta platforms that lead users to fake Google Play pages offering a free…
SecurityOnlineUNKK -
North Korean Konni Group Targets Think Tanks with Stealthy Malware
The SOCRadar Threat Research Unit says the suspected North Korean group Konni, also tracked as TA406 and Opal Sleet, began a targeted cyber-espionage campaign in early August 2026 against foreign-policy think tanks, diplomatic organisations and…
SecurityOnlineOpal Sleet -
Attackers Exploit Roundcube Webmail Flaw to Steal Mailbox Data
Roundcube Webmail vulnerability CVE-2026-48842, rated 8.1 by CVSS, is being exploited in the wild, according to an advisory from the Canadian Centre for Cyber Security published on 21 September 2026. The flaw affects Roundcube 1.6.x versions before 1.6.16…
-
Windows 11 Users Report Faster File Explorer After Disabling 8.3 Names
Windows 11 still supports the legacy 8.3 file-naming system inherited from MS-DOS. On modern file systems such as NTFS, this creates shortened aliases for long file names, often containing a tilde (~), despite Windows supporting much longer names.…
SecurityOnline -
Kiteworks Urges Customers to Isolate Servers Over Suspected Attack
Kiteworks told customers worldwide to temporarily isolate their secure file-transfer servers after receiving sensitive intelligence from unnamed federal authorities about a possible attack against certain deployments. The initial customer notice requested a…
SecurityOnline -
GitHub Blocks New Outlook and Hotmail Signups Over Abuse
GitHub has suspended new account registrations using Outlook and Hotmail email addresses. Applicants attempting to sign up with either domain reportedly receive an error saying that the address cannot be verified. Existing GitHub accounts registered with…
SecurityOnline -
Windows 11 Adds PowerToys Style Cursor Locator and Custom Colours
Microsoft has enabled a mouse-pointer locator in Windows 11 beta build 26220.9568, alongside expanded pointer-colour customisation. The changes are available under Settings > Accessibility > Mouse pointer and touch. Users can choose preset colours or create…
SecurityOnline -
Canonical Overhauls Ubuntu Kernel Updates to Deliver Fixes Weekly
Canonical is changing Ubuntu’s stable kernel update process in response to the growing volume of vulnerability reports. Instead of a standard four-week cycle, with separate two-week emergency security releases, it plans to use overlapping two-week Stable…
SecurityOnline -
Fake CAPTCHA Campaign Targets Mac Users With Information-Stealing Malware
Brad Duncan has analysed malware delivered through the active “Macfinger ClickFix” campaign, which uses injected scripts on legitimate websites to display fake CAPTCHA or bot-protection pages. Victims are instructed to paste commands into Terminal, causing a…
SANS ISC -
Nine Flaws Exploited as Attackers Target Edge Products and WordPress
CVE WATCHTOWER recorded 2,825 new vulnerabilities between 21 and 27 September 2026, including 221 rated Critical and 218 scoring CVSS 9.0 or higher. Daily Cybersecurity identified nine flaws being exploited, eight of which were also added to CISA’s Known…
-
North Korean Hackers Hide macOS Backdoors in Fake Coding Tests
SentinelOne says the suspected North Korean group TraderTraitor, also known as UNC4899, Jade Sleet and PUKCHONG, used fake recruitment exercises to compromise a developer workstation at an IT services company outside the cryptocurrency sector. The attackers…
SecurityOnlineTraderTraitor -
Apple Patches macOS Flaw Allowing Apps to Gain Root Access
Apple has issued patches for a local privilege-escalation vulnerability in macOS CoreServices, tracked as CVE-2026-43786 and rated 7.8 (High) under CVSSv3. The flaw affects versions before macOS Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. A malicious…
