News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Sun 25 Oct | 13 |
| Today, Mon 26 Oct | 17 so far |
Thu 1 Oct· 79 articles
-
Fortinet FortiMail2 articles this day · CISA first
FortiMail Flaw Exploited in the Wild, Exposing Corporate Networks · CISA Flags Fortinet FortiMail Flaw Under Active Exploitation
-
FortiMail Flaw Exploited in the Wild, Exposing Corporate Networks
Fortinet’s FortiMail appliance is actively exploited due to a path traversal flaw tracked as CVE-2026-104286, rated CVSS 9.8. The vulnerability arises from a combination of path traversal (CWE-22) and poor handling of NULL bytes (CWE-158), enabling…
-
CISA Flags Fortinet FortiMail Flaw Under Active Exploitation
CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) catalogue on 1 October 2026. The vulnerability affects Fortinet FortiMail and is named the Fortinet FortiMail Path Traversal Vulnerability. It allows an unauthenticated attacker to write…
-
-
KillSec5 articles this day · SecurityWeek first
Teen Allegedly Ran KillSec Ransomware Operation Behind 500 Attacks · International Sweep Dismantles KillSec Ransomware Operation and Seizes Data
5 outlets-
Teen Allegedly Ran KillSec Ransomware Operation Behind 500 Attacks
German authorities have identified a 16-year-old Romanian national as the alleged mastermind of the KillSec ransomware operation, following a coordinated international takedown that led to the arrests of three suspects and searches of eight properties across…
Dark Reading -
International Sweep Dismantles KillSec Ransomware Operation and Seizes Data
Authorities coordinating across nine countries say they have shut down the KillSec ransomware operation, with arrests made during a coordinated international action day organised by Eurojust and Europol. The operation involved public prosecutors and law…
DataBreaches -
Europol Dismantles KillSec Ransomware Gang After 500 Attacks
Europol says the KillSec ransomware group has been dismantled as part of Operation KillSwitch, with law enforcement seizing control of the group’s dark web leak site and more than 110 terabytes of stolen data. The action, led by German authorities and…
Security Affairs -
Teen Suspected of Running KillSec Ransomware Operation Arrested in Spain
Spanish police have arrested a 16-year-old in Alicante who investigators identify as KillSec’s suspected administrator and main operator. The arrest on 30 September, with the leak site seized the following day, comes as part of a Europe‑wide operation led by…
The Hacker News -
Teen Allegedly Ran KillSec Ransomware Group Behind 1,000 Attacks
Europol says a 16-year-old is believed to be the administrator and main operator of KillSec, a ransomware group linked to roughly 1,000 suspected attacks worldwide. The teenager was identified in Operation KillSwitch, an international investigation led by…
SecurityWeek
-
-
Pentagon Breach Exposes Data on 2.8 Million Personnel
Two U.S. federal breaches within a month have exposed a large trove of sensitive data. The Pentagon has disclosed that hackers accessed a Defence Department network used by the Defence Manpower Data Center, compromising personnel records stored there for…
Ars Technica -
Zero Trust Can Still Stop Rogue AI Agents, Its Policy Engine Must Hold
John Kindervag, the founder of the zero trust model, argues that the approach remains effective in the AI era but only if its implementation is correct. The SecurityWeek piece covers his new book, Cyber Resilience at Machine Speed: The Zero Trust Model for…
SecurityWeek -
Osavul Raises $10 Million to Predict Hybrid Attacks Before They Strike
Osavul, a hybrid risk intelligence company, has secured $10 million in a Series A funding round led by 33N Ventures, with Balnord, G+D Ventures, and 42CAP also participating. The Luxembourg-based startup says the funding will help expand its AI platform,…
SecurityWeek -
Crypto Phishing Sites Trick Users Into Authorising Token Theft
Malwarebytes confirms a large-scale phishing operation that imitates well-known crypto projects, including xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight and others. In nearly all cases the fake pages invite visitors to vote on the date of a…
Malwarebytes -
Leaked Russian Projects Reveal an Automated Cyber Espionage Ecosystem
The Spetsvuzavtomatika leak on the dark web exposes a broad Russian cyber development programme rather than a single intrusion operation. Seven named projects are described, including Felix-23 and HAD for target discovery, scanning, enrichment and active…
dti.domaintools.com -
AI Fuels Exploitation as Model Flaw Enables Remote Code Execution
A weekly ThreatsDay bulletin highlights how ordinary components can become attack paths when misused, with AI and automation accelerating both discovery and exploitation. The piece surveys a wide range of incidents and research, from model inspection…
-
McMinnville Data Breach Exposes Tax Returns and Police Records
A cybersecurity specialist told KOIN 6 News that the McMinnville data breach left a “treasure trove” of sensitive records exposed online, accessible after just three clicks. The attacker, identified as RansomHouse, leaked data that purportedly includes tax…
DataBreachesRansomHouse -
Cloudflare Launches Open Source AI Models for Faster Decisions
Cloudflare has announced Clef, a new family of open‑source decision models, and Clef-flash, with an accompanying RL fine‑tuning platform. The models, hosted on Workers AI and released under Apache 2.0 on Hugging Face, are designed to produce deterministic,…
Cloudflare -
WordPress Backdoor Uses Self-Healing Mesh to Survive Cleanup
Security researchers have disclosed a highly persistent WordPress infection that uses a “self-healing mesh” backdoor, codenamed SC, to ensure the final payload remains accessible even after apparent cleanup. The backdoor operates across eight locations…
-
Organisations Struggle to Defend Against Rising AI and Quantum Threats
PwC’s Global Digital Trust Insights 2027 survey, which polled nearly 4,000 leaders across more than 70 countries, highlights a wide gap between the pace of AI and quantum threats and organisations’ preparations. The report notes a surge in AI-assisted…
SecurityWeek -
Cisco Catalyst SD-WAN Manager2 articles this day · SOCRadar first
Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers · Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access
-
Cisco SD-WAN Zero Day Exposes Internet Facing Systems to Attackers
Cisco has released an urgent security update for Cisco Catalyst SD-WAN Manager after the discovery of a zero-day vulnerability that is already being exploited in the wild. The flaw, tracked as CVE-2026-76504, affects the API session-based authentication…
-
Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access
CVE-2026-76504 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Manager (formerly vManage) that lets an unauthenticated remote attacker reach the management API with administrator privileges. Cisco reports active exploitation in September…
-
-
Mimecast Chief Juncker Turned Childhood Hacking Into Cyber Defence
Rob Juncker, chief product and technology officer at Mimecast, describes himself as a hacker, a claim he frames as important for security leadership. The piece traces his early curiosity to a ten-year-old with an Apple IIc, where he taught himself BASIC…
SecurityWeek -
Shadow AI Is Putting UK Workplace Data at Risk, Studies Warn
Shadow AI is defined as AI technology used at work that isn’t captured in an organisation’s approved systems and processes. The article emphasises that employees may turn to AI tools to get work done faster, such as summarising long email threads or drafting…
Malwarebytes -
China Aligned Hackers Impersonate AI Experts to Steal Microsoft 365 Sessions
A China-aligned threat group, TA419, has been impersonating prominent AI policy figures and economists to harvest login credentials from AI policy specialists at US think tanks, universities and law firms. Proofpoint notes the activity has been ongoing since…
InfosecurityTA419 -
Microsoft warns AI agents are widening the attack surface for enterprises
Microsoft’s 2026 Digital Defense Report, released on 1 October 2026, builds a picture of an increasingly interconnected security environment. The briefing notes that threat activity now spans infrastructure, identities, applications, cloud environments, and…
Microsoft -
Governments Became Cyber Threats’ Top Target as Phishing Soared
Governments emerged as the sector most affected by cyber threats in 2026, accounting for 27% of observed activity and increasingly targeted by nation‑state actors. The Microsoft Digital Defense Report highlights that governments sit at the centre of networks…
blogs.microsoft.com -
Google’s Gemini 4 Argon Hunts Critical Flaws in Healthcare Software
Google has unveiled Gemini 4 Argon, described as a frontier AI model built for coding, enterprise work and autonomous cybersecurity defence. The company is rolling Argon out first to a trusted cohort through its Fairwind Program rather than a public release.…
Security Affairs -
Fake Zoom Installer Hides CloudSyncD Backdoor Behind Password Prompt
A new macOS backdoor, dubbed CloudSyncD, has been found hidden inside a fake Zoom installer that asks users to enter their login password before launching a second-stage payload. Jamf Threat Labs first observed CloudSyncD on 15 September in a development…
Infosecurity -
TeamViewer Fixes Flaw Allowing Remote Attackers to Bypass Permissions
TeamViewer has patched five high-severity vulnerabilities across its Full Client and Host applications for Windows, Linux and macOS, with the September 29, 2026 security bulletin TV-2026-1010 rating the issues as Important. The most serious, CVE-2026-92370…
-
AI Speeds Up Attacks, but Security Fundamentals Still Matter
The SecurityWeek piece argues that while Frontier AI and similar tools have accelerated the pace at which vulnerabilities are identified and exploits developed, this does not change the need for strong security fundamentals. The author emphasises that…
SecurityWeek -
Cloudflare Brings Europe’s Open AI Models to Workers AI
Cloudflare marks a year since its Sovereign AI initiative by highlighting two European open models now accessible on Workers AI: EuroLLM and Apertus. EuroLLM covers 35 languages, including all 24 official EU languages, and was developed with Horizon Europe,…
Cloudflare -
Warlock Ransomware Exploits SharePoint to Target Spanish-Speaking Regions
Warlock ransomware, linked to the China-nexus threat actor known as Longlegs and Microsoft as Storm-2603, has re-emerged targeting organisations in the Spanish- and Portuguese-speaking world. First observed in mid-2025, the operation has evolved into a…
Dark ReadingStorm-2603 -
Cloudflare’s AI Search Adds Native Image Retrieval and OCR
Cloudflare has announced that AI Search is now generally available, expanding a platform that combines Workers AI, Vectorize, R2 and Browser Run into a managed index and retrieval pipeline. The GA release includes native multimodal embedding and retrieval,…
Cloudflare -
Cloudflare Workers Opens Access to Post Quantum ML KEM and ML DSA
Cloudflare has begun enabling post-quantum cryptographic primitives in Cloudflare Workers through Web Crypto, giving developers first‑class access to ML-KEM and ML-DSA algorithms. The public API additions are opt‑in via the webcrypto_modern_algorithms…
Cloudflare -
Cloudflare’s KV Instant Brings Sub-2ms Global Reads to Workers Apps
Cloudflare has announced Workers KV Instant, a new mode for Workers KV that runs on the Quicksilver globally distributed key-value store. KV Instant provides the same API as the existing Workers KV but is powered by Quicksilver to deliver instant global…
Cloudflare -
Cloudflare Opens Managed Agent Workspace for Code and Gmail
Cloudflare has announced Cloudflare OS, described as an “agent workspace” for organisations that is now available with a fully managed option and a waitlist for deployments. The open-source project remains available for self-hosted use, but the managed…
Cloudflare -
Cloudflare Unveils K2 for Durable Serverless Event Streaming at Scale
Cloudflare has announced Cloudflare K2, a public beta offering a durable, serverless event streaming primitive built on the developer platform. K2 lets you send events to a stream that is stored as an ordered log, with consumers able to read in different…
Cloudflare -
Cloudflare Reimagines Git for Thousands of Collaborating AI Agents
Cloudflare is inviting developers to reimagine Git for an “agentic era,” built on its Artifacts platform and Workers. The company argues that the next generation of software will be produced by many agents working on the same codebase, raising questions…
Cloudflare -
Cloudflare Makes Basin Data Analytics Platform Generally Available
Cloudflare has generally availableed Basin, its serverless data analytics platform that sits within the Cloudflare Developer Platform. Basin combines three products—Basin Pipelines, Basin Catalog and Basin SQL—built on Apache Iceberg and Cloudflare R2 Object…
Cloudflare -
Attackers Exploited Zimbra Flaw Before Public Disclosure
SecurityWeek reports that attackers began exploiting a high-severity OS command injection in Zimbra Collaboration Suite (ZCS) shortly after patches were released, and before public disclosure. The flaw, CVE-2026-73570 (CVSS 8.9), affects ZCS pre-10.1.20,…
-
Apple Patches CoreGraphics Zero Day Exploited in Targeted Attacks
Apple has patched a zero‑day in CoreGraphics tracked as CVE-2026-86950, after researchers reported that it could be triggered by processing specially crafted files to cause arbitrary code execution. The flaw is described as an out‑of‑bounds write in the font…
-
Citrix NetScaler Zero Days Exploited Against 50,000 Devices
Two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway were exploited as zero-days for weeks, according to Datawater. The CVEs are CVE-2026-88771 and CVE-2026-88772, both rated with CVSS 9.5, and the exploits were…
