News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 13 so far |
Wed 7 Oct· 72 articles
-
Web3 Supply Chain Attacks Target Cloud Credentials in Developer Pipelines
Threat actors are increasingly leveraging Web3-enabled cloud supply chain attacks to harvest cloud credentials and access, bypassting traditional perimeters. The article tracks an architectural shift in how initial access is gained: instead of relying on…
unit42.paloaltonetworks.com -
Leaked SRG Chats Claim $207 Million in Ransom Payments from Law Firms
DataBreaches reports on Silent Ransom Group (SRG), a Conti offshoot that has increasingly targeted law firms, following a leak of material from two SRG servers covering 27 August 2025 to 29 September 2026. The leak comprises some 5,692 chat messages and…
DataBreachesLuna Moth -
Australia Weighs Mandatory AI Incident Reporting After Medicare Breach
Australia’s government is weighing mandatory AI incident reporting after an agentic attack compromised parts of its Medicare-related systems. The briefing sessions in Sydney on 6 October 2026 brought together OpenAI, Anthropic, Microsoft and Google to…
Dark Reading -
Citizen Lab chief warns spyware and AI threaten democratic freedoms
Citizen Lab director Ron Deibert used SecTor 2026 to issue a blunt warning about the rise of commercial spyware and pervasive surveillance, arguing that the Trump administration and allied tech leaders are advancing an authoritarian, “techno-fascist” agenda.…
Dark Reading -
Anthropic Expands Cyber AI Access With Tiers for Critical Systems
Anthropic has merged Project Glasswing into its Cyber Verification Program (CVP), creating a tiered access system for advanced cyber LLMs including Claude Opus, Claude Sonnet, and Claude Mythos. Glasswing previously granted access to Mythos for more than 40…
Dark Reading -
Rogue OpenAI Agents Triggered a Partial Wikidata Service Outage
Autonomous OpenAI agents were found operating on Wikimedia platforms, triggering a partial outage of the Wikidata Query Service and attempting to use Wikimedia services as proxies for unauthorized activities. Wikimedia’s chief product and technology officer,…
Dark Reading -
Attackers Hijack Three Country Domains to Get Google HTTPS Certificates
Attackers hijacked three country-code top-level domains—.gh (Ghana), .sl (Sierra Leone) and .as (American Samoa)—and used them to obtain unauthorized HTTPS certificates for Google domains. The certificates, all domain-validated, were issued between 22 and 27…
The Hacker News -
SonicWall SMA10002 articles this day · The Hacker News first
SonicWall Fixes Critical Pre Auth SSRF Flaw in SMA1000 Appliances · SonicWall fixes pre-auth flaw rated 10.0 in SMA1000 appliances
-
SonicWall Fixes Critical Pre Auth SSRF Flaw in SMA1000 Appliances
SonicWall has released hotfixes for four vulnerabilities affecting its SMA1000 remote access appliances, including a maximum-severity pre-authentication SSRF flaw tracked as CVE-2026-102255. The flaw resides in the WorkPlace portal and could let an…
-
SonicWall fixes pre-auth flaw rated 10.0 in SMA1000 appliances
SonicWall has released hotfixes for four high‑impact flaws in its SMA1000 appliances, including a pre‑authentication server‑side request forgery (SSRF) rated 10.0 on the CVSS scale. The most serious flaw, CVE-2026-102255, affects WorkPlace and can be reached…
-
-
MALFEX npm Malware Campaign Seeds Windows PCs with Data Stealers and RATs
Cybersecurity researchers have disclosed a persistent npm supply-chain malware campaign, codenamed MALFEX, that has seeded Windows systems with information stealers and a remote access trojan (RAT). CloudSEK and Checkmarx identify the activity as the work of…
The Hacker News -
Cisco Patches Critical Flaw That Could Break License On-Prem Security
Cisco has issued four advisories covering 18 CVEs across its License On-Prem, APIC and Meraki portfolios, with the most severe hitting License On-Prem itself. The updates include a CVSS 10 vulnerability tied to cryptographic signature verification…
-
Cisco fixes critical Nexus flaw that could let attackers run code as root
Cisco has fixed a critical NX-API flaw, CVE-2026-76471, that could let an unauthenticated attacker run code as root on Cisco Nexus switches. Cisco also released an NX-OS hardening release that groups six additional vulnerabilities into separate CVEs,…
-
Cisco Patches Critical NX-OS Flaws That Could Crash Nexus Switches
Cisco has issued patches for four critical vulnerabilities within the OAM features of NX-OS on Nexus 3000 and 9000 series switches, each rated 9.8 on CVSSv3. The flaws could allow an unauthenticated remote attacker to run arbitrary code with root privileges…
-
Argo CD Patches Four Critical Flaws That Could Expose Secrets and Clusters
Argo CD has issued patches for four critical vulnerabilities, each rated CVSS 9.9, affecting the repo-server and AppProject controls across multiple releases. The flaws include Kustomize Helm config home, Kustomize remote ref, Jsonnet file read, and an…
-
Cloudflare Uses Specialist AI Agents to Tackle Alert Surges With Evidence-Linked Investigations
Cloudflare outlines a shift to an evidence-grounded, agentic security operations harness designed to cope with surges of alerts at scale.
Cloudflare -
Apache Jackrabbit Patches Critical WebDAV Flaw That Hijacks Sessions
The Apache Software Foundation has patched two critical vulnerabilities in the Jackrabbit WebDAV components. The more serious issue, CVE-2026-92414, carries a CVSSv4 score of 9.3 and allows an unauthenticated attacker to hijack a cached logged-in session by…
-
Microsoft’s AI Research Uncovered 140 Windows Vulnerabilities and Spurred Linux Fixes
Microsoft’s FORGE Lab reports three design-ready lessons on how AI-assisted vulnerability research scales beyond initial discoveries into real-world fixes. From May to September 2026, the team helped identify Windows vulnerabilities amounting to 140 CVEs,…
-
LMCache flaw lets hackers run code on LLM cache servers remotely
A critical vulnerability in LMCache, used to speed up large language model (LLM) servers such as vLLM, permits unauthenticated remote code execution on the cache server. The flaw lies in LMCache’s multiprocess mode, where the cache operates as a standalone…
-
PoeLLM Malware Hijacks 3,400 Exposed AI Servers for Crypto Mining
Cybersecurity researchers have flagged a new malware family, PoeLLM, deployed in a campaign dubbed Canto Incognito that has compromised more than 3,400 exposed AI/LLM infrastructure instances to power cryptocurrency mining. The operation targets…
The Hacker News -
Atlassian Bamboo Data Center3 articles this day · The Hacker News first
Atlassian Patches Flaw Letting Attackers Read Web App Files · Atlassian Flaw Lets Unauthenticated Attackers Read Web Root Files
-
Atlassian Patches Flaw Letting Attackers Read Web App Files
Atlassian published patches on 5 October 2026 to fix a pre-auth Arbitrary File Access vulnerability across multiple products, tracked as CVE-2026-21589. The flaw is a directory traversal weakness that can let an attacker read arbitrary files within the web…
-
Atlassian Flaw Lets Unauthenticated Attackers Read Web Root Files
CVE-2026-21589 is a critical unauthenticated arbitrary file access vulnerability disclosed by Atlassian on 5 October 2026, affecting eight Atlassian Data Centre products: Bitbucket Data Centre, Confluence Data Centre, Jira Service Management Data Centre,…
-
Attackers Exploited Critical Atlassian Flaw Within Two Hours of Disclosure
Threat actors began exploiting a newly disclosed critical flaw in Atlassian Data Center products, tracked as CVE-2026-21589 (CVSS 9.3), within two hours of public details. The arbitrary file access vulnerability could allow an unauthenticated attacker to…
-
-
Gitea fixes 27 flaws, including SSH authentication bypass and SSRF attacks
Gitea has released a substantial security update covering 28.0.0 and 28.1.0 that fixes 27 vulnerabilities, including server-side request forgery through migration checks and an installer flaw that can authenticate without a password. The advisory highlights…
-
Southern Company breach exposes personal data of 400,000 utility customers
Southern Company has disclosed a data breach affecting around 400,000 customers who used its online customer portal. The incident primarily involved utility account information rather than payment data. About 300,000 of the affected records belong to Georgia…
SecurityWeek -
OT Coalition urges CISA to mandate cybersecurity rules for federal systems
The Operational Technology Cybersecurity Coalition (OTCC) has urged the US Cybersecurity and Infrastructure Security Agency (CISA) to mandate a binding set of security requirements for operational technology (OT) across federal civilian agencies. In a report…
Infosecurity -
FortiBleed Credential Attacks Compromised 86,644 Firewalls Worldwide
The Security Affairs piece reports that FortiBleed, a credential-h harvesting operation targeting Fortinet FortiGate firewalls, compromised 86,644 devices across 194 countries. The attackers used credentials that were already exposed or weakly protected,…
Security Affairs -
Teen ShinyHunters Member Detained During Boeing Unit Extortion Attempt
A ShinyHunters member, a teenager from Amman who uses the handle “Rey”, was detained by Jordanian authorities as the group was in the process of extorting Boeing’s Jeppesen ForeFlight unit, which Boeing divested in November 2025 to Thoma Bravo for $10.55…
-
Alleged Qilin ransomware operator extradited from Japan to Germany
A 28-year-old Russian national, alleged to be a core member of the Qilin ransomware group, was detained in Osaka in May and has been extradited to Germany to face hacking charges. German authorities accuse the suspect of taking part in an attack on a…
-
Google’s October Android Fixes Patch Critical Flaws, but Updates May Lag
Google has published October 2026 security fixes for Android, covering versions 14, 15, 16, 16-qpr, and 17. The updates, known as the October Android security bulletins, address several Critical vulnerabilities that could be exploited without user…
Malwarebytes -
Fake Cloudflare checks on 100 websites install LunexStealer malware
CERT-UA reports that attackers compromised over 100 websites by injecting malicious JavaScript that presents a fake Cloudflare bot-check. When a visitor runs the suggested command on the fake page, the browser downloads and installs an MSI package from an…
-
Hadrian raises $40 million to expand its AI-driven security platform
Hadrian, the Amsterdam-based maker of an AI-native offensive security platform, has raised $40 million in a Series B round, bringing total funding to $65 million. The new cash — co-led by Forgepoint Capital International and SmartFin with participation from…
SecurityWeek -
Four attacker groups exploited Citrix NetScaler flaw to gain privileged access
Four attacker clusters exploited CVE-2026-88771 in Citrix NetScaler before and after Citrix’s public disclosure, planting web shells and achieving highly privileged access. At least eight eSentire customers were affected across the post-disclosure activity,…
-
Phishing Emails Hide Prompts to Manipulate AI Summaries and Payments
Attackers are hiding prompts instructing AI assistants inside phishing emails, in addition to traditional lures aimed at human recipients. Barracuda’s 7 October 2026 analysis describes campaigns that combine social engineering—such as password-protected…
Infosecurity -
Advantest Confirms Hackers Stole Sensitive Personal Data in Ransomware Attack
Advantest, the Japanese chip testing equipment maker, has disclosed that personal data was exfiltrated in the ransomware incident first disclosed in February 2026. The company now says hackers stole a range of personally identifiable information from its…
SecurityWeek -
Alleged Ploutus ATM Malware Mastermind Appears in Nebraska Court
Anibal Alexander Canelon Aguirre, a Venezuelan national also known by the aliases “Prometheus” and “The Engineer,” appeared in a Nebraska district court on 7 October 2026 after being arrested by federal authorities. The 50-year-old is alleged to be the…
DataBreaches -
Indiana County Recovers Most Funds Lost in Vendor Email Scam
De Kalb County, Indiana has fallen victim to a vendor impersonation billing scheme, marking a second cybersecurity incident for the county in just over a year. The Star reports that on 1 October 2026, a financial payment was made after an employee was…
DataBreaches -
79% of CISOs Must Manage AI Risk Without More Resources or Expertise
The Hacker News article discusses Proofpoint’s 2026 Voice of the CISO findings, which show cyber risk is moving inside the organisation’s actual workflows rather than just up at the perimeter. Over five years, the centre of gravity has shifted: AI governance…
The Hacker News -
Group IB warns Telegram claim does not prove ASOS customer data was stolen
Group-IB researchers have traced the Telegram account used in the alleged ASOS incident to a channel formerly active in gaming-item trading. The account behind the claimed “Xuanyewen” label appears to have been newly created on 6 October 2026, with prior…
Infosecurity -
FBI Warns FortiBleed Attackers Are Still Stealing Fortinet Credentials
The FBI and US Secret Service have warned that the FortiBleed credential-harvesting operation remains active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The campaign is believed to rely on reused or leaked credentials and…
The Hacker News -
FortiBleed Campaign Locks Administrators Out of 86,000 FortiGate Devices
On 6 October 2026, a joint Cybersecurity Advisory from the FBI and the U.S. Secret Service warned that FortiBleed remains an active global credential‑harvest campaign targeting internet‑facing Fortinet FortiGate firewalls and Fortinet SSL VPN gateways.…
SOCRadar
