News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Tue 13 Oct· 85 articles
-
NVIDIA AIStore flaw scores CVSS 10 and risks remote code execution
NVIDIA has released six security advisories on 13 October 2026, addressing 18 vulnerabilities across its AI software stack. The most critical entry is CVE-2026-65162, rated CVSS 10.0, which affects NVIDIA AIStore and could allow remote code execution. Eight…
-
Microsoft Windows4 articles this day · thezdi.com first
Microsoft fixes over 1,400 flaws, including a Windows zero day · Microsoft patches actively exploited Windows flaw that bypasses security checks
-
Microsoft fixes over 1,400 flaws, including a Windows zero day
Microsoft has issued a sweeping patch batch fixing more than 1,400 security vulnerabilities across Windows operating systems and related software. The roll-up dwarfs September’s near-1,000 fixes and underscores an unusually large month for Microsoft’s patch…
-
Microsoft patches actively exploited Windows flaw that bypasses security checks
On 13 October 2026, Dark Reading reports Microsoft’s October Patch Tuesday as the largest update yet, with 1,413 Microsoft CVEs disclosed. The haul includes 80 critical flaws and two zero-day bugs, one of which is actively exploited. The patched issues span…
-
Microsoft Patches Windows Shell Zero Day Exploited in the Wild
Microsoft’s October 2026 Patch Tuesday swells to a much larger cycle than last month, with 1,413 disclosed vulnerabilities across its own products, of which 1,102 are in Windows.
-
Adobe and Microsoft Patch Thousands of Flaws in Record Update
The October 2026 security update cycle sees Adobe patching across 11 bulletins addressing 174 CVEs spanning Dimension, Commerce, Substance 3D, Bridge and related tools, with several critical issues. Notably, Adobe ColdFusion (APSB26-144) contains 32 critical…
-
-
OpenAI Engineer Arrested After Hidden Recording Device Found in Office
An OpenAI engineer, Abdulrahman Alfozan, a 35-year-old Saudi national, has been arrested and terminated after a recording device was found in a conference room. The device, concealed in toilet paper and connected via a USB port at the back of a television,…
SecurityWeek -
Weak VPN controls let attacker probe a European bank for months
An investigation by Unit 42 recounts a European bank’s security incident that began with unauthorized VPN-based access attempts to its central IT system over several months. The intrusion stemmed from gaps in basic security controls rather than novel…
unit42.paloaltonetworks.com -
North Korean Hackers Target Ukraine With Reply Bait Phishing
North Korean state-sponsored actors have been conducting spear-phishing campaigns aimed at Ukrainian government, policy, and academic circles to prise out war-related intelligence. Researchers describe the operation as a relatively crude but ongoing effort…
Dark ReadingKimsuky -
South African Lab Ampath Probes Attack After 80 Million Records Claim
Ampath Laboratories, one of South Africa’s largest pathology service providers, says it was the target of a cyberattack with the attacker claiming that more than 80 million patient records were exfiltrated. The claim comes from ByteToBreach, a threat actor…
DataBreachesByteToBreach -
Researchers Show AI Worm Could Spread Across Insecure Android Devices
Anthropic researchers William Zhou and Daniel Freeman explored the theoretical and practical steps by which an AI-based worm might propagate across insecure devices and networks. In a set of experiments, they used a network of inexpensive Android TV boxes…
Dark Reading -
Microsoft Patches Windows Shell Flaw Exploited in Malicious File Attacks
Microsoft’s October 2026 Patch Tuesday patches across a wide attack surface, addressing 1,417 disclosed vulnerabilities, with 76 rated as critical. The update set includes fixes for a substantial number of Office and .NET/Framework components, plus notable…
SANS ISC -
Docker Hub2 articles this day · The Hacker News first
Docker fixes critical flaw that could hijack developers’ access tokens · Docker Hub patched critical GhostPat flaw that let attackers hijack image access
-
Docker fixes critical flaw that could hijack developers’ access tokens
Docker Hub has released a security advisory for CVE-2026-105445, describing a token flaw that could enable an attacker to secretly reassign a target user’s personal access token (PAT) during an account-to-organisation conversion. The flaw, rated CVSS 9.4…
-
Docker Hub patched critical GhostPat flaw that let attackers hijack image access
Docker has patched a critical vulnerability in Docker Hub that allowed one user to perform actions on another user’s images, effectively letting an attacker push, pull or delete images under a different identity. The flaw lived in the feature that converts a…
-
-
Ivanti Connect Secure7 articles this day · SecurityOnline first
Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials · CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution
-
Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials
SecurityWeek reports that Ivanti has disclosed a zero-day chain affecting its Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, which allowed unauthenticated remote code execution with elevated privileges. The issue was exploited in the wild,…
-
CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, CVE-2026-104935, carries a CVSS of 8.6 and is described as an authentication bypass caused…
-
Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In
An attacker chained three Ivanti Connect Secure zero-days to gain root-level access without logging in, with the exploitation observed in the wild starting on 3 October and disclosure on 13 October 2026. The first two flaws form an authentication bypass and…
-
Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive
Ivanti Connect Secure has a high‑severity zero‑day, CVE-2026-104935, described by Ivanti as an unauthenticated authentication bypass (CWE-290) that allows remote command execution. The vulnerability, rated CVSSv3.0 8.6, affects Ivanti Connect Secure…
-
Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs
Ivanti Connect Secure (ICS) devices were found to be exploited in a chained zero‑day sequence, beginning in early October 2026. Security firm Volexity and Ivanti report that a threat actor, tracked as UTA0576, used an authentication bypass to reach a…
-
CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalogue on 13 October 2026. The entry affects Ivanti Connect Secure and describes an authentication bypass by spoofing that lets a remote, unauthenticated attacker execute arbitrary…
-
Ivanti Connect Secure flaw bypasses authentication in active attacks
Ivanti Connect Secure has a newly disclosed vulnerability, CVE-2026-104935, which Ivanti confirms is being exploited in the wild. The flaw allows a remote, unauthenticated attacker to bypass authentication by spoofing and then execute arbitrary commands on…
-
-
Anthropic warns AI worms could turn smart TVs into self-spreading botnets
Anthropic has warned that small AI models could soon develop autonomous, self-propagating capabilities on internet‑connected devices such as IoT ovens and Android TV boxes. The concern is that these “AI worms” could replicate themselves across compromised…
The Hacker News -
Wazuh fixes 15 flaws that could let attackers take over deployments
Fifteen Wazuh vulnerabilities, including two CVSS 9.4 flaws that allow remote code execution as root, are fixed in 4.14.8. Upgrade managers and agents now. Related Posts: Docker Hub Security Advisory: CVE-2026-105445 Token Flaw Fortinet Patches Critical…
-
Fortinet Patches Critical Flaws Enabling Unauthenticated Remote Attacks
Fortinet has released a set of patches addressing 13 vulnerabilities across eight product lines, issued on 13 October 2026. The most serious flaws are two unauthenticated, remote-exploitation risks: an authentication bypass in FortiSandbox (CVE-2026-107656)…
-
Critical SAP Python SDK flaw could expose OAuth credentials via SSRF
SAP has disclosed a critical SSRF flaw in its Cloud SDK for Python that can exfiltrate OAuth2 client credentials. The vulnerability, tracked as CVE-2026-89111, affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the Python…
-
Adobe Patches 140 Flaws Across Ten Products, Including Commerce
Adobe has published ten security advisories detailing around 140 vulnerabilities across ten products, including ColdFusion, Commerce, Photoshop, Substance 3D, Dimension, FrameMaker and Bridge. The disclosures show a broad patch effort with specific focus in…
SecurityWeek -
Google quadruples Chrome memory bug bounty rewards after backlash
Google has signalled a partial U-turn on its Chrome bug bounty reforms, moving to lift rewards for memory safety vulnerabilities while keeping a tighter overall structure. After cutting base payouts in April to prioritise actionable reports, the company has…
SecurityWeek -
Cloudflare redesigns D1 to handle millions of serverless databases at scale
Cloudflare’s D1 is a serverless SQLite-based database designed to scale to millions of databases.
Cloudflare -
GitHub Tightens npm Trust After SlugFest Exposed Package Hijacks
GitHub has tightened npm trusted publishing after researchers exposed a weakness that could let attackers hijack packages without credential theft. The changes, announced 48 hours after a trusted publishing configuration is created, mean unvalidated…
The Hacker NewsBloom Security -
Zoom Patches Four High Severity Flaws in Workplace Clients
Four Zoom Workplace vulnerabilities, including privilege escalation and certificate flaws rated up to CVSS 8.1, are now fixed. Update to 7.2.0 or later. Related Posts: Docker Hub Security Advisory: CVE-2026-105445 Token Flaw Wazuh Fixes 15 Vulnerabilities,…
-
Stolen Employee Credentials Expose Meta Code, Affect 1,500 People
Meta has disclosed that roughly 1,500 individuals were affected by an intrusion linked to GitHub repositories containing the company’s software code. The incident, detected in the preceding weeks, involved an outside group gaining access using an employee’s…
SecurityWeek -
Cloudflare Cuts Data Traffic by 70 GB/s to Keep Its Backbone in Check
Cloudflare reports that more than 20% of the web sits behind its network, and the Data team runs the data pipeline powering Logs, SQL API, observability and more. Faced with traffic growing at exponential rates against linear hardware growth, the team…
Cloudflare -
Ivanti flaws expose Intune and Xtraction credentials, prompting secret rotation
Ivanti released two security advisories on 13 October 2026 detailing six vulnerabilities across Neurons Patch for Intune and Ivanti Xtraction, with two rated CVSS 9.9. The disclosures emphasise credential theft risk, noting that stolen secrets could grant…
-
Siemens Warns of Critical Flaws in SIMATIC S7-1500 Web Server
Siemens has disclosed eight unpatched flaws in the SIMATIC S7-1500 Web Server, disclosed on 13 October 2026. The vulnerabilities reside in the web server’s Trace page and are linked to improper handling of data in imported trace files, enabling cross-site…
SecurityOnline -
LiteLLM flaws let attackers seize admin access and run code remotely
Check Point Research’s assessment, published on 13 October 2026, scrutinised LiteLLM v1.77.7, a popular open‑source LLM gateway. They identify several high‑severity flaws that could enable attackers to bypass access controls, read arbitrary files, seize…
Check Point -
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices
Anthropic researchers have published findings showing that very small AI models could autonomously replicate across networks of IoT devices, raising concerns about AI-powered botnets. In their experiments, a 26‑billion‑parameter model, Gemma4-26B-A4B, was…
Security Affairs -
Cyber incidents disrupt European retailers as attacks hit key brands
Several European retailers have confirmed cyber incidents disrupting operations. Netherlands-based Ahold Delhaize said on 12 October 2026 that it was experiencing “a security issue” within its networks and had to take certain systems offline, affecting three…
Infosecurity -
GitLab patches critical flaw letting attackers run code without logging in
GitLab has patched a critical vulnerability tracked as CVE-2026-97229 with a CVSS v3 score of 10.0, which could allow unauthenticated attackers to run arbitrary code on GitLab servers. The flaw stems from weak validation of regular expressions in CI/CD…
-
n0n Extortion Group Targets 38 Maritime Operators in Data Theft Campaign
The SOCRadar cyber threat tracker reports that the n0n extortion group expanded its activity on 12 October 2026 by adding 38 global ports, shipping lines, port IT providers and related operators to its Dark Web leak site. The batch spans Brazil, Spain,…
SOCRadarn0n -
Only 25% of Security Teams Use Agentic AI in Active Defence
Defenders are still reluctant to deploy agentic AI as a core cybersecurity tool, even as organisations pour resources into AI for defence. The Enterprise Threat Intelligence Report: 2026 from Flashpoint finds only a quarter (25%) of security teams are…
Infosecurity -
Microsoft-Owned Xandr Fined €8.6 Million Over Grindr Data Sharing
The Norwegian Data Protection Authority has fined Xandr, the advertising arm once owned by AT&T and now under Microsoft, €8.6 million (about $9.62 million) for unlawfully relaying Grindr users’ sensitive data to advertisers. The breaches occurred between…
The Hacker News
