News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Thu 15 Oct· 78 articles
-
SecTor 2026 Draws 6,500 as AI Security Takes Centre Stage
SecTor 2026, Canada’s largest cybersecurity conference, closed in Toronto with landmark attendance and a notable 22% year-on-year growth in interest. The event drew over 6,500 verified attendees to the Metro Toronto Convention Centre for 40 Briefings…
Dark Reading -
AI-Enabled Espionage Campaign Targets Government Linux Systems
Unit 42 identifies an AI-enabled espionage campaign dubbed CL-UNK-1211, targeting government Linux infrastructure and extended across Linux servers and databases. The operation ran from October 2025 to April 2026, with attackers pursuing broad…
-
F-Secure launches scam guide as victim losses more than double
F‑Secure has launched what it describes as a victim‑centred Scam Encyclopedia, a living, online resource cataloguing more than 50 distinct consumer fraud schemes. Built from years of threat intelligence work, the guide explains scams from the victim’s…
Dark Reading -
AI Is Making Cyberattacks Noisier, Not More Sophisticated
Prominent threat actors are curbing their use of artificial intelligence in cyber campaigns, according to Proofpoint researchers. In a briefing shared with Dark Reading, the TA4903 operation—previously a sophisticated credential-phishing and business email…
Dark ReadingTA4903 -
Targeted ads infected 45 Al Jazeera devices with zero click spyware
Researchers from the University of Toronto’s Citizen Lab say they have found mercenary spyware delivered via targeted ads that exploit devices with zero user interaction. Dubbed AdFection, the campaign operated on both iOS and Android and could install…
Ars Technica -
Critical Linux Flaw Lets Virtual Machines Read Host Memory
A newly disclosed critical vulnerability in the Linux kernel, tracked as CVE-2026-99999 and nicknamed PwnEscape, allows code running inside a guest virtual machine to read memory from the host. The flaw sits in the kernel’s networking code and affects the…
-
CISA Flags Exploited Firewall, Email Gateway and Backup Software Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four newly observed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The list comprises CVE-2026-0322 (Palo Alto Networks PAN-OS code injection), CVE-2026-76519…
-
Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally
ThreatsDay this week showcases a broad mix of exploits, from widely exploited remote code execution chains to novel attacker use of DNS and AI-enabled tooling. The headline concern is active exploitation of PAN-OS GlobalProtect/Prisma Access via…
-
RARLAB WinRAR2 articles this day · The Hacker News first
Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government · Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
-
Kazakhstan Based Espionage Group Exploits CVE to Target Energy and Government
Silent Lynx, a threat actor believed to be based in Kazakhstan, has been observed conducting espionage campaigns against energy and government targets across Central Asia, including an assault on the Orsk Oil Refinery in southern Russia and the government of…
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
Silent Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE…
-
-
CISA Flags Critical Atlassian Flaw Letting Attackers Access Files
CISA added CVE-2026-21589 to its Known Exploited Vulnerabilities (KEV) catalogue on 15 October 2026. The flaw affects multiple Atlassian products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software…
-
Contextual AI Defence Aims to Stop Attackers Before Breaches Escalate
Context is king in the fight against modern cyberattacks, argues Etay Maor, reframing how security teams detect and respond to intrusive activity. The piece emphasises that attackers no longer rely on a single dramatic exploit; instead they exploit chained,…
SecurityWeek -
Cloudflare Adds Edge Workers to Transform Traffic and Extend Security Rules
Cloudflare has announced true programmability for its Cloudflare Gateway and Data Loss Prevention (DLP) capabilities, integrating them with its edge computing platform. Moving beyond traditional static security stacks, the company introduces a new Gateway…
Cloudflare -
Vibetech Database Exposes 13.7 Million Records From Older Breaches
An unprotected database connected to Vibetech, an India‑based AI software development and IT services company, exposed 13.7 million records containing credentials and other sensitive information from prior breaches. The repository was openly accessible…
DataBreaches -
Caramel Tsunami2 articles this day · Security Affairs first
Candiru spyware reached real devices through targeted online ads, Citizen Lab finds · Spyware Firm Used Adverts to Target Users With Zero Clicks
2 outlets-
Candiru spyware reached real devices through targeted online ads, Citizen Lab finds
A report by the Citizen Lab confirms a zero-click spyware operation linked to Candiru targeted Al Jazeera and other organisations through online advertising. The researchers found that the attack ran as soon as an advertisement loaded, with some callbacks…
The Hacker News -
Spyware Firm Used Adverts to Target Users With Zero Clicks
The investigation by Citizen Lab, as reported by Security Affairs, reveals that spyware operators used online advertising infrastructure to profile targets and deliver exploits without requiring users to click anything. The focus is Discover-Tech, linked to…
Security Affairs
-
-
Security Teams Must Prioritise Exploited Flaws, Not CVSS Scores
Organisations are drowning in vulnerability data, facing millions of vulnerabilities across countless assets. The piece argues that vulnerability management must move away from vendor-generated scores and toward real exploit data that reflects each…
Dark Reading -
UK Legal Aid Agency Breach Exposed Records Dating Back to 1978
The UK’s Legal Aid Agency (LAA) has disclosed that a 2025 data breach exposed records dating back to 1978, with forensic review expanding the known scope. While initial disclosures in May 2025 described unauthorised access and data exfiltration affecting…
SecurityWeek -
Google Patches Seven Critical Chrome Flaws That Could Enable Remote Code Execution
Google has issued Chrome updates across desktop and Android to address a batch of security flaws, including seven rated as Critical. The desktop release, rolling out to Chrome 155.0.8059.79/.80 for Windows and macOS and 155.0.8059.79 for Linux, accompanies a…
-
Help TDS hijacks websites to funnel visitors into tech support scams
The Hacker News reports that a long-running Traffic Distribution System (TDS) known as Help TDS is again being tied to the Hotejka ecosystem, believed to be a rebrand of ROI777. The operation has been active since at least 2017 and works by injecting PHP…
The Hacker NewsHotejka -
Cloudflare Unveils Void to Build and Deploy Full Stack Vite Apps
Cloudflare has announced three new open‑source products that integrate server routing, typed data access, and Cloudflare deployment into a unified Vite workflow, under the banner of Void. The Void Platform provides a shared deployment environment for teams…
Cloudflare -
China Linked ARMORY CASTLE Exploited BeyondTrust Flaw as a Zero Day
Google Threat Intelligence Group (GTIG) and Mandiant say the suspected China-linked espionage group ARMORY CASTLE, formerly tracked as UNC5221, exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 as a zero-day in late August 2026. BeyondTrust…
-
cURL Fixes High Severity HTTP/2 Flaw That Could Crash Upload Clients
The cURL CVE-2026-92392 vulnerability enables remote code execution during HTTP/2 uploads. Update to cURL 8.23.0 or disable HTTP/2 to protect systems. Related Posts: Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update Citrix Patches…
SecurityOnline -
Windows 11 Update Breaks Enterprise Wi-Fi Authentication
Microsoft has flagged that the Windows 11 cumulative update KB5127648, released on 15 October 2026, can disrupt enterprise Wi-Fi authentication. Reports from network administrators indicate that WPA2-Enterprise, 802.1X, and PEAP authentication fail during…
SecurityOnline -
Danfoss StoreView Exposure Plunges After French Supermarket Cyberattack
Internet-exposed Danfoss StoreView controllers in France have been disappearing from public view at a rapid pace in the wake of a cyber incident affecting hundreds of French supermarkets’ food supplies. Censys researchers reported a 71% drop in…
-
Cloudflare Helps ChatGPT Discover Hundreds of Millions More Web Pages
Cloudflare and OpenAI describe a research pilot launched in July to improve AI-driven discovery of web content. The aim is to help ChatGPT find and surface more useful pages by using signals from Cloudflare’s network to augment OpenAI’s crawlers. Early…
Cloudflare -
Aoki Infostealer Targets AI Coding Credentials to Hijack Developer Accounts
New versions of the Aoki infostealer are targeting credential and session files used by popular AI coding assistants, according to a Symantec report. The latest development marks a shift from earlier Aoki variants, which focused on browser data,…
InfosecurityAoki -
NGINX fixes five flaws, including a bug dating back to 2005
NGINX has released version 1.30.6 and 1.31.7 on 14 October 2026 to fix five vulnerabilities, one of which has existed in every release since May 2005. The advisory from F5 (the maker of the NGINX ecosystem) describes three memory-related flaws that could…
The Hacker News -
Malwarebytes Launches Free Tool to Check Suspicious Links Before Clicking
Malwarebytes has published a public-facing explainer for its Scam Link Check tool, a free service designed to help users determine whether a suspicious link is likely safe before clicking. The article introduces Scam Link Check as a quick, on-demand…
Malwarebytes -
Cyberattack on French Supermarkets Spreads to More Cooling Controllers
France’s national cybersecurity agency ANSSI and CERT-FR say a cyberattack disrupting supermarket refrigeration has widened to affect Copeland XWEB and Dixell XWEB controllers, in addition to earlier Danfoss AK-SM and AK-SC units. In total, around 700 of…
SecurityWeek -
Next.js Patches Critical Flaws That Could Let Attackers Run Code
Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high-severity denial-of-service flaw. One code-execution flaw is in React Server Components, and the…
-
Ransomware Gangs Threaten Workers’ Families to Force Payments
Ransomware gangs are expanding their extortion beyond encrypting files to targeting employees and their families. The piece cites the Semperis 2026 Ransomware Risk Report, which found that 37% of successful attacks included threats against workers’ friends…
DataBreaches -
UK Legal Aid Agency Breach Exposed Data Dating Back Before 2007
An update on the UK Legal Aid Agency (LAA) cyberattack reveals that data compromised in the 2025 breach extends much farther back than previously understood. The agency has completed analysis to identify the date range and types of information affected,…
DataBreachesShinyHunters -
Drupal Patches Critical Field UI Flaw That Could Enable Unauthenticated RCE
Drupal has patched a critical unauthenticated RCE flaw in its Field UI core module (CVE-2026-108097) that could be exploited via contributed modules and custom code. The Drupal Security Team says an attacker cannot reach the flaw through core alone;…
-
FTC Accuses Sextortion Firm of Defrauding Victims of $60 Million
The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated firms of defrauding people targeted by sextortion. The agency says victims paid at least $60 million for so-called “Phase…
Malwarebytes -
Fake AI Campaigns Target US Firms With Malware Hidden in Downloads
Attackers are fanning out fake AI campaigns across US companies by impersonating well-known AI services such as Claude, ChatGPT, GitHub Copilot and Gemini. The campaigns push malware through suspicious download pages, fraudulent authentication pages and…
The Hacker News -
LiteLLM flaws could hand attackers admin access and expose AI keys
Two high‑risk vulnerabilities have been disclosed in LiteLLM, a widely adopted open‑source LLM gateway tool used to connect AI applications to providers including OpenAI, Google and Anthropic. The flaws, tracked as CVE-2026-35029 and CVE-2026-59823, affect…
-
CikaBika Bot Uses Discord to Control Infected Windows PCs
Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.
SecurityWeek -
AI tool Raven can identify locations from a single interior photo
Graylark has developed Raven, an AI-based location-matching tool that can identify an indoor location from a photo without relying on GPS data. The system compares interior images against a large catalogue of property photos and uses visual features—such as…
Malwarebytes -
SANS Frameworks Put Human Oversight at the Heart of AI Investigations
Two new frameworks from SANS aim to tighten governance around AI-assisted digital forensics and incident response, mapping AI-assisted workflows to established standards. The Digital Forensics & AI Investigations Framework aligns with SWGDE’s trusted…
The Hacker News
