News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Mon 19 Oct· 60 articles
-
ConnectWise Takes Cloud Services Offline After Microsoft 365 Breach
ConnectWise has suspended access to several cloud services after detecting unauthorized access to Microsoft 365 tenants. The investigation began on 15 October, with the company confirming on 19 October that the attackers accessed application identities…
Infosecurity -
Fake Web3 Accelerator Plants Data Stealers in Malicious npm Packages
A fake Web3 accelerator, allegedly called Apex Accelerator and tracked as REF8801, has been observed distributing information-stealing malware and backdoors through malicious npm packages. The two packages, @apexacc/cli and @apexacc/audit, were marketed as…
The Hacker NewsREF8801 -
US Cybersecurity Job Postings Fall 26%, CISO Roles Plunge 39%
US cybersecurity job postings fell by 26.4 per cent year on year from January to September 2026, according to CyberSN’s analysis. A total of 235,786 cybersecurity roles were posted in 2026 on JobSpikr, the lowest figure in the four years CyberSN has tracked…
Infosecurity -
Roundcube Patches 20 Flaws, Including IMAP Injection and XSS Attacks
Roundcube has released security updates for versions 1.6.20 and 1.7.5 on 19 October 2026, addressing a total of 20 vulnerabilities spanning IMAP command handling, header processing, and several webmail-specific flaws. The advisory notes that these fixes…
SecurityOnline -
MITRE ATT&CK v20 Adds AI Attacks and Water Utility Campaigns
MITRE has released ATT&CK v20, expanding coverage across Enterprise and ICS with 15 new detection strategies and 38 analytics. In the Enterprise domain, the update adds several techniques and sub-techniques, including two variants of prompt injection—one for…
SecurityWeek -
ConnectWise Cloud Backup Breach Exposed Microsoft 365 Data and Access
ConnectWise disclosed that attackers gained unauthorized access by abusing stolen credentials tied to ConnectWise Cloud Backup (formerly SkyKick) application identities. The incident came to light after internal monitoring on 14 October 2026, with seven…
Security Affairs -
Anthropic Buys Opaque Systems to Secure Sensitive AI Data
Anthropic has announced the acquisition of Opaque Systems, a startup specialising in confidential and verifiable AI. Opaque has developed technology intended to allow AI systems to access sensitive data while keeping it protected by the underlying hardware.…
SecurityWeek -
Attackers Exploit SiteGuard WAF Flaw to Gain Root Access
Attackers are actively exploiting CVE-2026-106931 in SiteGuard Server Edition, a vulnerabilities disclosed by EG Secure Solutions and referenced by JVN. The flaw is an OS command injection that, once successfully exploited, lets an attacker run commands with…
-
Eiliko Robot Flaws Expose Private Conversations and Let Hackers Alter Its Speech
Malwarebytes Labs’ weekly round-up covers stories published between 12 and 18 October 2026. It highlights security and privacy issues involving consumer devices, online services and organisations, alongside scams and emerging risks linked to artificial…
Malwarebytes -
Broadcom Router Flaw Lets Nearby Attackers Run Code as Root Over Wi-Fi
A security researcher has disclosed a flaw in Broadcom’s Wi‑Fi setup software that could let an attacker in radio range execute code as root on Broadcom-based routers without needing a network password or any pairing step. The bug affects Broadcom’s…
The Hacker News -
Attackers Hijack AOMEI Updates to Deploy Backdoors on Enterprises
Between April and July 2026, UNC7017 attackers tampered with AOMEI’s official update infrastructure for brief windows of five to ten minutes, delivering the CROSSROAD downloader and SHINYROAD backdoor to enterprise systems during those moments. They modified…
SecurityOnlineUNC7017 -
OpenCode Breach May Expose AI Provider Keys, Prompting Revocations
OpenCode has disclosed that an intruder gained access to a legacy system on the night of 16 October, potentially exposing third‑party API keys that users had saved in OpenCode Console. Console is OpenCode’s optional hosted workspace that stores provider keys…
The Hacker News -
Microsoft links Exchange server failures to a new Windows memory cap
Microsoft warns that Exchange Server instability observed after October 2026 Patch Tuesday is linked to Windows updates, not an Exchange patch. Since 13 October 2026, some on‑premises Exchange servers under heavy load have begun experiencing failures, with…
SecurityOnline -
Critical Linux Flaw Could Let Virtual Machines Write to Host Memory
PWNAI Research has disclosed PwnEscape, a critical Linux kernel VM escape flaw tracked as CVE-2026-99999, which was demonstrated in lab tests to leak host memory from a guest VM and could potentially allow root activity on the host. The vulnerability…
-
CISA warns of critical flaws in medical archives and EseeCloud cameras
CISA has issued two advisories detailing nine vulnerabilities in the dcm4chee-arc-light medical archive and in Guangzhou Juan IoT Technology’s EseeCloud IP cameras, with three critical flaws in EseeCloud and six in the dcm4chee archive. For…
-
Six Linux Kernel Flaws Have Public PoCs for Root Access and Escape
Researchers have publicised six Linux kernel vulnerabilities, collectively dubbed “Infinity Core,” with full PoCs that can lead to local privilege escalation and container escape. Hyunwoo Kim’s write-up includes public PoCs for five flaws that reportedly…
-
Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin
Between 12 and 18 October 2026, CVE Watchtower logged 5,499 new vulnerabilities, with this weekly review tracking 12 exploited flaws. Six of those were flagged by Daily Cybersecurity’s intelligence sources, and three of the exploited flaws are not yet…
-
Broadcom Wi-Fi flaw enables unauthenticated router attacks from 2010 code
A Broadcom Wi‑Fi vulnerability dating back to 2010 allows an attacker within Wi‑Fi range to execute code on vulnerable routers without any authentication or knowledge of the network password. The flaw resides in Broadcom’s proprietary 802.11 implementation…
Security Affairs -
Apache Kylin’s Critical SQL Injection Flaw Prompts Urgent Upgrade
Apache has disclosed a set of vulnerabilities across its Kylin, Airflow and related components, with the most severe being a critical SQL injection in Apache Kylin. The overall advisory covers 12 Kylin flaws and three Airflow provider issues, plus notes on…
-
Attackers Exploit Plex Flaws to Run Cryptominers and Proxy Tools
Attackers have begun exploiting Plex Media Server vulnerabilities in the wild, following a full write-up and PoC by researcher Zach Main on 17 October 2026. The exploit chain, dubbed Plex2Shell, combines four CVEs to achieve unauthenticated remote code…
