News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Wed 21 Oct· 96 articles
-
Compromised GitHub account slipped secret stealer into OVHcloud CLI releases
OVHcloud has revealed that a developer’s GitHub account was compromised, leading to the insertion of a secret-stealing binary into the company’s official OVHcloud CLI tool. The tampered releases appeared in versions from v0.11.0 up to v0.15.0, with clean…
SecurityWeek -
Pegasus Spyware Infected Serbian Rector’s iPhone Before Election
Citizen Lab has confirmed that NSO Group’s Pegasus spyware was on the iPhone of Vladan Đokić, the Rector of the University of Belgrade, infected in 2026. The infection was achieved via a zero-click exploit, meaning no action by the user was required. The…
Security Affairs -
PHP2 articles this day · Ars Technica first
PHP Prepares Emergency Fixes for Two Critical RCE Flaws · PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts
-
PHP Prepares Emergency Fixes for Two Critical RCE Flaws
PHP has issued an out-of-cycle security release addressing two critical PHP RCE flaws, collectively nicknamed php2shell, with a CVSS v4.0 score of 9.2. The vulnerabilities are identified in the leak as CVE-2026-109618 and CVE-2026-109619. Researchers from…
-
PHP Warns of Critical Flaws That Could Expose 1.3 Million Hosts
PHP maintainers warned that two critical vulnerabilities, rated 9.2 out of 10, are expected to be patched imminently. In an advisory published on 20 October 2026, they urged all PHP users to prepare to upgrade as soon as the releases are available, while…
-
-
Accenture, Dragos and SANS launch $10m cyber fund for US utilities
Accenture, Dragos and the SANS Institute have launched a $10 million Community Cyber Resilience Foundation to help under-resourced U.S. utilities defend their operational technology (OT) environments, focusing on water, electric and natural gas sectors. In…
SecurityWeek -
Critical CouchDB Flaw Lets Admins Run Shell Commands, Apache Warns
On 20 October 2026, Apache disclosed six vulnerabilities affecting Apache CouchDB, led by a critical CVSS 9.3 flaw that allows a CouchDB admin to run arbitrary shell commands as the operating system user. The issues span pre-authentication and authenticated…
-
Oracle Patches 203 Fusion Middleware Flaws, Including Four Critical Bugs
Oracle has issued its October 2026 Critical Patch Update for Oracle Fusion Middleware, patching a total of 203 vulnerabilities across three products. Four of the flaws are CVSS 10.0 criticals, with 131 patches exploitable remotely without authentication. The…
-
Lazarus Group abuses South Korean security software in FlashHole campaign
Operation FlashHole is a Lazarus Group campaign that uses a multi-stage malware chain anchored to South Korea, first observed in July 2025. The operators repurposed legitimate South Korean software, notably CrossWeb EX (a mandatory financial-security tool),…
securelist.comLazarus Group -
eMudhra Revokes Eight CAs After Private Keys Were Created One Byte Long
Eight intermediate certificate authorities from Indian firm eMudhra have had their certificates revoked after a script error during a key-creation ceremony produced private keys only one byte long. The issue primarily affects personal signing certificates…
-
Mozilla Blocks Weak eMudhra Keys That Could Enable Website Impersonation
Mozilla blocked eight compromised eMudhra intermediate certificates after learning on 17 October 2026 that their private keys had been exposed. The certificates can be used to sign HTTPS certificates, so possession of their keys could allow an attacker to…
-
Industrial Defender Adds Network Monitoring to Help Utilities Meet NERC CIP Rules
Industrial Defender announced a new version of its operational technology cybersecurity platform on 20 October 2026, adding internal network security monitoring (INSM) and Risk Signal. The company says the release is designed to help operators meet the…
SecurityOnline -
Google Chrome 156 Fixes 353 Security Flaws, Including Six Critical Bugs
Google released Chrome 156 to the stable channel on 20 October 2026, fixing 353 security issues. The update includes six vulnerabilities described in the article as critical, affecting Skia, Accessibility, CSS, Paint and WebRTC. Most involve memory…
-
Apache Tomcat fixes authentication bypass and data leaks in key releases
Apache disclosed eight vulnerabilities in Tomcat on 20 October 2026. Three are rated Important by the project, including CVE-2026-101296, an authentication bypass affecting JNDI realms that use a non-GSSAPI SASL mechanism: an attacker may be able to log in…
-
MariaDB fixes seven flaws, including a file access bug that could enable code execution
MariaDB disclosed seven vulnerabilities on 16 October 2026: three rated critical with CVSS scores of 9.9, two high and two medium. The flaws affect versions 10.6, 10.11, 11.4, 11.8, 12.3 and 13.0 before the relevant fixes. A low-privileged database account…
-
Oracle’s October Patch Fixes 1,209 CVEs, Including Six Critical Flaws
Oracle’s Critical Patch Update for October 2026 has a large slate, delivering 1,295 security updates that fix 1,209 unique CVEs across 33 product families, from databases to retail and healthcare software. The update, released on 20 October 2026, includes…
-
30 Flaws Threaten Advantech Industrial Units, Enabling Remote Attacks
Singapore’s Cyber Security Agency disclosed 30 vulnerabilities affecting Advantech ADAM-3600 industrial remote terminal units (RTUs) on 20 October 2026. The devices are used for industrial data collection and remote monitoring, including at utilities and…
