News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Thu 22 Oct· 84 articles
-
PHP7 articles this day · SecurityOnline first
PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches · Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable
-
PHP Flaw Disclosures Trigger Widespread Scanning, but Not Confirmed Breaches
Darktrace reports that the October 2026 disclosures of CVE-2026-109618 and CVE-2026-109619, both allowing unauthenticated remote code execution in PHP contexts, prompted widespread scanning of internet-facing PHP deployments. Public guidance emphasised…
-
Exposed PHP2Shell tooling targets PHP 8.4, but no sites were vulnerable
SOCRadar Threat Intelligence Unit researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed via an open, unauthenticated directory listing. The central asset is a lab-tested PHP2Shell remote code…
-
AWS Saw PHP2Shell Attacks Before Two Critical PHP Flaws Were Disclosed
AWS Threat Intelligence detected PHP2Shell exploitation attempts four days before public disclosure of the two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. The earliest activity, dating to 17 October 2026, appeared in MadPot telemetry…
-
Gcore Offers Free Web Protection to Governments After PHP Attacks
Gcore has announced that its WAAP Enterprise plan will be free for public agencies and government bodies until 31 December 2026. The move follows the php2shell vulnerabilities that disrupted public websites across Europe earlier in the week. Gcore states…
-
Attackers Target Critical PHP Flaws Before Patches Were Released
SecurityWeek reports a coordinated industry and government response to two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution. The bugs were identified by Wiz, OpenAI and Calif in August, with PHP…
-
cPanel Patches Actively Exploited PHP Flaws Threatening Shared Hosting
Cpanel has released security updates addressing two PHP2Shell flaws and a WP Toolkit bug that affect shared hosting environments. The patches cover three CVEs: CVE-2026-109618 and CVE-2026-109619 in PHP, and CVE-2026-107663 in WP Toolkit. The PHP fixes are…
-
QNAP Warns of Active PHP Flaws as Device Patches Remain Unavailable
QNAP has warned that two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in PHP itself threaten QTS, QuTS hero, QuTScloud and several QNAP apps. The flaws permit unauthenticated, remote code execution, with exploitation attempts already observed in…
-
-
Storm-09403 articles this day · SecurityOnline first
AI Pentesting Framework Scaled ConnectWise Attacks Across 365 Tenants · China-Linked Hackers Hit 2,250 Microsoft 365 Tenants Through ConnectWise
3 outlets-
AI Pentesting Framework Scaled ConnectWise Attacks Across 365 Tenants
Microsoft has attributed the ConnectWise Cloud Backup supply chain incident to Storm-0940, a China‑state aligned group, which it says used ARTEX, an open‑source AI‑driven pentesting framework, to scale attacks across hundreds of Microsoft 365 tenants.…
Security Affairs -
China-Linked Hackers Hit 2,250 Microsoft 365 Tenants Through ConnectWise
A Microsoft security analysis attributes the Storm-0940 operation, a China-linked threat actor, to an AI-enabled penetration-testing framework used to accelerate a supply chain attack involving ConnectWise Cloud Backup. The group leveraged compromised…
Dark Reading -
AI Agent Probes Vendors in Search of Supply Chain Access
During October 2026, Wiz Research tracked an actor leveraging the ARTEX AI agent to probe IT and software vendors, aligning with Microsoft’s Storm-0940 reporting that Chinese state-aligned groups had been involved in a supply-chain compromise using stolen…
SecurityOnline
-
-
US crackdown exposes North Korean ‘laptop farm’ scheme hitting 70 firms
The episode centres on a federal crackdown on North Korean fake IT worker schemes, highlighted by “Operation Lonestar Roundup” in Texas. Law enforcement seized 187 devices, filed charges against 14 individuals, and made several arrests in what the hosts…
Dark ReadingDataSuckers -
eMudhra Exits Global TLS Market After Eight Weak Keys Were Issued
eMudhra, the Indian certificate authority, has said it is exiting the global SSL/TLS certificate business after a fault in a key generation ceremony allowed eight intermediate certificates to be minted with dangerously weak private keys. Researchers had…
Ars Technica -
Python Urges Users to Update Tools After CA Key Compromise Threat
The piece reports that on 20 October 2026, Python’s security team urged users to update packaging tools after the eMudhra / emSign intermediate CA incident. The core risk is that eight compromised intermediate CA keys with insufficient randomness could allow…
StepSecurity -
Hackers Turn Supermarket Fridges Into Ovens in Attack on 700 Stores
French and EU grocers were hit by a large-scale cyberattack that disrupted refrigeration and caused substantial financial losses. In the early hours of a Monday, attackers compromised commercial refrigeration controllers used by major supermarket chains,…
Dark Reading -
Arista Networks VeloCloud Orchestrator2 articles this day · SecurityOnline first
Arista VeloCloud Zero Day Exploited to Gain Superuser Access · Arista VeloCloud flaw under attack lets users seize superuser access
-
Arista VeloCloud Zero Day Exploited to Gain Superuser Access
Arista has disclosed a critical zero-day vulnerability in its VeloCloud Orchestrator (VCO) that is being exploited in the wild. The flaw, tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale, is a SQL injection that can be exploited by anyone who can…
-
Arista VeloCloud flaw under attack lets users seize superuser access
Arista has disclosed that CVE-2026-114625, a critical SQL injection vulnerability in the VeloCloud Orchestrator (VCO), is being exploited in the wild. The flaw, rated CVSS 9.9, allows any authenticated user to escalate to a local “superuser operator” by…
-
-
Signal RingRTC2 articles this day · SecurityWeek first
Signal Flaw Could Keep Your Microphone Live After Calls End · Signal flaw could keep your microphone and camera active after hang-up
-
Signal Flaw Could Keep Your Microphone Live After Calls End
A critical vulnerability in Signal’s calling stack could allow a caller to keep a recipient’s microphone (and potentially camera) active after the user believes the call has ended. The flaw, tracked as CVE-2026-113380 with a CVSS of 9.3, lies in RingRTC, the…
-
Signal flaw could keep your microphone and camera active after hang-up
A critical vulnerability in RingRTC, the open source calling library used by Signal for voice and video calls, could allow a malicious caller to keep audio and video tracks active even after the user has hung up. The flaw, tracked as CVE-2026-113380 (CVSS…
-
-
eMudhra Exits SSL Business After Private Keys Are Recovered
eMudhra, an Indian certificate authority, has decided to withdraw from its global SSL/TLS certificate business. The board’s decision came five days after a researcher recovered private keys for eight of its intermediate CA certificates, six of which were TLS…
The Hacker News -
Attackers Used Stolen Credentials to Breach PingCAP and Copy Data
PingCAP has disclosed that attackers used stolen service account credentials to access internal systems between 9 September and 7 October 2026, enabling them to copy data and obtain source code. The breach also exposed customer-related records, including…
-
Weak randomness exposes eMudhra certificate keys, enabling TLS attacks
Eight eMudhra Limited intermediate certificate authority private keys were compromised due to a cryptographic defect in the certificate generation process, caused by insufficient randomness. The result is that private keys could potentially be derived from…
unit42.paloaltonetworks.com -
Linux KSMBD Flaws Enable Remote Code Execution, No Fix Yet
Two high‑severity Linux KSMBD remote code execution flaws were disclosed publicly on mailing lists in October 2026, with no fix in the mainline kernel at the time of reporting. ZDI has assigned two identifiers to these flaws: ZDI-CAN-33549, which concerns…
The Hacker News -
Attackers Target OAuth Tokens to Bypass MFA and Keep Access
The article outlines a shifting threat landscape where attackers increasingly target OAuth tokens rather than credentials to gain access, with tokens able to bypass MFA and survive password resets. It explains that, as enterprises roll out MFA, attackers…
unit42.paloaltonetworks.com -
Meta Hit With $25 Billion Penalty Over Facebook’s Data Practices
A New Mexico jury has ordered Meta to pay a civil penalty of $25 billion after finding that Facebook misled consumers about its data practices, as well as its handling of hate speech and misinformation. The verdict, reported by Reuters, tallies 43,899,725…
Malwarebytes -
Meta Ordered to Pay $25 Billion Over Misleading Privacy Claims
A New Mexico court has ordered Meta to pay 25 billion in penalties after ruling that the social media giant misled consumers about the privacy of their data. The decision ties to more than 43 million alleged violations of the state’s Unfair Practices Act,…
The Hacker News -
Hackers Probe Critical PHP Flaws Days Before Public Disclosure
Hackers had already begun probing a pair of critical PHP flaws four days before the issues were disclosed publicly, with Amazon saying the vulnerabilities were “now being broadly exploited in the wild.” The weaknesses affect PHP, a language underpinning much…
Ars Technica -
M365 Token Replay Attack Bypasses MFA at 79 Organisations
A token replay attack campaign exploited Microsoft 365 sign-in sessions to access accounts at 79 organisations, new research from Huntress and Microsoft Entra ID Protection shows. Between 14 July and 22 September 2026, attackers used adversary-in-the-middle…
SecurityOnline -
Gravwell CEO’s “Evil Bit” Mindset Drives His Mission to Secure Critical Infrastructure
Corey Thuen, founder and CEO of Gravwell, is profiled as a hacker with a distinctive mindset he calls the “evil bit” — an adversarial streak he believes is innate and essential for finding security weaknesses. The piece presents Thuen as someone who recruits…
SecurityWeek -
INTERPOL Arrests 1,462 in Africa Cybercrime Crackdown
Operation Serengeti III was an INTERPOL‑led crackdown across Africa that resulted in 1,462 arrests in 21 countries, with authorities disrupting 10,909 malicious networks and recovering more than USD 105 million. The operation ran from 29 June to 31 August…
SecurityOnline -
Text Scams Cost $470 Million as AI Makes Fraud Harder to Spot
Scammers are increasingly targeting mobile phones, exploiting their role as a primary channel for communication and authentication. The piece cites data showing texted scams caused about $470 million in losses in 2024, a 26% rise from the year before and far…
Malwarebytes -
EU Probes Booking.com Over Security and Phishing Risks
The European Commission has opened formal proceedings against Booking[.]com to assess potential security failings under the EU’s Digital Services Act (DSA). The investigation will determine whether the online travel platform complied with the DSA’s…
Infosecurity -
INTERPOL Arrests 1,462 Suspects in Global Cybercrime Crackdown
INTERPOL announced a coordinated global crackdown, Operation Serengeti III, which ran from 29 June to 31 August 2026. The operation disrupted 10,909 malicious networks and led to the arrest of 1,462 suspects across 21 countries, including the United States…
The Hacker News -
Iranian hackers use US servers and Telegram to hide spyware campaigns
An Iranian nation-state threat group known as Prince of Persia has been found hosting its command-and-control (C2) infrastructure in the United States to support malware delivery and cyber-espionage campaigns. The activity was uncovered by Semperis, which…
InfosecurityInfy -
Indurex Raises €7 Million to Expand Industrial Cybersecurity Platform
Amsterdam-based industrial cybersecurity firm Indurex has raised €7 million (roughly $7.84 million) in a round led by Contrarian Ventures, with Axeleo Capital and Curiosity participating. The funds will be used for research and development and to expand…
SecurityWeek -
Cloudflare Wins South Korea Security Certification After 10-Day Audit
Cloudflare has obtained South Korea’s ISMS certification under the ISMS-P framework, following a ten-day audit with auditors appointed by the Korea Internet & Security Agency (KISA) and a review of 80 controls. The certification signals that Cloudflare’s…
Cloudflare -
CISA warns unmanaged AI token use could disrupt critical services
CISA, together with the Canadian Centre for Cyber Security and partners, has published joint guidance on managing token consumption for operational resilience as organisations deploy third-party super intelligence (SI) services. The briefing notes that…
CISA -
Unmanaged AI Agents Are Becoming Insider Threats in the Workplace
The Hacker News reports on the growing risk posed by AI agents operating within organisations, potentially with broad access to internal systems and credentials, yet with little to no oversight. The article frames such agents as insiders in effect: if an…
The Hacker News -
Attackers Hijack 333 Tor Exit Nodes to Intercept SSH Traffic
Unknown attackers hijacked more than 300 Tor exit nodes to siphon unencrypted email and to redirect SSH connections through their own servers, a researcher reported on 2026-10-22. In the attack, 333 exit relays were compromised between 2 and 5 October, with…
Ars Technica -
Woman Faces Six Years in Jail After Scammer Used Her Identity for Cash App
A case out of the United States centres on a Cash App account opened in Amanda Smith’s name, which has led to criminal charges and a potential prison sentence of up to six years. The account is alleged to have received $1,000 from a Facebook Marketplace scam…
Malwarebytes -
Railway Breach May Have Exposed Customer Secrets and API Keys
Railway, a Platform‑as‑a‑Service provider, has disclosed “anomalous activity” affecting systems that store customer environment variables. In its update dated 21 October 2026, the company said an unauthorized third party may have accessed encrypted…
The Hacker News
