News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 12 so far |
Thu 22 Oct· 84 articles
-
Storm-09402 articles this day · The Hacker News first
AI-Powered Attack on ConnectWise Took Cloud Services Offline · AI Framework Helped China Aligned Hackers Breach ConnectWise Backup
2 outlets-
AI-Powered Attack on ConnectWise Took Cloud Services Offline
A Chinese state-aligned actor, tracked as Storm-0940, used an agentic AI penetration testing framework called ARTEX to compromise Microsoft 365 tenants used by ConnectWise, leading to multiple ConnectWise cloud services going offline. Microsoft assessed that…
Infosecurity -
AI Framework Helped China Aligned Hackers Breach ConnectWise Backup
Microsoft has disclosed that a China‑aligned threat actor known as Storm-0940 used ARTEX, a Go‑based agentic AI penetration testing framework, to accelerate a supply‑chain compromise against ConnectWise Cloud Backup. The attackers automated password…
The Hacker News
-
-
EU Probes Booking.com Over Fake Listings and Phishing Scams
The European Commission has opened formal proceedings against Booking[.]com under the Digital Services Act (DSA) to assess whether the platform did enough to curb fake property listings and phishing scams, and to check if boosted paid listings are clearly…
SecurityOnline -
Splunk and SolarWinds patch flaws exposing data and enabling attacks
Splunk and SolarWinds have released a new wave of security updates this week, addressing a range of flaws that could enable code execution, privilege escalation, information disclosure and other impacts. Splunk’s patches cover Splunk Enterprise and Splunk…
SecurityWeek -
Portainer fixes flaws letting users mount host files and gain root access
Portainer has fixed two critical vulnerabilities, both rated CVSS 9.4, that could let standard users mount files from the Docker host into containers. The flaws could lead to root access on the host. One reportedly extends a bind-mount bypass that remained…
-
OpenCode flaw lets hijacked MCP servers run commands on Windows during sign in
A flaw in the OpenCode AI coding agent could allow a malicious or hijacked MCP server to execute code on a developer’s Windows or Windows Subsystem for Linux (WSL) machine during sign-in. OpenCode connects to MCP (Model Context Protocol) servers to bring in…
The Hacker News -
Attackers Targeted PHP2Shell Flaws Four Days Before Disclosure
Threat intelligence analysts now observe large-scale evidence of exploitation of the two critical PHP vulnerabilities
Infosecurity -
Cisco TelePresence Video Communication Server (VCS) Expressway2 articles this day · SecurityOnline first
Cisco Patches Critical Expressway Flaw That Could Run Commands as Root · Cisco Patches Root Access Flaw in Expressway Gateways
-
Cisco Patches Critical Expressway Flaw That Could Run Commands as Root
Cisco has released patches for 34 vulnerabilities across multiple products, including Expressway Series, IOS XR, Snort 3 and various Unified Communications components. The fixes address a range of severe issues, from remote code execution to authentication…
-
Cisco Patches Root Access Flaw in Expressway Gateways
Cisco has issued three security advisories on 21 October 2026 addressing ten vulnerabilities across Cisco Expressway Core (Expressway-C) and Expressway Edge (Expressway-E) gateways, with the most severe being a root remote code execution flaw. The standout…
-
-
PHP2 articles this day · The Hacker News first
Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public · Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot
-
Over a Million PHP Systems Face Exploitation After RCE Flaws Go Public
Security researchers tracked a rapid surge of exploitation activity targeting two critical PHP RCE flaws, now tracked as CVE-2026-109618 and CVE-2026-109619, with patches released on 21 October after an embargo and weeks of coordinated disclosure. Initial…
-
Amazon Detects PHP2Shell Exploit Attempts Targeting Its Honeypot
Amazon’s Threat Intelligence team detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on 17 October 2026, targeting its MadPot honeypot service. The activity originated from an IP address tied to a commercial anonymisation service…
-
-
Delivery robot firms face lawsuits over alleged biometric data harvesting
Two Chicago residents have filed separate class actions alleging that delivery robots operated by Coco Robotics (Cyan) and Serve Robotics illegally scanned customers’ faces, hands and surrounding LiDAR data during deliveries, storing the biometric data…
Malwarebytes -
Microsoft Windows 10 Version 18092 articles this day · securelist.com first
APT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central Asia · BlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flaw
-
APT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central Asia
Security researchers have disclosed a new firmware-based intrusion campaign attributed to APT41, in which a BlackX UEFI bootkit targets diplomatic networks in Central Asia. The operation, observed in early 2026 and detailed by Kaspersky GReAT, deploys a…
-
BlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flaw
Kaspersky Securelist reveals that in early 2026 an APT campaign targeting diplomatic organisations in Tajikistan, Uzbekistan and Turkmenistan employed a UEFI bootkit named BlackX, closely resembling the BlackLotus malware. The attackers gained initial access…
-
-
Malicious LiteLLM Package Steals Secrets and Opens a Backdoor
LiteLLM disclosed that threat actors compromised multiple independent security controls to push a malicious version of the LiteLLM Python package, designed to harvest credentials and act as a backdoor. The attack occurred on 21 October 2026, when the release…
The Hacker News -
Cloud Misconfigurations Drive 45% of Critical Incidents, SANS Finds
Nearly all organisations now operate production workloads in the cloud, yet the 2026 SANS Cloud Security Survey Insights shows a clear maturity gap. Based on 400 IT and security professionals, the report finds that only about 40% regard their cloud security…
Infosecurity -
Fortinet urges customers to patch critical flaws before details emerge
Fortinet has issued urgent security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, with FortiMail and FortiAuthenticator fixes arriving a day earlier. The disclosures follow AI-assisted testing that identified critical and…
SecurityOnline -
Fancy Bear Used Webhook.site to Breach European Defence Targets
Symantec’s Threat Hunter Team tracks the operation as Swallowtail (also known as APT28, Fancy Bear or Forest Blizzard). In the campaign, three organisations in two NATO member states were compromised: a naval shipbuilder, a defence contractor producing…
SecurityOnlineAPT28 -
Node.js fixes Brotli flaw that could enable remote code execution
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the project says can allow remote code…
The Hacker News -
Oracle fixes 1,209 vulnerabilities in October security update
Oracle has released its Critical Patch Update (CPU) for October 2026, delivering 1,295 fixes across numerous Oracle products. Tenable’s analysis accompanying the update notes 1,209 unique CVEs addressed, of which 95 are rated critical. The update distributes…
-
Trojanised LiteLLM Release Steals Cloud Keys on Python Startup
A new LiteLLM supply chain attack has compromised the 1.107.0 release of the open‑source LiteLLM gateway, turning it into a credential stealer. Attackers used stolen maintainer tokens to publish trojanised wheels to PyPI and poisoned Docker images, exposing…
SOCRadar -
Anthropic Launches Claude Duet, an AI Agent That Works in the Background
Anthropic has unveiled Claude Duet, a proactive AI agent designed to act as a digital partner that takes initiative while keeping you in the loop. Positioned as a rival to OpenAI Dots and Meta Muse, Duet is being released as a research preview with a waiting…
SecurityOnline -
Meta Fined $25 Billion Over False Facebook Privacy Assurances
A New Mexico jury has ordered Meta Platforms to pay $25 billion after finding Facebook deceptive in how it handled users’ privacy. Jurors concluded Meta violated state consumer protection laws over more than 43 million statements about data handling, with…
SecurityWeek -
SafePay ransomware hits 600 victims using stolen VPN credentials and old flaws
Six agencies from the US, Germany and the UK issued a joint StopRansomware advisory on SafePay ransomware on 20 October 2026, detailing that the group has compromised at least 600 victims since August 2024. The advisory, AA26-293A, is a collaboration between…
SecurityOnline -
SafePay Ransomware Hits 600 Organisations in Global Campaign
SafePay ransomware has affected more than 600 organisations since mid‑2024, with the US CISA, FBI, US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz and two UK police forces publishing a joint advisory. The victims span critical infrastructure…
Security AffairsSafePay -
quic-go2 articles this day · SecurityOnline first
HTTP/3 Header Flaws Let Small Requests Exhaust Server Memory · HTTP/3 Header Attack Can Amplify Memory Use 4,000 Times in Bun
-
HTTP/3 Header Flaws Let Small Requests Exhaust Server Memory
A class of denial-of-service flaws in QPACK header compression has been disclosed for HTTP/3 stacks, with a remote attacker able to crash servers via a single connection by sending a small batch of compressed headers that expands dramatically in memory. The…
-
HTTP/3 Header Attack Can Amplify Memory Use 4,000 Times in Bun
On 20 October 2026, security researchers FoxIO published details and proof-of-concept code for “Header Accordions”, a denial-of-service attack targeting HTTP/3 implementations that use QPACK to compress headers. FoxIO found that a small request can make some…
-
-
China linked hackers used AI agents to breach 48 targets in 12 days
Between 24 September and 14 October 2026, a suspected China-linked operator conducted 66 hacking operations from a single server using AI agents, according to VULONE Research. The campaign targeted government ministries in Vietnam, Taiwan, Indonesia, and…
SecurityOnline -
UAE Aims to Move Half of Government Operations to Agentic AI
The United Arab Emirates plans to shift half of its government operations, services and sectors to autonomous, agentic AI within the next two years. Speaking at the World Economic Forum in Dubai on 14 October 2026, Omar Sultan Al Olama, the minister of state…
Dark Reading -
Zeabur to shut down services after breach exposed millions of records
Zeabur, a developer deployment platform, has announced it will shut down its shared cluster and dedicated server services by the end of December 2026, citing ongoing security problems and repeated data breaches that undermine confidence in delivering…
SecurityOnline -
Google Brings Hands-Free Gemini AI to Apple CarPlay Navigation
Google has rolled out Gemini integration to Apple CarPlay, bringing a conversational AI companion directly into the navigation experience. The update adds a dedicated Gemini button in the CarPlay interface, enabling hands-free access to the assistant without…
SecurityOnline -
Signal fixes critical RingRTC flaw that could keep calls live after hang-up
A researcher has published full details and a proof-of-concept for CVE-2026-113380, a critical vulnerability in Signal’s RingRTC library. The flaw allows a remote peer to flood a call’s event queue so that hanging up does not terminate the call, potentially…
-
Cisco Patches 13 Snort 3 Flaws, Including Critical Code Execution Risk
Cisco has issued a coordinated set of advisories fixing 13 Snort 3 vulnerabilities across its security products, including firewalls, Meraki MX, Cyber Vision and UTD on IOS XE. The most severe flaw, CVE-2026-20043, carries a CVSSv3 score of 9.0 for an…
-
Railway Breach May Expose Customer Secrets and API Keys
Railway has disclosed a security incident affecting its cloud platform, reporting anomalous activity on October 21 that potentially exposed customer environment variables. The firm warned that an unauthorised party “may have accessed encrypted environment…
SecurityOnline -
PHP2Shell Flaws Face Active Attacks as Exploits Spread Rapidly
PHP2Shell remote code execution flaws CVE-2026-109618 and CVE-2026-109619 are exploited in the wild as PoCs go public. Patch PHP now. Related Posts: Signal Call Vulnerability Details and PoC Published, Showing Hang-Up Can Fail to End Calls Cisco Fixes 13…
SecurityOnline -
Splunk fixes 31 flaws, including three rated CVSS 9.9, in urgent updates
Splunk has released four advisories fixing 31 vulnerabilities across Splunk Enterprise and Splunk SOAR, with three flaws rated at CVSS 9.9. The company urges admins to apply the latest updates: Splunk Enterprise to 10.4.4, 10.2.8, 10.0.11 or 9.4.16, and…
-
Apache Pulsar Flaws Enable Token Bypass and Cross Tenant Access
Apache Software Foundation researchers disclosed 17 security flaws on 21 October 2026, affecting both Apache Pulsar and Apache IoTDB. The majority are Pulsar-related, with 13 vulnerabilities, and four concern IoTDB. The most severe issues include a 10.0 CVSS…
-
Critical PHP flaws enable remote attacks on websites and appliances
On 22 October 2026, SANS ISC’s Stormcast focused on a critical PHP vulnerability that has widespread impact because PHP is used by roughly 60% of websites and many network appliances run PHP as well. The discussion notes that the flaw is in the PHP…
SANS ISC -
Apache Traffic Server Fixes 15 Flaws, Including Unauthenticated RCE Risk
Apache Traffic Server users face a substantial round-up of flaws disclosed in October 2026, with 15 CVEs spanning core proxy functionality and experimental plugins. The most severe entry is CVE-2026-111813 (CVSS 10.0) in the experimental magick plugin, which…
-
AI Assisted PaperCut Campaign Breaches 395 Organisations Worldwide
Hunt[.]io researchers uncovered three open directories on an attacker server involved in a PaperCut RCE campaign, exposing AI-assisted exploitation toolkit elements and victim data from hundreds of targets. The exposed material includes AI agent…
