News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 23 Oct· 68 articles
-
Cybercriminals Exploit Customer Trust to Target Salesforce Accounts
A recent TransUnion report highlights a shift in cybercrime: threat actors are exploiting trust rather than deploying malware, often by impersonating trusted brands or existing customer accounts. Through social engineering, deepfake technology, text…
Dark Reading -
CISA Flags Actively Exploited Nextcloud Code Injection Flaw
CISA added CVE-2026-110447 to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026. The flaw affects Collabora Online – Built-in CODE Server when used within the Nextcloud platform and can allow remote code execution through OS command…
-
PHP Memory Exploit’s Real World Potential May Be Limited
Security researcher Bojan Zdrnja provides a cautious take on the recently discussed php2shell exploitability. After examining published proofs of concept (PoCs), he argues that building a universal, reliable one-click exploit is far from straightforward, and…
SANS ISC -
PHP3 articles this day · Security Affairs first
Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It · Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In
-
Attackers Exploit PHP2Shell Faster Than Organisations Can Patch It
New data shows that organisations aren’t patching PHP2Shell as quickly as attackers are exploiting it. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were publicly disclosed on 21 October, and threat activity surged immediately. Cloudflare’s…
-
Mirai Botnet Tries to Exploit PHP2Shell, but Finds No Way In
Researchers have linked attempts to exploit PHP2Shell to a Mirai-derived botnet, with new ASLR-bypass exploits emerging, though no confirmed in‑the‑wild compromise has yet been demonstrated. Two days after PHP issued emergency fixes for the PHP2Shell flaws,…
-
Critical PHP Flaws Trigger Millions of Exploit Attempts in Days
PHP2Shell has prompted a surge of activity after two critical PHP core vulnerabilities were disclosed, tracked as CVE-2026-109618 and CVE-2026-109619, with a CVSS of 9.2. The issues reside in the PHP engine itself and allow unauthenticated remote code…
-
-
BlackX Bootkit Bypasses Secure Boot in Central Asian Attacks
A new UEFI bootkit called BlackX has been observed targeting diplomatic organisations in Central Asia, specifically Tajikistan, Uzbekistan and Turkmenistan, in early 2026. The operation appears to be a more capable evolution of the BlackLotus bootkit and is…
The Hacker NewsAPT41 -
Cloudflare speeds up large file delivery by fetching only missing content
Cloudflare has rolled out Origin Range Requests, a self-service feature that optimises how large cacheable objects are delivered when clients ask for partial content. Built to replace the previous range-caching approach (which used fixed, manually tuned…
Cloudflare -
Compromised LiteLLM Release Steals Credentials on Python Startup
On 21 October 2026 a compromised LiteLLM 1.107.0 release was published to PyPI and distributed via official container images. The malicious wheel added Python startup files (cook[.]pth, cook[.]py, sitecustomize[.]py) that were relocated outside the litellm…
Microsoft -
CVE-2026-1155603 articles this day · The Hacker News first
PHP Reveals Rare RCE Flaw With Session Upload Progress Enabled · PHP Warns of RCE Flaw in Rare Session Upload Configurations
-
PHP Reveals Rare RCE Flaw With Session Upload Progress Enabled
PHP has disclosed a new, unlikely remote code execution flaw, tracked as CVE-2026-115560, appearing just two days after emergency patches for the PHP2Shell flaws. The issue is confined to a narrow configuration scenario: the PHP app must configure…
-
PHP Warns of RCE Flaw in Rare Session Upload Configurations
On 23 October 2026, PHP disclosed a new session handling flaw, tracked as CVE-2026-115560, that could allow remote code execution in a narrow set of configurations related to session upload progress. The advisory notes the highest reported CVSSv4 score for…
-
PHP Warns of Unpatched RCE Risk in Rare Session Configurations
PHP has warned of a fresh, unpatched RCE pathway on web servers, just two days after it released emergency fixes for the PHP2Shell flaws. The new issue, tracked as CVE-2026-115560, affects only web applications that are configured in a narrow, unusual way…
-
-
Cloudflare’s Post Quantum Key Manager Restricts Decryption by Region
Cloudflare has introduced a post-quantum geographically restricted key manager (PQ GeoKey Manager) in closed beta as part of its Data Localization Suite. The system ensures that a customer’s decryption keys can only be accessed by Cloudflare edge servers…
Cloudflare -
Arista Networks VeloCloud Orchestrator2 articles this day · SecurityWeek first
CISA Confirms Active Attacks on Arista VeloCloud Orchestrator · Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day
-
CISA Confirms Active Attacks on Arista VeloCloud Orchestrator
CISA added CVE-2026-114625, the Arista VeloCloud Orchestrator SQL Injection Vulnerability, to its Known Exploited Vulnerabilities (KEV) catalogue on 23 October 2026. The flaw affects on-premises Arista VeloCloud Orchestrator and may let a remote attacker…
-
Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day
Arista Networks has released patches for a third exploited zero-day in its VeloCloud Orchestrator (VCO), a central management tool used in software-defined networking. The vulnerability, tracked as CVE-2026-114625, is a critical SQL injection that can be…
-
-
Ruby Patches Regex Flaws Behind Four Critical GitLab RCEs
Ruby has released updates to address three bugs in Onigmo, the regular expression engine embedded in the language. The fixes are in Ruby 4.0.9, 3.4.12, and 3.3.13, after GitLab had patched four critical remote code execution flaws over the preceding weeks.…
The Hacker News -
AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices
Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an Autonomous Red Team Kill Chain Framework called Phantom, used in live operations…
-
AI Agents Breach 27 Companies and Steal 600,000 Payment Cards
A Dark Reading report dated 23 October 2026 describes how AI-powered tools are enabling large-scale, low-cost cyber campaigns. Over five days in September, a Chinese-speaking attacker used three different AI harnesses and both open-weight and public AI…
Dark Reading -
Knicks Phishing Test Lured Staff With a Free Championship Ring
The New York Knicks organisation ran a phishing exercise in which an email promising free “Employee Championship Ring” asked recipients to click a link to choose between two ring designs. The missive, circulated in late September, presented two…
Ars Technica -
Palo Alto Patches PHP2Shell Flaws Enabling Remote Code Execution
Palo Alto Networks has confirmed that two PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, affect PAN-OS, Panorama and WildFire WF-500 appliances. The vulnerabilities reside in PHP’s error handling and are exposed via the PAN-OS management web…
SecurityOnline -
MacOS Ransomware Rebuilds Itself to Evade Detection, Researcher Finds
Heartbreaker, a Rust-based macOS ransomware sample, has surfaced in SecurityWeek’s roundup after researcher Patrick Wardle found it on VirusTotal. Uploaded in May 2025 and still undetected at the time of reporting, it seeks persistence via a LaunchAgent,…
SecurityWeek -
Ransomware Outage Exposes Caribbean’s Cross Border Cyber Risk
On 24 July 2025, Curaçao’s Tax and Customs Administration reported ransomware on its network, with counter services, the call centre and internal processes largely unavailable for more than a week. The Joint Court of Justice—which serves Curaçao, Aruba, Sint…
Dark Reading -
Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign
Cybersecurity researchers have detailed a large-scale campaign that targeted exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The joint investigation by Group-IB and NyxLab notes that operators in the…
-
Cyber insurers tighten security rules as record claims reshape risk assessments
Cyber insurance is moving beyond simple risk transfer to a more active cybersecurity stance. In a landscape intensified by AI-enabled attacks, social engineering and cloud‑service risks, underwriters are expanding posture requirements and even engaging in…
Dark Reading -
Capcom Data Breach Exposes 11.7 Million Account Records
.kadence-column480618_38f885-ca > .kt-inside-inner-col{padding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;}.kadence-column480618_38f885-ca > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column480618_38f885-ca…
Malwarebytes -
PHP Patches Arrive Before Exploits, but Vulnerable Devices Remain at Risk
This morning, we returned to Infocon Green. As usual, we are raising the Infocon to alert you to emerging situations requiring immediate attention. PHP fit that description. By now, you either know about it, or you probably never will, so it is time to go…
SANS ISC -
New Infostealer Targets AI Sessions and Developer Credentials
Aokigahara, a newly observed infostealer, has been detected in the wild with a broadening target set that now includes AI applications and developer tools alongside traditional credentials. Check Point Research notes that an earlier moniker for the malware…
Check PointAokigahara -
Capcom ID Breach Exposes Millions of User Records and Emails
Capcom has disclosed a data breach affecting CAPCOM ID, the unified account used for online play and web services across its titles such as Resident Evil, Street Fighter and Monster Hunter. In a notice published on 22 October, the Japanese publisher said…
Infosecurity -
Meta Faces Record $25 Billion Fine Over Facebook Data Deception
A New Mexico court has ordered Meta to pay $25 billion after a jury found that Facebook deceived users about how their data was handled, marking a record penalty against the tech giant. The judge described the deception as intentional, with executives…
Security Affairs -
Microsoft Expands Project Perception to Contain Risky AI Agents
Microsoft is expanding Project Perception to treat AI agents as insiders, with Guardian Agents added to watch and contain anomalous AI entities that roam organised environments. The aim is to assign each agent a distinct identity separate from the user,…
Dark Reading -
Sandworm Used Yggdrasil Network in Destructive Ukraine Wiper Attack
The Hacker News reports that Sandworm, the Russian state‑sponsored group, worked with another actor to mount a destructive wiping operation against a Ukrainian logistics company. The operation began with initial access on 16 July 2025, delivered via a…
The Hacker NewsSandworm -
China-Linked Hackers Use AI Framework in ConnectWise Supply-Chain Attack
A China-linked threat actor known as Storm-0940 has been using the open‑source AI penetration testing framework Artex to automate intrusions into ConnectWise customers’ environments, Microsoft reported. The activity, active since at least 2021, ramped up in…
SecurityWeekStorm-0940 -
Microsoft 365 Token Theft Lets Attackers Bypass MFA in BEC Campaigns
A new, large-scale business email compromise (BEC) campaign targeted Microsoft 365 environments using token-spraying techniques to access corporate accounts without the attackers needing passwords. Researchers from Huntress identified the operation after a…
Infosecurity -
PHP Exploits Are Probing Targets as Patches Roll Out Worldwide
The latest SANS Internet Storm Center podcast update centres on ongoing patch activity and recent vulnerability disclosures. The host notes that patches for the long‑running PHP vulnerability are widely available from many vendors, though some devices such…
SANS ISC -
Switch 2 Jailbreak Runs Homebrew but Vanishes on Restart
Researcher Sammy Hajhamid has released NS2JB, a jailbreaking project for Nintendo’s Switch 2 handheld, developed with assistance from the AI tool Codex. The exploit relies on a software-only chain of flaws to achieve native code execution on firmware 23.0.1.…
SecurityOnline -
Third Party Breaches Hit 69% of Victims as Tech Vendors Spread Risk
A new Kroll report finds that more than two-thirds (69%) of data breach victims in the past year were affected by a third-party breach, with 79% of those individuals’ data accessed following a compromise at a technology company during June 2025 to June 2026.…
Infosecurity -
Crime Stoppers breach exposes personal details in 850,000 tips
A breach has compromised the anonymity relied upon by Crime Stoppers tip lines, prompting one Toronto chapter to pause phone, website and app submissions. The incident stemmed from March and involved P3 Global Intel, the Texas-based tip-management platform…
Malwarebytes -
Qualcomm signals global job cuts as smartphone demand slumps
Qualcomm has signalled substantial global job cuts in response to a marked slump in smartphone demand, according to a Reuters report cited by the site. The San Diego-based chipmaker informed staff that workforce reductions will begin in November, with the…
SecurityOnline -
Pillow flaw lets malicious EPS filenames trigger code execution via Ghostscript
Pillow, the widely used Python image library, has a critical flaw tied to how it handles EPS images. The vulnerability, CVE-2026-112900, arises because Pillow passes the EPS file name to Ghostscript when converting the PostScript to pixels, without first…
-
Python Rushes Emergency Releases to Block MITM Attacks via emSign Certificates
A security incident involving eMudhra intermediate certificates has led to the removal of the emSign CA certificate from major trust bundles used by Python projects, including certifi. In response, the Python project issued emergency releases: Python 3.15.1,…
SecurityOnline
