News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 16 Oct· 1 article
-
China-linked hackers exploited BeyondTrust zero-day to steal credentials
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Wed 14 Oct· 1 article
-
Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched
Ivanti reported that two zero-day flaws in its Ivanti Connect Secure (ICS) hardware and software were exploited in the wild, centring on a high-severity authentication bypass combined with unauthenticated remote code execution (RCE) in SSL-VPN and…
Tue 13 Oct· 1 article
-
Microsoft patches actively exploited Windows flaw that bypasses security checks
On 13 October 2026, Dark Reading reports Microsoft’s October Patch Tuesday as the largest update yet, with 1,413 Microsoft CVEs disclosed. The haul includes 80 critical flaws and two zero-day bugs, one of which is actively exploited. The patched issues span…
Mon 5 Oct· 1 article
-
ClingSTUN turns vulnerable IoT devices into proxy nodes using STUN servers
Fortinet’s FortiGuard Labs researchers have uncovered a Linux backdoor, dubbed ClingSTUN, that compromises IoT devices by exploiting at least 24 known vulnerabilities across a broad range of Internet-connected gear from vendors including Realtek, MVPower,…
Fri 2 Oct· 1 article
-
Citrix NetScaler Zero Days Exploited as Vendors Take Different Risks
Threat researchers tracked a sequence of zero-day events around Citrix NetScaler over the weekend of 24–26 September. GreyNoise Intelligence observed a US-based IP address scanning NetScaler installations and attempting remote code execution, with social…
Tue 29 Sep· 1 article
-
Apple Patches Actively Exploited CoreGraphics Zero Day in Targeted Attacks
Apple has released updated iOS and macOS versions to address a zero-day vulnerability that attackers are actively weaponising in targeted attacks. The flaw, CVE-2026-86950, is an out-of-bounds write in Apple's CoreGraphics framework that processes graphics…
Mon 21 Sep· 1 article
-
ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoin
ShinyHunters apparently breached rival ransomware group Clop’s dark-web leak site last week, defacing it with the message “DOMAIN SEIZED BY SHINYHUNTERS.” The group claimed it exploited an unauthenticated file-upload vulnerability in the Grav CMS used by the…
Fri 18 Sep· 1 article
-
Cisco Patches Exploited ISE Flaw That Grants Attackers Root Access
Cisco has disclosed and patched CVE-2026-76460, a maximum-severity authentication bypass affecting an API endpoint in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) products. The flaw, rated 10 out of 10 on the CVSS scale,…
Mon 14 Sep· 2 articles
-
Russia-linked hackers exploit Cisco firewall flaws to deploy Cyclops Blink
A likely Russia-linked threat actor is exploiting two vulnerabilities in Cisco Secure Firewall Management Centre (FMC) to deploy an updated version of the Cyclops Blink malware. Sophos and Cisco Talos identified the activity, while Sophos attributed it with…
-
CISA Warns of Active Exploitation of Critical GitLab File Theft Flaw
GitLab vulnerability CVE-2026-85706 is being actively exploited after its disclosure and patching on 10 September 2026. The path-traversal flaw affects self-hosted GitLab Community Edition and Enterprise Edition instances and has a CVSS score of 10 out of…
Tue 8 Sep· 1 article
-
Microsoft Fixes 974 Flaws as Two Windows Zero Days Face Exploitation
Microsoft released fixes for 974 unique vulnerabilities in its September Patch Tuesday, a figure that would once have represented a full year’s worth of CVEs. Of these, two zero‑days are already under active exploitation, and 58 further flaws are considered…
Wed 2 Sep· 1 article
-
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
SonicWall has reported two new zero-day vulnerabilities in its SMA 1000 perimeter devices, leading to ongoing exploitation by attackers. The vulnerabilities, CVE-2026-83548 (pre-authentication SSRF) and CVE-2026-83549 (post-authentication RCE), affect models…
Tue 1 Sep· 1 article
-
Attackers Pounce on Critical Artifactory Flaw Following Disclosure
A critical vulnerability, CVE-2026-82329, has been discovered in JFrog's Artifactory software, allowing attackers to bypass authentication and gain administrative access without user interaction. Disclosed on August 28, the flaw has a CVSS score of 9.8 and…
Mon 24 Aug· 1 article
-
Exploited Zimbra Flaw Highlights Shrinking Window to Patch
CISA has set a three-day deadline for federal agencies to address a significant security flaw in the Zimbra communications suite, identified as CVE-2026-73570. This vulnerability allows potential attackers to execute unauthorized code remotely, threatening…
Tue 11 Aug· 2 articles
-
Microsoft's Patch Tuesday Deluge Continues With August Updates
In August 2026, Microsoft released fixes for 421 unique CVEs during its Patch Tuesday, including two zero-day vulnerabilities. The bulk of these vulnerabilities (236) affect Windows, with 98 impacting Office products. Among the critical issues,…
-
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA
The article discusses the Gunra ransomware gang, which is exploiting vulnerabilities in Fortinet products, particularly CVE-2024-55591 and CVE-2025-24472, to bypass multifactor authentication (MFA) and compromise critical infrastructure and government…
Mon 3 Aug· 1 article
-
Nable Ncentral CVE-2026-18577 lets attackers hijack admin access
N-able has identified a critical authentication bypass vulnerability, CVE-2026-18577, affecting its N-central remote monitoring and management platform. Attackers exploited this flaw to gain unauthorized administrator access to customer environments,…
Mon 20 Jul· 2 articles
-
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
The article discusses the recent exploitation of two critical vulnerabilities in WordPress, identified as CVE-2026-60137 and CVE-2026-63030, which allow unauthenticated remote code execution on millions of sites. Discovered using AI technology, these flaws…
-
Ivanti Deploys AI to Uncover Hidden Flaws Like CVE-2026-10520
Ivanti is leveraging large language models (LLMs) to improve the identification and remediation of software vulnerabilities, a move prompted by the effectiveness of these models in the cybersecurity domain. Daniel Spicer, Ivanti's Chief Security Officer,…
Fri 17 Jul· 1 article
-
SonicWall CVE-2026-15409 flaw lets ransomware group hijack VPNs
A major ransomware group, Inc, has exploited two zero-day vulnerabilities in SonicWall's Secure Mobile Access (SMA) appliances—CVE-2026-15409 and CVE-2026-15410. These vulnerabilities allow unauthorized access and remote code execution, enabling threat…
Tue 14 Jul· 1 article
-
Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes
Microsoft's July 2026 Patch Tuesday update is unprecedented, addressing 622 unique CVEs, including three zero-day vulnerabilities. Among these, two are actively exploited, while the third is a known but unexploited flaw. The update signals a significant…
Mon 6 Jul· 1 article
-
LLM Driven Ransomware Automates Attack via Langflow CVE-2025-3248
The "JadePuffer" ransomware attack marks the first fully automated cyber extortion operation executed by a large language model (LLM) without human intervention. Researchers from Sysdig identified that JadePuffer exploited a vulnerability (CVE-2025-3248) in…
Mon 29 Jun· 1 article
-
Djinn malware exploits SimpleHelp flaw to steal AI credentials
The article discusses the 'Djinn' infostealer malware, delivered through the CVE-2026-48558 vulnerability in SimpleHelp, an RMM tool. This malware targets cloud and AI credentials by exploiting administrative access. Attackers use obfuscated JavaScript to…
Thu 25 Jun· 1 article
-
Cisco CUCM flaw allows hackers to gain root access in 24 hours
A critical vulnerability in Cisco Unified Communications Manager (CUCM), tracked as CVE-2026-20230, has been weaponized by attackers within 24 hours of a proof-of-concept (PoC) release. This server-side request forgery (SSRF) flaw allows unauthenticated…
Wed 24 Jun· 1 article
-
Cisco Catalyst SD WAN bug exploited pre patch, gave root access
In June 2026, Mandiant reported that a serious vulnerability in Cisco's Catalyst SD-WAN, identified as CVE-2026-20245, was exploited by attackers starting in March, prior to Cisco's official disclosure of the flaw. This vulnerability allows someone with…
Fri 12 Jun· 1 article
-
ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed
ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, affecting over 100 organizations, particularly in higher education. The vulnerability, which allowed remote code execution without authentication, was active…
Thu 11 Jun· 1 article
-
Critical Ivanti Sentry flaw exploited 24 hours after disclosure
A critical vulnerability in Ivanti Sentry (CVE-2026-10520) was exploited within 24 hours of its disclosure, affecting versions prior to R10.5.2, R10.6.2, and R10.7.1. This OS command injection flaw received a maximum CVSS score of 10, allowing unauthorized…
Tue 9 Jun· 1 article
-
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs
Russian attackers are exploiting a patched WinRAR vulnerability (CVE-2025-8088) in separate campaigns aimed at military and government organizations in Ukraine. Two groups, Shadow-Earth-066 and Earth Dahu, are using malicious emails containing weaponized…
Mon 8 Jun· 1 article
-
Check Point warns of IKEv1 flaw linked to Qilin ransomware
Check Point has identified a critical zero-day vulnerability (CVE-2026-50751) affecting its Security Gateways and Spark Firewalls, specifically in implementations using the deprecated IKEv1 key exchange protocol. This authentication bypass flaw, assigned a…
Mon 1 Jun· 1 article
-
CVE-2026-0257 flaw lets hackers bypass Palo Alto VPN auth
A critical vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect VPN allows attackers to bypass authentication and gain unauthorized access to VPNs. Disclosed in May 2026, the flaw has been actively exploited, prompting advisories from…
Tue 26 May· 1 article
-
Microsoft patches critical SharePoint RCE flaw CVE-2026-45659
Microsoft has released an out-of-band patch to address a critical remote code execution vulnerability in SharePoint Server (CVE-2026-45659). This flaw allows authenticated attackers to remotely execute code without elevated privileges, assigning it a high…
Tue 19 May· 1 article
-
Windows Zero-Day Barrage Continues After Patch Tuesday
Six Windows zero-days were disclosed by Nightmare Eclipse in the six weeks since May 2026’s security update, adding to a growing list that researchers say attackers are already exploiting in some cases. The three new vulnerabilities are YellowKey,…
Mon 18 May· 1 article
-
Microsoft Exchange Zero-Day Under Attack, No Patch Available
Microsoft on Thursday disclosed a zero-day vulnerability in Exchange that is under active exploitation, and four days later customers were still awaiting a patch. The flaw, tracked as CVE-2026-42897, affects Exchange Outlook Web Access and could allow an…
Thu 14 May· 1 article
-
Cisco SD WAN flaw lets attackers seize control, patch urged
A highly sophisticated threat actor is exploiting a critical vulnerability in Cisco Catalyst SD-WAN Controllers, with Rapid7 disclosing CVE-2026-20182, an authentication bypass that allows unauthenticated attackers control over a key network management tool.…
Mon 4 May· 1 article
-
Attackers Exploit cPanel Flaw, Endangering Millions of Websites
A critical authentication bypass flaw in cPanel software products has been heavily exploited across multiple threat actors shortly after public disclosure, risking millions of websites via tens of thousands of compromised instances. On 28 April the vendor…
Thu 30 Apr· 1 article
-
Nine year old Linux bug CVE-2026-31431 lets users gain root
Researchers have identified a nine-year-old Linux root-escalation bug, dubbed Copy Fail, designated CVE-2026-31431, after an hour of AI-assisted scanning. The flaw lets any local user write four specific bytes to the in-memory copy of a readable file,…
Tue 21 Apr· 2 articles
-
Exploits Turn Windows Defender into Attacker Tool
Three publicly available proof-of-concept exploits are being used to attack Microsoft Defender and turn its protective functions against organisations, with two of the exploits unpatched. BlueHammer is a TOCTOU flaw in Defender’s signature update workflow…
-
Bomgar CVE-2026-1731 Exploited in Supply Chain, LockBit Deployed
A fresh wave of cyberattacks has exploited Bomgar RMM instances across organisations and their customers over the past two weeks, underscoring the rapid downstream risk to unpatched supply chains. According to Huntress Security Operations Center, there has…
Tue 14 Apr· 1 article
-
Privilege Elevation Dominates Massive Microsoft Patch Update
Privilege Elevation Dominates Microsoft’s patch Tuesday, with elevation-of-privilege bugs accounting for more than half of the 165 CVEs patched. Microsoft noted that one zero-day is actively being exploited, CVE-2026-32201, a spoofing vulnerability in…
Mon 13 Apr· 1 article
-
Adobe patches CVE-2026-34621 in Acrobat after wild exploitation
Adobe patched an arbitrary code execution vulnerability in the latest versions of its Acrobat and Reader for Windows and macOS, nearly four months after an attacker first appeared to have begun exploiting it. The high-severity flaw, assigned as…