News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 23 Oct· 2 articles
-
INC Ransomware Exposed Using AI and Custom Malware Against Victims
In late September 2026, security researchers uncovered seven INC Ransomware command servers that exposed AI-driven activity and bespoke malware used by affiliates of the group. The exposed AI workbench contained 8,257 messages across 133 OpenCode sessions…
-
Hackers Steal 70,000 Credentials in Fortinet and Palo Alto Attacks
Group-IB and NyxLab have uncovered a widespread campaign linked to an operator known as “k0t” that targets FortiGate, FortiWeb and Palo Alto GlobalProtect deployments. Launched largely between February and June 2026, the operation uses bulk asset discovery…
Thu 22 Oct· 2 articles
-
Arista VeloCloud flaw under attack lets users seize superuser access
Arista has disclosed that CVE-2026-114625, a critical SQL injection vulnerability in the VeloCloud Orchestrator (VCO), is being exploited in the wild. The flaw, rated CVSS 9.9, allows any authenticated user to escalate to a local “superuser operator” by…
-
AI Assisted PaperCut Campaign Breaches 395 Organisations Worldwide
Hunt[.]io researchers uncovered three open directories on an attacker server involved in a PaperCut RCE campaign, exposing AI-assisted exploitation toolkit elements and victim data from hundreds of targets. The exposed material includes AI agent…
Tue 20 Oct· 2 articles
-
Ransomware gangs bypass MFA through PAN OS VPN flaw CVE-2026-0257
Ransomware groups are abusing CVE-2026-0257, a GlobalProtect authentication bypass in PAN-OS, to gain VPN access without valid credentials and to bypass MFA safeguards. The exposed flaw lets attackers skip login checks on vulnerable GlobalProtect portals and…
-
Hackers Exploit Siemens Software Center Flaw to Hide Malware
Siemens confirms that CVE-2026-110936, a DLL sideloading flaw in Siemens Software Center, is being exploited in the wild. The vulnerability allows attackers to load malicious DLLs through an uncontrolled search path, disguising malware as a legitimate,…
Mon 19 Oct· 2 articles
-
Actively Exploited Flaws Hit Cisco, BeyondTrust and WordPress Plugin
Between 12 and 18 October 2026, CVE Watchtower logged 5,499 new vulnerabilities, with this weekly review tracking 12 exploited flaws. Six of those were flagged by Daily Cybersecurity’s intelligence sources, and three of the exploited flaws are not yet…
-
Attackers Exploit Plex Flaws to Run Cryptominers and Proxy Tools
Attackers have begun exploiting Plex Media Server vulnerabilities in the wild, following a full write-up and PoC by researcher Zach Main on 17 October 2026. The exploit chain, dubbed Plex2Shell, combines four CVEs to achieve unauthenticated remote code…
Fri 16 Oct· 2 articles
-
BeyondTrust Patches Remote Access Flaw Exploited to Steal Credentials
BeyondTrust disclosed a critical remote-access vulnerability in its BeyondTrust Remote Support product, tracked as CVE-2026-102764, with a CVSS of 9.3. The flaw allows unauthenticated remote attackers to bypass origin validation in internal messaging…
-
Espionage Group Exploits WinRAR Flaw to Target CIS Governments
Security researchers have publicised an active espionage campaign attributed to the UAT-6275 group (also tracked as TAG-193) targeting CIS governments and allied institutions. The campaigns ran from June 2025 to August 2026, culminating in four distinct…
Thu 15 Oct· 2 articles
-
Attackers Exploit SiteGuard Flaw to Seize Server Control as Root
A SiteGuard Server Edition vulnerability, CVE-2026-106931, is exploited in the wild and grants root or SYSTEM access. Update to Ver8.00 Update 5 now. Related Posts: Citrix Patches XenServer Host Escape Risks and UniconOS Privilege Escalation Flaws Juniper…
-
Hackers Used FortiManager Flaws to Compromise 500 Firewalls
In September 2024, threat cluster CL-STA-0954, tracked by Mandiant as UNC5820 and attributed to Unit 42, breached a telecommunications managed service provider by exploiting Fortinet’s FortiJump vulnerability, CVE-2024-47575. The attackers gained access via…
Wed 14 Oct· 6 articles
-
Cisco Email Gateways Face Active Attacks That Could Expose Cluster SSH Keys
Cisco’s Secure Email Gateway is being exploited in the wild for CVE-2026-76519, a critical arbitrary file write vulnerability rated CVSS 3.1 v3.1 9.8. The flaw lies in the AMP File Reputation feature, specifically in how the file reputation service handles…
-
Palo Alto Patches PAN-OS Flaw Exploited to Gain Root Access
Palo Alto Networks has disclosed CVE-2026-0322, a high-severity remote code execution flaw affecting PAN-OS managed devices, notably PA-Series, VM-Series and Panorama (virtual and M-Series). The vulnerability sits in the PAN-OS management interface and can…
-
Collabora Online - Built-in CODE Server2 articles this day · SecurityOnline first
Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026 · Attackers Exploit Nextcloud Collabora Flaw to Plant Webshells
-
Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026
Microsoft has announced the end of life for Windows 11 consumer editions running version 24H2, with lifecycle support terminating on 13 October 2026. The final security update for these builds (KB5127648) has already been issued, and Microsoft will stop…
-
Attackers Exploit Nextcloud Collabora Flaw to Plant Webshells
Threat actors are actively exploiting CVE-2026-110447, a critical OS command injection flaw in the Nextcloud Collabora Online Built-in CODE Server app (richdocumentscode). The vulnerability, rated CVSS 9.2, enables unauthenticated attackers to plant PHP…
-
-
Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery
Broadcom has announced a shift to a monthly software security update cadence for its VMware product line, citing the increasing capability of AI to identify defects as a driver for faster remediation. The move implies that organisations will need to devote…
-
Microsoft Fixes Actively Exploited Windows Flaw in Record Patch Release
Microsoft’s October 2026 Patch Tuesday fixes a record 1,414 vulnerabilities, including 78 rated critical, making it the largest Microsoft release to date. The update slate includes three zero-day flaws, with one already being actively exploited. CISA has…
Tue 13 Oct· 2 articles
-
Ivanti Connect Secure2 articles this day · SecurityOnline first
Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs · Ivanti Connect Secure flaw bypasses authentication in active attacks
-
Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs
Ivanti Connect Secure (ICS) devices were found to be exploited in a chained zero‑day sequence, beginning in early October 2026. Security firm Volexity and Ivanti report that a threat actor, tracked as UTA0576, used an authentication bypass to reach a…
-
Ivanti Connect Secure flaw bypasses authentication in active attacks
Ivanti Connect Secure has a newly disclosed vulnerability, CVE-2026-104935, which Ivanti confirms is being exploited in the wild. The flaw allows a remote, unauthenticated attacker to bypass authentication by spoofing and then execute arbitrary commands on…
-
Mon 12 Oct· 2 articles
-
Actively Exploited Vulnerabilities Jump to 100 in Q3 2026
Daily CyberSecurity’s Q3 2026 CVE report tracks every entry CISA added to the Known Exploited Vulnerabilities (KEV) catalog between 1 July and 30 September 2026. In this quarter, 100 actively exploited vulnerabilities were added, up from 75 in Q2, with…
-
Six Actively Exploited Flaws Remain Outside CISA’s KEV Catalog
Between 5 and 11 October 2026, CVE Watchtower logged 3,255 new vulnerabilities. This weekly CVE report highlights six flaws that Daily Cybersecurity’s intelligence sources surfaced as exploited, but which were not yet listed in the CISA Known Exploited…
Fri 9 Oct· 2 articles
-
CISA Flags Five Actively Exploited Flaws in Enterprise Tools
The article reports that on 8 October 2026 the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five high-risk vulnerabilities to its active threat list. These flaws are actively exploited in the wild and affect popular enterprise tools,…
-
Hackers Exploit AhsayCBS Flaws to Gain SYSTEM Access and Deploy Miners
Security researchers warn of active, wild exploitation of two AhsayCBS vulnerabilities that together enable remote code execution on affected hosts. The attackers chain an authentication weakness (CVE-2026-105133) in ApiStructsAction[.]java with a remote…
Wed 7 Oct· 2 articles
-
Four attacker groups exploited Citrix NetScaler flaw to gain privileged access
Four attacker clusters exploited CVE-2026-88771 in Citrix NetScaler before and after Citrix’s public disclosure, planting web shells and achieving highly privileged access. At least eight eSentire customers were affected across the post-disclosure activity,…
-
Hackers Exploit Atlassian File Read Flaw in Self Managed Servers
CVE-2026-21589 is being exploited in the wild against self‑managed Atlassian servers, with researchers publishing a full technical breakdown and a working proof‑of‑concept for the arbitrary file read flaw. WatchTowr Labs notes a broad, pre‑auth path that…
Tue 6 Oct· 2 articles
-
ClingSTUN Turns Unpatched Routers and Cameras Into Stealthy Proxies
ClingSTUN is a Linux backdoor that turns unpatched IoT and edge devices into remotely controllable proxy nodes. The malware uses legitimate public STUN infrastructure to punch through NAT, making its traffic appear as ordinary VoIP or WebRTC activity.…
-
Atlassian Patches Critical Flaw Exposing Files Across Data Center Products
Atlassian has released patches for a critical self-managed vulnerability, CVE-2026-21589, classified as a path traversal flaw with a CVSS v4 score of 9.3. The bug allows an unauthenticated attacker to read files from the web application root by crafting a…
Mon 5 Oct· 1 article
-
Seven Newly Exploited Flaws Put Cisco, MediaWiki and Zammad at Risk
Researchers tracked 2,652 new CVEs between 28 September and 4 October 2026, with seven flaws showing confirmed exploitation. Daily Cybersecurity (DC) flagged six exploited flaws, and six appeared in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Five…
Sun 4 Oct· 1 article
-
Citrix NetScaler Flaw Exploited to Knock SAML Gateways Offline
Citrix NetScaler is currently dealing with CVE-2026-88779, a memory buffer flaw (CWE-119) that has been observed being exploited in the wild against NetScaler SAML authentication deployments using a Gateway or AAA virtual server. Citrix attributes CVSS 4.0…
Fri 2 Oct· 2 articles
-
Citrix NetScaler Reboots Persist as SAML Flaw Fix Remains Pending
Citrix NetScaler ADC appliances are reportedly rebooting repeatedly after patches were applied, even on builds 14.1-73.37. Citrix has acknowledged a new issue linked to NetScaler SAML authentication and is preparing a security bulletin and a fix, though no…
-
Zammad Zero Days Let Attackers Hijack Sessions and Gain Root Access
Attackers chained two Zammad zero-day flaws to gain access to the Dutch Institute for Vulnerability Disclosure (DIVD) on 21 September 2026, exploiting CVE-2026-102489 and CVE-2026-102490. The chain enabled session hijacking that leads to remote code…
Thu 1 Oct· 4 articles
-
FortiMail Flaw Exploited in the Wild, Exposing Corporate Networks
Fortinet’s FortiMail appliance is actively exploited due to a path traversal flaw tracked as CVE-2026-104286, rated CVSS 9.8. The vulnerability arises from a combination of path traversal (CWE-22) and poor handling of NULL bytes (CWE-158), enabling…
-
Citrix NetScaler ADC2 articles this day · SecurityOnline first
Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords · Active NetScaler Zero Days Expose Devices to Remote Code Execution
-
Citrix NetScaler Zero Day Lets Attackers Seize Root Access Without Passwords
Attackers have been exploiting a Citrix NetScaler zero-day to seize root access on NetScaler ADC and Gateway devices without requiring a password, beginning at least in early September 2026. The issue, tracked as CVE-2026-88772, resides in NetScaler’s packet…
-
Active NetScaler Zero Days Expose Devices to Remote Code Execution
Citrix NetScaler ADC and Gateway were found to be vulnerable to a pre-authentication memory overflow, tracked as CVE-2026-88772, with a companion flaw CVE-2026-88771 also exploitable in the wild. The issues were actively exploited as a zero‑day, leading CISA…
-
-
Attackers Hide AdaptixC2 Implant Inside Fake Microsoft Copilot
Attackers chained two PaperCut MF flaws to gain initial access from an internet-facing server and deploy a trojanised Microsoft Copilot binary, concealing an AdaptixC2 implant inside the fake Copilot. The intrusion, attributed to an in-scope incident…
Wed 30 Sep· 3 articles
-
Unpatched Zimbra Servers Exposed to Shells and Credential Theft
Microsoft Threat Intelligence has tracked attacks exploiting Zimbra CVE-2026-73570, an unauthenticated command-injection flaw in the SNMP notification path, that can give attackers a shell on exposed, unpatched servers. The article notes that exploitation…
-
Cisco Patches Exploited SD-WAN Flaw Enabling Unauthenticated Admin Access
Cisco has identified and patched a critical authentication bypass in Cisco Catalyst SD-WAN Manager, tracked as CVE-2026-76504. The flaw, rated CVSS 9.8, lies in the API session-based authentication logic and stems from improper handling of URI encoding in an…
-
Google Gemini Turns Find Hub Into a Memory Based Valuables Tracker
Google Gemini is being paired with Google’s Find Hub to create a memory-based tracking system for important documents and valuables. The piece describes an approach in which semantic memory — rather than physical device positioning — underpins item tracking.…
Tue 29 Sep· 3 articles
-
Hackers Exploited GlobalProtect Flaw to Fuel Brazilian Invoice Fraud
SOCRadar Threat Research Unit, with input from Palo Alto Networks Unit 42, has tied a global intrusion campaign—Operation Master—to Brazilian invoice fraud that used stolen utility data to generate fake energy bills. The operation reportedly ran from 23…
