News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 23 Oct· 1 article
-
Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-Day
Arista Networks has released patches for a third exploited zero-day in its VeloCloud Orchestrator (VCO), a central management tool used in software-defined networking. The vulnerability, tracked as CVE-2026-114625, is a critical SQL injection that can be…
Mon 19 Oct· 3 articles
-
Attackers Exploited Siemens Software Center Flaw in Malware Campaign
Siemens has disclosed that threat actors exploited a vulnerability in its Software Center—tracked as CVE-2026-110936—as part of a malware campaign. The flaw arises because Software Center does not adequately restrict the folders it searches for DLL files,…
-
Attackers Exploit Plex2Shell Flaws to Install Miners and Proxy Software
Threat actors have been observed delivering cryptocurrency miners and proxy software.
-
Fortinet Flaw Exploits Led to Stealthy FortiGate Implant in Telecom Breach
Security researchers have linked a sequence of exploited Fortinet vulnerabilities to a stealthy FortiGate implant used in a telecom intrusion. The activity began with the exploitation of a critical remote code execution flaw in FortiManager, tracked as…
Fri 16 Oct· 1 article
-
Chinese APT exploited BeyondTrust Remote Support flaw to steal files
A Chinese state‑sponsored APT, Armory Castle (UNC5221/Warp Panda), has been exploiting a BeyondTrust Remote Support vulnerability as a zero‑day since August 2026. The flaw, CVE-2026-102764, allows improper validation of message origins and could enable a…
Thu 15 Oct· 2 articles
-
Palo Alto patches exploited PAN-OS zero-day allowing root access to firewalls
Palo Alto Networks has released patches for a PAN-OS zero-day vulnerability tracked as CVE-2026-0322, which has been exploited in limited attacks against the management interface of PAN-OS. The flaw allows remote code execution and can be exploited by an…
-
Attackers Exploit Critical Cisco Email Gateway Flaw to Gain Root Access
Cisco has disclosed that attackers are actively exploiting a critical vulnerability in its Secure Email Gateway (SEG), tracked as CVE-2026-76519 with a CVSS of 9.8/10. The flaw affects the AMP (Advanced Malware Protection) component and arises when…
Wed 14 Oct· 2 articles
-
Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day
Security updates have addressed 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including several critical-severity flaws that could allow unauthenticated code execution, authentication bypass, DoS, or leakage of sensitive data. Citrix…
-
Microsoft’s record 1,413 fixes include a Windows flaw exploited to bypass security warnings
Microsoft has released its October 2026 Patch Tuesday with a record 1,413 CVE fixes across multiple products, including Windows, Office, developer tools, and SharePoint Server. Microsoft notes that 1,102 of the fixes affect Windows, with additional patches…
Tue 13 Oct· 1 article
-
Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials
SecurityWeek reports that Ivanti has disclosed a zero-day chain affecting its Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, which allowed unauthenticated remote code execution with elevated privileges. The issue was exploited in the wild,…
Fri 9 Oct· 1 article
-
Hackers Exploit AhsayCBS Flaws to Deploy Webshells and Crypto Miners
SecurityWeek reports that two unpatched flaws in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, are being exploited in the wild to achieve unauthenticated remote code execution. The defects allow an attacker to manipulate arguments in certain functions to…
Thu 8 Oct· 1 article
-
Attackers Target Atlassian Flaw Hours After PoC Details Emerge
Threat actors began targeting CVE-2026-21589, a critical pre-authentication vulnerability in Atlassian’s self-hosted Data Center products, within hours of its PoC details going public. Atlassian disclosed the flaw on 5 October, rating it 9.3 on the CVSS…
Wed 7 Oct· 2 articles
-
Alleged Qilin ransomware operator extradited from Japan to Germany
A 28-year-old Russian national, alleged to be a core member of the Qilin ransomware group, was detained in Osaka in May and has been extradited to Germany to face hacking charges. German authorities accuse the suspect of taking part in an attack on a…
-
Atlassian Patches Critical File Access Flaw Across Eight Products
Atlassian has released patches for a critical vulnerability affecting eight of its products, tracked as CVE-2026-21589 with a CVSS score of 9.3. The flaw is described as an arbitrary file access issue that can be exploited without authentication to access…
Mon 5 Oct· 1 article
-
Citrix NetScaler Zero Day Exploited Days After PitScaler Fixes
Citrix has confirmed a fresh zero-day affecting NetScaler appliances, tracked as CVE-2026-88779, appearing only a few days after two previously exploited flaws were patched. The new memory overflow vulnerability targets NetScaler ADC and NetScaler Gateway…
Fri 2 Oct· 2 articles
-
Warlock Ransomware Expands SharePoint Attacks Against Critical Sectors
Warlock, a ransomware operation tied to the China-based groups Longlegs and Storm-2603, is again exploiting SharePoint vulnerabilities to target critical infrastructure, government, and educational sectors. Symantec’s assessment states that the group has…
-
Fortinet FortiMail Zero Day Lets Attackers Write Files via HTTP
Fortinet’s FortiMail has a critical zero-day vulnerability being exploited in the wild, tracked as CVE-2026-104286 with a CVSS score of 9.8. The flaw is a path traversal and improper neutralisation of NULL byte/NULL character, which could allow attackers to…
Thu 1 Oct· 3 articles
-
Attackers Exploited Zimbra Flaw Before Public Disclosure
SecurityWeek reports that attackers began exploiting a high-severity OS command injection in Zimbra Collaboration Suite (ZCS) shortly after patches were released, and before public disclosure. The flaw, CVE-2026-73570 (CVSS 8.9), affects ZCS pre-10.1.20,…
-
AI Attackers Breached Dutch Security Institute Through Zammad Zero-Days
The Dutch Institute for Vulnerability Disclosure (DIVD) says it was hacked in an automated AI-powered attack that exploited two zero-day vulnerabilities in the open-source Zammad web-based ticketing system. The breach occurred on 21 September, prompting full…
-
Cisco Patches Actively Exploited SD-WAN Manager Auth Bypass
Cisco has released urgent patches for a critical authentication bypass in Catalyst SD-WAN Manager, which has been exploited in the wild. The flaw, tracked as CVE-2026-76504 with a CVSS score of 9.8, targets the API session-based authentication mechanism. It…
Wed 30 Sep· 2 articles
-
Google Finds AI Discovered Flaws Are More Likely to Enable RCE
Google Threat Intelligence Group (GTIG) has analysed vulnerability disclosures from January 2025 to August 2026 and found that AI-enabled discovery is accelerating both the pace and the focus of security flaws. Monthly disclosures more than double from 5,045…
-
Citrix NetScaler Zero Days Let Attackers Steal Credentials Through Web Shells
SecurityWeek reports that government and finance organisations have been targeted in weeks-long exploitation of Citrix NetScaler zero-days. The flaws, CVE-2026-88771 and CVE-2026-88772, affect NetScaler ADC and NetScaler Gateway and enable unauthenticated…
Tue 29 Sep· 2 articles
-
Dutch Police Arrest Suspected ShinyHunters Member in Ongoing Probe
The Dutch police have confirmed the arrest of a 24-year-old Amsterdam man suspected of links to the ShinyHunters extortion group, with authorities stating he was arrested in September in an investigation into the group. The suspect, believed to be Pepijn van…
-
Apple Patches iOS Flaw Exploited in Targeted Attacks
Apple has released updates for iOS, iPadOS and macOS to address CVE-2026-86950, an out-of-bounds write vulnerability in the CoreGraphics component. The flaw can allow arbitrary code execution when the system processes a specially crafted file. Apple said it…
Mon 28 Sep· 2 articles
-
ShinyHunters Revive Attacks on PeopleSoft with WAF Bypass
Mandiant and the Google Threat Intelligence Group (GTIG) have warned that the ShinyHunters extortion group, tracked by Google as UNC6240, is conducting a fresh mass-exploitation campaign against Oracle PeopleSoft customers. PeopleSoft is used by large…
-
Citrix Patches NetScaler Zero Days Exploited in Global Attacks
Citrix has released emergency patches for two critical NetScaler ADC and NetScaler Gateway zero-day vulnerabilities being exploited in the wild. The flaws are part of an advisory covering eight vulnerabilities, including remote code execution, HTTP request…
Sun 27 Sep· 1 article
-
Attackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells
Microsoft SharePoint vulnerability CVE-2026-65660 is being exploited in attacks, about six weeks after Microsoft issued patches and days after researchers published technical details. Microsoft fixed the flaw in its August 2026 Patch Tuesday updates and…
Thu 24 Sep· 1 article
-
WordPress Flaw Exploited Within Hours to Gain Remote Code Execution
A critical WordPress vulnerability was exploited within hours of its public disclosure, with attacks later progressing to active compromises, according to security firm Patchstack. Tracked as CVE-2026-87902 and rated 9.2 on the CVSS scale, the flaw is a…
Wed 23 Sep· 4 articles
-
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day
Arista has issued urgent patches for a critical vulnerability in on-premises VeloCloud Orchestrator (VCO), its central management platform for VeloCloud SD-WAN edge devices, policies and traffic. Tracked as CVE-2026-93952 and rated 10.0 on the CVSS scale,…
-
F5 BIG-IP APM zero-day lets attackers execute code remotely
F5 and the US Cybersecurity and Infrastructure Security Agency (CISA) have warned that attackers are exploiting a critical BIG-IP Access Policy Manager (APM) vulnerability as a zero-day. Tracked as CVE-2026-94127, and rated 9.8 under CVSS, the flaw can allow…
-
ShinyHunters Claims FBI Breach Exposed Agents’ Personal Data
ShinyHunters claims it breached FBI systems and accessed sensitive information from Criminal Justice, HR and Medlink services, including data on nearly all FBI agents and job applicants. To support the claim, the group defaced a subdomain of the FBI’s jobs…
-
Check Point Patches Critical Flaw Exploited in Active Attacks
Check Point has released urgent patches for CVE-2026-93616, a critical directory-traversal and file-upload vulnerability in its Management Server products. Rated 9.8 by CVSS, the flaw can allow unauthenticated attackers to upload and execute arbitrary…
Tue 22 Sep· 1 article
-
Chinese Hackers Exploit Zyxel Switch Flaw to Steal Credentials
A Chinese threat actor has exploited a recently disclosed vulnerability in Zyxel GS1900 switches to steal sensitive information, according to threat intelligence firm GreyNoise. Tracked as CVE-2026-7273 and rated 8.8 on the CVSS scale, the flaw is a…
Mon 21 Sep· 1 article
-
CISA Flags Three Exploited Linux Kernel Flaws for Urgent Fixes
The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue and instructed federal agencies to patch them within three days. However, CISA has not…
Thu 17 Sep· 2 articles
-
Cisco Patches Dozens of Flaws as ISE Zero Day Faces Exploitation
Cisco has released patches for dozens of vulnerabilities in Secure Firewall Management Centre (FMC), Identity Services Engine (ISE) and Nexus Dashboard. The ISE update addresses 20 CVEs, including 12 rated critical. Three vulnerabilities — CVE-2026-20282,…
-
Cisco Patches Zero Day Letting Attackers Take Root Access in ISE
Cisco has released urgent patches for a critical authentication-bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), after confirming that it is being exploited in the wild as a zero-day. Tracked as…
Wed 16 Sep· 3 articles
-
Google Patches Pixel Zero Day Exploited in Targeted Attacks
Google has patched a high-severity zero-day in the modem component of Pixel smartphones after observing “limited, targeted exploitation”. Tracked as CVE-2026-58704, the vulnerability results from a logic error that can allow a permission bypass and remote…
-
Acronis Patches Exploited cPanel Backup Flaw Enabling Privilege Gain
Acronis has released urgent patches for a vulnerability in its Backup plugin for cPanel & WHM after detecting exploitation in limited, targeted attacks. The flaw, tracked as CVE-2026-87886 and rated 7.8 on the CVSS scale, involves insecure file permissions…
-
Critical WSO2 Flaw Exploited to Steal API Credentials and Secrets
A critical WSO2 vulnerability patched earlier this year is being exploited in the wild, according to exposure management firm WatchTowr. Tracked as CVE-2026-5430 and rated 10.0 on the CVSS scale, the flaw affects WSO2 API Manager, API Control Plane, Traffic…
Tue 15 Sep· 2 articles
-
Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
Threat actors targeted Thai broadband provider 3BB, also known as Triple T Broadband, by exploiting vulnerabilities in Fortinet and F5 products, according to cybersecurity firm Hunt.io. The intrusion was uncovered after the attackers left their tools in an…
