News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Fri 23 Oct· 1 article
-
Arista VeloCloud Orchestrators Hit by Exploited SQL Injection Flaw
Arista has disclosed CVE-2026-114625, a critical SQL injection flaw in on-prem VeloCloud Orchestrator (VCO) deployments. The vulnerability, which is being actively exploited in the wild, allows any authenticated portal user—even an Enterprise Read Only…
Tue 20 Oct· 2 articles
-
Japan’s October Breach Wave Exposes Millions of Customer Records
SOCRadar documents a dense wave of Japanese breach disclosures that began in late September and surged through October 2026. The firm’s Dark Web News logged 134 Japan-related items in the first half of October, more than all of September (129) and at roughly…
-
AI-Driven Ransomware Campaign Targeted 62 Organisations
SOCRadar Threat Research Unit (STRU) has disclosed an AI-driven intrusion ecosystem operated by affiliates of INC Ransomware and The Gentlemen Ransomware. A publicly accessible command-and-control server exposed the operators’ AI session databases, their…
Fri 16 Oct· 1 article
-
BeyondTrust Patches Zero-Day Flaw Used to Gain Root Access
BeyondTrust disclosed CVE-2026-102764, a critical improper origin validation vulnerability (CWE-290) in its internal Remote Support messaging component. The flaw allowed remote attackers to trigger file operations without authentication or user interaction…
Thu 15 Oct· 1 article
-
Cisco and Palo Alto Patch Exploited Flaws Enabling Root Access
Cisco and Palo Alto Networks have issued patches for two actively exploited zero-day vulnerabilities that can enable root-level code execution on security appliances. The flaws, CVE-2026-76519 and CVE-2026-0322, have been added to the US CISA Known Exploited…
Tue 6 Oct· 1 article
-
Hackers Exploited Citrix NetScaler Flaw to Knock Services Offline
CVE-2026-88779 is a high‑severity memory overflow that affected Citrix NetScaler ADC and NetScaler Gateway appliances configured for SAML authentication. Exploited as a zero‑day before fixes arrived, the flaw could cause a denial of service by triggering…
Mon 5 Oct· 1 article
-
Dark Web Claims Expose 10 Million French Records and More
SOCRadar’s Dark Web Team report highlights a cluster of fresh underground posts alleging a mix of data leaks and access to compromised infrastructures. The most prominent claim is an IQUALIF-based leak of more than 10 million French residential records, with…
Thu 1 Oct· 1 article
-
Actively Exploited Cisco SD-WAN Flaw Grants Unauthenticated Admin Access
CVE-2026-76504 is a critical authentication bypass flaw in Cisco Catalyst SD-WAN Manager (formerly vManage) that lets an unauthenticated remote attacker reach the management API with administrator privileges. Cisco reports active exploitation in September…
Mon 28 Sep· 1 article
-
Citrix Patches NetScaler Zero Days Exploited in Global Attacks
Citrix has issued emergency updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two critical zero-days being exploited in the wild. CVE-2026-88771 and CVE-2026-88772 both have CVSS v4.0…
Mon 21 Sep· 1 article
-
ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secrets
ShinyHunters reportedly hijacked and defaced Clop’s (also known as Cl0p) Tor-based data-leak site on 18 September 2026, turning the ransomware group’s extortion platform against it. The attackers allegedly exploited an unauthenticated file-upload…
Wed 16 Sep· 1 article
-
Cisco Warns Attackers Are Exploiting Critical Secure Email Gateway Flaw
Cisco has confirmed active exploitation of CVE-2026-76461, a critical SQL injection vulnerability in the email-parsing logic of AsyncOS Software for Cisco Secure Email Gateway. Rated CVSS 9.8 and classified as CWE-89, the flaw can be exploited remotely…
Mon 7 Sep· 1 article
-
SOCRadar Connects ChatGPT to Threat Intelligence via MCP
SOCRadar has released an integration that lets the SOCRadar Threat Intelligence MCP app connect ChatGPT to the SOCRadar MCP server via OAuth, exposing licensed intelligence modules as callable tools within a conversation. Analysts can enrich indicators,…
Thu 3 Sep· 2 articles
-
JFrog Artifactory CVE-2026-82329 Exploited
The article discusses a critical authentication bypass vulnerability in JFrog Artifactory, known as CVE-2026-82329. This vulnerability, which has a CVSS score of 9.8, allows unauthenticated attackers to gain full administrative control over self-managed…
-
SonicWall CVE-2026-83548 Leads to CISA Alert
SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances, specifically **CVE-2026-83548** (a pre-authentication SSRF flaw) and **CVE-2026-83549** (a post-authentication OS command injection flaw). These vulnerabilities are actively…
Fri 24 Jul· 1 article
-
Zimbra XSS bug CVE‑2025-66376 lets Russian hackers steal mail
CVE-2025-66376 is a stored cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite's Classic UI, allowing mailbox theft through malicious emails. Exploitation requires the targeted user to view an email containing crafted HTML without…
Tue 21 Jul· 1 article
-
SonicWall SMA 1000 zero day used to spread KNUCKLEBALL
The article discusses critical vulnerabilities in SonicWall SMA 1000 appliances exploited in a zero-day attack campaign leading to the deployment of KNUCKLEBALL malware. The two primary vulnerabilities, CVE-2026-15409 and CVE-2026-15410, allow attackers…
Thu 2 Jul· 2 articles
-
CISA Flags SharePoint RCE (CVE-2026-45659) for Active Exploitation
CISA has flagged CVE-2026-45659, a vulnerability in Microsoft SharePoint Server, indicating active exploitation. This bug allows remote code execution (RCE) due to deserialization of untrusted data and affects on-premises SharePoint versions below specific…
-
CVE-2026-8037: Progress Kemp LoadMaster RCE Exploited in the Wild
CVE-2026-8037 is a critical vulnerability affecting Progress Kemp LoadMaster, enabling pre-authenticated Remote Code Execution (RCE) via OS command injection through the product’s API. Active exploitation attempts began on June 29, 2026, coinciding with the…
Tue 30 Jun· 1 article
-
SimpleHelp auth bypass lets hackers deploy Djinn Stealer
CVE-2026-48558 is a critical vulnerability in SimpleHelp, a remote monitoring and management platform, allowing authentication bypass and potential infostealer payload deployment. This flaw arises from improper verification of cryptographic signatures for…
Fri 19 Jun· 1 article
-
CVE-2026-20253 Splunk bug lets hackers run code remotely
CVE-2026-20253 is a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to perform arbitrary file operations, potentially leading to remote code execution (RCE). CISA warns of active exploitation and has listed this…
Wed 17 Jun· 1 article
-
FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code
FortiSandbox has critical vulnerabilities (CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089) affecting its API and Web UI components, allowing attackers to bypass authentication, escalate privileges, and execute commands without valid credentials. These…
Wed 10 Jun· 1 article
-
CVE-2026-10520 lets hackers run root on Ivanti Sentry
CVE-2026-10520 is a critical OS command injection vulnerability in Ivanti Sentry, allowing remote unauthenticated attackers to execute commands with root privileges. The flaw, rated with a CVSS score of 10.0, affects Ivanti Sentry versions prior to R10.5.2,…
Tue 9 Jun· 2 articles
-
CVE-2026-11645: Exploited Chrome V8 Bug Enables In-Browser Code Execution
The article discusses CVE-2026-11645, a high-severity zero-day vulnerability in the Google Chrome V8 JavaScript engine that allows for arbitrary in-browser code execution via an out-of-bounds memory condition. Google confirmed that exploitation actively…
-
CISA warns of exploits in LiteLLM and Check Point VPN flaws
On June 8, 2026, CISA added two significant vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-42271 for LiteLLM (CVSS 8.8) and CVE-2026-50751 for Check Point Security Gateway (CVSS 9.3). **CVE-2026-42271** involves a command…
Fri 5 Jun· 1 article
-
Cisco patches SSRF flaw in Unified CM enabling root access
Cisco has issued fixes for CVE-2026-20230, a critical server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager and Session Management Edition. This flaw can lead to root-level compromise when the WebDialer service is enabled.…
Wed 3 Jun· 1 article
-
Android Local Privilege Flaw CVE-2025-48595 Exploited in the Wild
The blog post discusses CVE-2025-48595, a high-severity vulnerability in the Android Framework, included in Google's June 2026 security update. This flaw, which allows local elevation of privilege, is marked as potentially being exploited in the wild. It…
Fri 15 May· 1 article
-
CVE-2026-20182 Cisco SD WAN flaw grants remote admin access
CVE-2026-20182 is a critical authentication bypass affecting Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly vManage), with the flaw residing in the peering authentication and control-connection handshake.…
Tue 12 May· 1 article
-
Discord and Gemini Database Claims, Cisco FMC RCE Leak, Xia Stealer Sale, and IMSS Donor Records Listing
SOCRadar’s Dark Web Team identified several new underground posts, including an alleged Discord database leak and an alleged Google Gemini database leak shared for free, along with an alleged Cisco Secure Firewall Management Center RCE tied to…
Fri 8 May· 1 article
-
CVE‑2026‑6973 Exploited in Wild, Urges Patch of Ivanti EPMM
CVE-2026-6973 is a high-severity remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) on-prem deployments that becomes accessible only after remote authentication with administrative privileges. Ivanti has patched the vulnerability and public…
Mon 4 May· 1 article
-
Dark web lists WhatsApp data, Indian bank VPN for sale
On 4 May 2026, SOCRadar reported a batch of underground posts detailing a range of data and tool sales, including a claim of 20.65 million Indonesian WhatsApp numbers being shared. According to SOCRadar Dark Web Team, there was a separate listing advertising…
Tue 14 Apr· 1 article
-
Apache Tomcat Tribes flaw exposes cluster to unauthenticated RCE
CVE-2026-34486 is a regression in Apache Tomcat Tribes that can convert an exposed cluster receiver into an unauthenticated remote code execution opportunity, according to SOCRadar Vulnerability Intelligence. The issue stems from a decryption failure that no…
Mon 13 Apr· 2 articles
-
Adobe Acrobat and Reader2 articles this day · SOCRadar first
Alleged Police Tipline Data Sale, iOS and Adobe Exploits, RDWeb Access Listings, and Gunra Recruitment · Adobe patches Acrobat after CVE‑2026‑34621 exploited in the wild
-
Alleged Police Tipline Data Sale, iOS and Adobe Exploits, RDWeb Access Listings, and Gunra Recruitment
SOCRadar’s Dark Web Team published on 13 April 2026 a post detailing several new underground posts this week, including an alleged sale of United States and Canada tipline database records, claims of high-end exploitation tooling for iOS and Adobe Reader,…
-
Adobe patches Acrobat after CVE‑2026‑34621 exploited in the wild
Adobe has issued an emergency update for Adobe Acrobat and Adobe Acrobat Reader on Windows and macOS to address CVE-2026-34621, a vulnerability Adobe says can be exploited to achieve arbitrary code execution when a crafted PDF is opened, with exploitation…
-
Mon 6 Apr· 1 article
-
Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Fortinet disclosed a critical vulnerability in FortiClient EMS (Enterprise Management Server) tracked as CVE-2026-35616, described as an API authentication and authorization bypass that can allow an unauthenticated attacker to execute commands or code.…
Thu 2 Apr· 1 article
-
CVE-2026-5281: Chrome WebGPU Zero-Day Exploited In The Wild
Google has patched CVE-2026-5281, a high-severity use-after-free vulnerability in Dawn, Chromium’s WebGPU implementation, with exploitation in the wild confirmed and the bug added to the Known Exploited Vulnerabilities catalog by CISA. Google’s release notes…
Wed 1 Apr· 1 article
-
CVE-2025-53521: F5 BIG-IP APM Flaw Reclassified as Unauthenticated RCE
CVE-2025-53521 concerns F5 BIG-IP Access Policy Manager (APM), which was initially treated as a denial-of-service issue in 2025 but has been reclassified as a potential unauthenticated remote code execution (RCE) under certain configurations. The…
Tue 24 Mar· 1 article
-
CVE-2026-3055: NetScaler Memory Disclosure Puts SAML-Enabled Edge Devices at Risk
Citrix has released fixes for two NetScaler vulnerabilities that security teams should review promptly: CVE-2026-3055, described as a critical memory overread, and CVE-2026-4368, a race condition that can cause user session mix-ups, with both affecting…
Mon 23 Mar· 1 article
-
CVE-2025-32975: Quest KACE SMA SSO Authentication Bypass Enables Admin Takeover
CVE-2025-32975 affects Quest KACE SMA and allows an authentication bypass in the appliance’s SSO handling, potentially enabling an unauthenticated attacker to impersonate legitimate users and pursue administrative takeover. The vulnerability is pre-auth and…
Fri 6 Mar· 2 articles
-
Cisco Catalyst SD-WAN Manager (CVE-2026-20122 & CVE-2026-20128) Flaws Exploited
According to Cisco PSIRT, Cisco Catalyst SD-WAN Manager (vManage) is currently being actively exploited for two vulnerabilities, CVE-2026-20122 and CVE-2026-20128. CVE-2026-20122 is an arbitrary file overwrite flaw in the vManage API that requires…
-
KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar
Two long-standing vulnerabilities affecting Hikvision cameras and Rockwell Automation Logix environments have been flagged by CISA as urgently requiring patching and mitigations, entering the KEV catalog as actively exploited items. The Hikvision issue,…