News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Most articles on Wed 21 Oct (96); 9–13 on weekend days.
Show as table
| Day | Articles published |
|---|---|
| Sun 11 Oct | 9 |
| Mon 12 Oct | 56 |
| Tue 13 Oct | 85 |
| Wed 14 Oct | 86 |
| Thu 15 Oct | 78 |
| Fri 16 Oct | 61 |
| Sat 17 Oct | 10 |
| Sun 18 Oct | 10 |
| Mon 19 Oct | 60 |
| Tue 20 Oct | 86 |
| Wed 21 Oct | 96 |
| Thu 22 Oct | 84 |
| Fri 23 Oct | 68 |
| Sat 24 Oct | 13 |
| Today, Sun 25 Oct | 9 so far |
Sat 24 Oct· 1 article
-
CISA Warns of Active Attacks on Nextcloud and Arista Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, affecting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO).…
Fri 23 Oct· 2 articles
-
AI Agents Power Ransomware Affiliates’ Attacks on Edge Devices
Cybersecurity researchers have uncovered an AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. Central to the operation is an Autonomous Red Team Kill Chain Framework called Phantom, used in live operations…
-
Hackers Target Exposed Fortinet and Palo Alto Firewalls in Global Campaign
Cybersecurity researchers have detailed a large-scale campaign that targeted exposed network edge devices, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. The joint investigation by Group-IB and NyxLab notes that operators in the…
Thu 22 Oct· 1 article
-
Arista VeloCloud Zero Day Exploited to Gain Superuser Access
Arista has disclosed a critical zero-day vulnerability in its VeloCloud Orchestrator (VCO) that is being exploited in the wild. The flaw, tracked as CVE-2026-114625 and rated 9.9 on the CVSS scale, is a SQL injection that can be exploited by anyone who can…
Tue 20 Oct· 4 articles
-
Qilin and INC ransomware gangs exploit Palo Alto VPN flaw to bypass MFA
Palo Alto Networks has disclosed that exploitation of a patched PAN-OS and Prisma Access flaw, CVE-2026-0257 (CVSS 7.8), is continuing in financially motivated campaigns. The vulnerability is an authentication bypass that could allow attackers to establish…
-
AI Agents Target 1,200 Retail Sites in Low Cost Hacking Campaign
A security researcher has watched attackers deploy autonomous AI agents against more than 1,200 retail and service websites, with at least 100 organisations affected. The activity centred on Cairn, an open‑source AI tool, whose exposed control panels were…
-
APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion
The Hacker News reports that the Russia-linked APT28 group, also known as BlueDelta, Fancy Bear or Forest Blizzard, has been attributed by Symantec Threat Hunter Team (Swallowtail) with breaching multiple NATO-related targets, including a naval shipbuilder…
-
Siemens Patches Software Center Flaw Exploited in ClickFix Attacks
Siemens has disclosed and patched a DLL sideloading flaw in its Software Center that has been actively exploited in ClickFix campaigns. Tracked as CVE-2026-110936 (CVSS v4 score: 8.4), the vulnerability arises because the affected application loads DLLs from…
Mon 19 Oct· 2 articles
-
Hackers exploit Plex flaws to install crypto miners and Linux backdoors
Threat actors are actively exploiting a chain of Plex Media Server flaws, collectively dubbed Plex2Shell, to install crypto miners and a Linux proxy backdoor. In-the-wild activity follows a public PoC and chains four vulnerabilities to achieve…
-
Attackers Exploited BeyondTrust Zero Day as Crypto Wallets Were Backdoored
The Hacker News’s weekly recap highlights a week thick with high-stakes cyber incidents and disclosures across software, hardware and AI-enabled systems. Notably, BeyondTrust Remote Support was exploited as a zero-day in late August 2026 (CVE-2026-102764),…
Fri 16 Oct· 2 articles
-
China Linked Hackers Exploited BeyondTrust Zero Day to Steal Credentials
China-linked threat group Armory Castle, also known as UNC5221 or Warp Panda, exploited a zero-day in BeyondTrust Remote Support (formerly Bomgar) to compromise a self-hosted appliance in late August 2026. The flaw, tracked as CVE-2026-102764, is rated 9.3…
-
Fortinet flaw lets stealthy PEERSTITCH malware hijack firewall processes
Security researchers say attackers leveraged Fortinet FortiOS vulnerability CVE-2025-61624 to deploy a memory-resident ARM64 malware named PEERSTITCH. The flaw is a path traversal bug in the FortiOS command line interpreter that could let a privileged…
Thu 15 Oct· 4 articles
-
Attackers Exploit PAN-OS Flaw to Gain VPN Access and Move Laterally
ThreatsDay this week showcases a broad mix of exploits, from widely exploited remote code execution chains to novel attacker use of DNS and AI-enabled tooling. The headline concern is active exploitation of PAN-OS GlobalProtect/Prisma Access via…
-
Silent Lynx Exploits WinRAR Flaw in Attacks on CIS Governments
Silent Lynx has been linked to a new wave of attacks against government organisations across the CIS, with activity spanning from June 2025 to August 2026. The group employs four parallel infection chains that hinge on macro-enabled Office documents, PS2EXE…
-
Ahsay Backup fixes exploited flaws after patches failed to stop attackers
Singapore-based Ahsay Backup has issued updated security patches for AhsayCBS to address two flaws that have been observed in the wild being exploited to deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, CVE-2026-105133 and…
-
Palo Alto Patches PAN-OS Flaw Exploited to Run Code as Root
Palo Alto Networks has released security updates for PAN-OS after a high‑severity remote code execution flaw, tracked as CVE-2026-0322 (CVSS 8.6), was observed being exploited in the wild. The vulnerability affects PAN-OS running on PA‑Series and VM‑Series…
Wed 14 Oct· 4 articles
-
Cisco Email Gateway Flaw Exploited to Run Commands as Root
Cisco has warned that active attacks are exploiting a critical vulnerability in its Secure Email Gateway. The flaw, tracked as CVE-2026-76519 (CVSS 9.8), can allow a sender with no login to write files to the appliance’s operating system and, if successful,…
-
Hackers Exploited Nextcloud Flaw to Plant PHP Web Shells
Hackers compromised a Nextcloud deployment by exploiting a flaw in Collabora Online’s Built-in CODE Server app (Richdocumentscode). Attackers sent unauthenticated requests to proxy[.]php while the local CODE server was not running (for example during…
-
CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks
CISA has urged organisations to urgently update Ivanti Connect Secure (ICS) appliances to the latest version after the disclosure of a zero-day authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS 8.6). The flaw affects ICS versions…
-
Microsoft patches 1,413 flaws as hackers exploit Windows bug
Microsoft has released a record-breaking Patch Tuesday, delivering fixes for 1,413 vulnerabilities across Windows, Office, Developer Tools, SharePoint Server, and SQL Server. The update slate includes 1,102 Windows flaws, 134 in Office, 61 in Developer…
Tue 13 Oct· 2 articles
-
Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In
An attacker chained three Ivanti Connect Secure zero-days to gain root-level access without logging in, with the exploitation observed in the wild starting on 3 October and disclosure on 13 October 2026. The first two flaws form an authentication bypass and…
-
GitLab Patches Critical Flaw That Could Let Attackers Run Server Code
GitLab has issued patches for a critical vulnerability, CVE-2026-97229, that could let an unauthenticated attacker run arbitrary server code. GitLab described the flaw as an integer overflow arising from insufficient regular expression validation in a CI/CD…
Mon 12 Oct· 3 articles
-
Attackers Exploit Atlassian Flaw Just Two Hours After Details Emerge
The weekly recap from 12 October 2026 highlights a stretch where attackers moved rapidly on newly disclosed flaws, underscoring how speed without adequate context can outpace defenders. The standout is Atlassian Data Center’s arbitrary file access flaw,…
-
Hackers Exploit Critical SonicWall SMA Flaw Within Days of Disclosure
Threat actors are actively exploiting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances less than a week after its public disclosure. The flaw, CVE-2026-102255, is a pre-authenticated server-side request forgery (SSRF) with a…
-
AI Powered Campaign Breaches Ukrainian Infrastructure and 429 WordPress Sites
CyberXero, a Russian-speaking initial access broker, is reported to be running a two‑pronged AI‑augmented campaign that targets Ukrainian critical infrastructure and a broader global surface. According to SOCRadar, the operation combines commodity tools such…
Sat 10 Oct· 1 article
-
Enterprise Software’s Hidden AI Agents Create a Security Blind Spot
The Hacker News piece highlights a growing blind spot in AI security: third-party agents that come embedded inside enterprise software, often without a formal adoption decision or clear governance. In a landscape studied for the 2026 State of Agent Security…
Fri 9 Oct· 4 articles
-
P7 DarkSword iOS Exploit Adds Stealthier Keychain and Crypto Theft
Researchers have disclosed a new variant of the DarkSword iOS exploit kit, named P7 DarkSword. Billed as a lighter-on-device variant, it patches tighter on-device stealth by removing debug logs, and it now also exfiltrates keychain data and crypto-wallet…
-
Hackers Exploit AhsayCBS Flaws to Deploy Hidden Crypto Miners
Threat actors have been observed exploiting two recently disclosed flaws in the AhsayCBS backup utility to seize control of affected devices and deploy web shells and XMRig cryptocurrency miners. Details of the flaws are below - CVE-2026-105133 (CVSS v4…
-
CISA Adds Five Flaws to KEV After Flax Typhoon Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after reports that a China-linked actor group, Flax Typhoon, abused them in targeted intrusions. The flaws…
-
Hackers Earn $562,500 for Three Remote Exploits on Pixel 10
Three teams demonstrated remote exploits against Google’s Pixel 10 at Pwn2Own Ireland on 8 October 2026, with the event confirming patches were required for targets. The Pixel 10 entries were remote exploits, meaning breaches were delivered via web content…
Thu 8 Oct· 3 articles
-
China-Based Hackers Accused of Stealing Emails Across 7 Countries
Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other countries said on October 8. The company,…
-
ThreatsDay Round-Up Exposes Rogue Affiliates and Leaky Attack Tools
A weekly ThreatsDay round-up notes a miscellany of mischief, from a rogue ransomware affiliate who kept profits for himself to an exposed server containing intrusion tools. The piece highlights that gang betrayals, careless operators, and sloppy design…
-
Japan’s Data Leaks Surge as Hackers Exploit Apps and Metabase
Attackers in Japan have been chaining personal data leaks by abusing mobile-app APIs and exploiting known flaws in business systems, according to a 8 October 2026 alert from JPCERT/CC. The incidents, described as limited and fragmentary by the CERT, span…
Wed 7 Oct· 1 article
-
Attackers Exploited Critical Atlassian Flaw Within Two Hours of Disclosure
Threat actors began exploiting a newly disclosed critical flaw in Atlassian Data Center products, tracked as CVE-2026-21589 (CVSS 9.3), within two hours of public details. The arbitrary file access vulnerability could allow an unauthenticated attacker to…
Tue 6 Oct· 2 articles
-
Atlassian warns of critical flaw exposing files in self-hosted products
Atlassian has disclosed a critical path-traversal flaw affecting eight self-hosted Data Centre products that could allow unauthenticated attackers to read specific files in the web application root directory. Exploitation does not require login or directory…
-
FBI removes Accenture contractor after ShinyHunters breach exposes staff data
The FBI has removed an Accenture contractor following a security lapse linked to a ShinyHunters data breach that exposed personal details of thousands of FBI employees. Reuters, citing two sources, reports that the incident stemmed from a security failure in…
Mon 5 Oct· 3 articles
-
Credential sprawl is outpacing security teams’ ability to see it
The Credential Layer Is Expanding Faster Than Security Teams Can See It reviews how credentials now sit across humans, systems, and AI, and why visibility into this “credential layer” is critical. GitGuardian’s three-part security approach—Detect, Remediate,…
-
Cling botnet exploits Realtek flaw and hides C2 in STUN traffic
Threat researchers have observed renewed attempts to exploit a now-patched critical vulnerability in Realtek Jungle SDK to deploy a botnet known as Cling. Nozomi Networks notes that Cling repurposes STUN (Session Traversal Utilities for NAT) traffic as a…
-
Citrix NetScaler Zero Day Exploited in Targeted Attacks, CISA Warns
Citrix has released security updates for a high-severity flaw in NetScaler ADC and Citrix NetScaler Gateway that has been observed being exploited in targeted zero-day campaigns. The vulnerability, tracked as CVE-2026-88779, carries a CVSS score of 8.7/10.0…
Fri 2 Oct· 1 article
-
Fortinet FortiMail Zero Day Exploited in Attacks, CISA Warns
Fortinet has disclosed a critical zero-day affecting Fortinet FortiMail that has been observed being exploited in the wild. The flaw, tracked as CVE-2026-104286 with a CVSS score of 9.8, allows unauthenticated attackers to write arbitrary files on the…