News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Mon 26 Oct | 74 | 5 |
| Today, Tue 27 Oct | 0 so far | 0 |
Developing
Fri 22 Mar 202457 articles
- Unsaflok flaws allow to open millions of doors using Dormakaba Saflok electronic locks
A flaw in Dormakaba Saflok electronic locks, dubbed Unsaflok, can allow threat actors to open millions of doors worldwide. Researchers Lennert Wouters, Ian Carroll, rqu, BusesCanFly, Sam Curry, sshell, and Will Caruana discovered a series of...
Security Affairs - Microsoft releases emergency fix for Windows Server crashes
Microsoft has released emergency out-of-band (OOB) updates to fix a known issue causing Windows domain controllers to crash after installing the March 2024 Windows Server security updates. [...]
BleepingComputer - Russian APT Releases More Deadly Variant of AcidRain Wiper Malware
New AcidPour variant can attack a significantly broader range of targets including IoT devices, storage area networks, and handhelds.
Dark Reading - Emora: GUI OSINT tool to search accounts by username across social networks
Emora Emora allows you to search for accounts by username across social networks. Inspired by tools like Sherlock, Emora provides a user-friendly graphical interface to ease the usage and navigation through the results. Features Intuitive...
SecurityOnline - NoArgs: dynamically spoof and conceal process arguments while staying undetected
NoArgs: Manipulating and Hiding Process Arguments NoArgs is a tool designed to dynamically spoof and conceal process arguments while staying undetected. It achieves this by hooking into Windows APIs to dynamically manipulate the Windows...
SecurityOnline - Russian hackers target German political parties with WineLoader malware
Researchers are warning that a notorious hacking group linked to Russia's Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions. [...]
BleepingComputer - New Go loader pushes Rhadamanthys stealer
Malware loaders (also known as droppers or downloaders) are a popular commodity in the criminal underground. Their primary function is to successfully compromise a machine and deploy one or multiple additional payloads. A good loader avoids detection and…
Malwarebytes - Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The…
Krebs on Security - Canada revisits decision to ban Flipper Zero
In February 2024 the Canadian government announced plans to ban the sale of the Flipper Zero, mainly because of its reported use to steal cars. The Flipper Zero is a portable device that can be used in penetration testing with a focus on wireless devices and…
Malwarebytes - Apple Stingy With Details About Latest iOS Update
The security update comes just weeks after the release of iOS 17.4, but Apple has not included CVEs or information about the fixes.
Dark Reading - Hackers Can Unlock Over 3 Millions Hotel Doors In Seconds
No content available.
packetstormsecurity.com - Apple Lawsuit: US Says iPhone Monopoly Undermines Security
No content available.
packetstormsecurity.com - China Relaxes Some Security Review Rules For Data Exports
No content available.
packetstormsecurity.com - Russian APT29 Hackers Caught Targeting German Political Parties
No content available.
packetstormsecurity.com - GoFetch - Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers
No content available.
packetstormsecurity.com - Mozilla fixes two Firefox zero-day bugs exploited at Pwn2Own
Mozilla has released security updates to fix two zero-day vulnerabilities in the Firefox web browser exploited during the Pwn2Own Vancouver 2024 hacking competition. [...]
BleepingComputer - Darknet marketplace Nemesis Market seized by German police
The German police have seized infrastructure for the darknet Nemesis Market cybercrime marketplace in Germany and Lithuania, disrupting the site's operation. [...]
BleepingComputer - Russian APT29 Hackers Caught Targeting German Political Parties
Russia’s APT29 hacking group is expanding targets to political parties in Germany using a new backdoor variant tracked as Wineloader.
SecurityWeek - UN Adopts Resolution Backing Efforts to Ensure Artificial Intelligence is Safe
The resolution, sponsored by the United States and co-sponsored by 123 countries, including China, was adopted by consensus with a bang of the gavel and without a vote, meaning it has the support of all 193 U.N. member nations.
SecurityWeek - Ransomware Group Takes Credit for Attack on Boat Dealer MarineMax
The Rhysida ransomware group has taken credit for the cyberattack on MarineMax and is offering to sell stolen data for 15 bitcoin.
SecurityWeek - New GoFetch attack on Apple Silicon CPUs can steal crypto keys
A new side-channel attack called "GoFetch" impacts Apple M1, M2, and M3 processors and can be used to steal secret cryptographic keys from data in the CPU's cache. [...]
BleepingComputer - ‘Brain Weasels’: Impostor Syndrome in Cybersecurity
There are several attributes that tie the cybersecurity community together–namely our collective passion for solving complex problems in order to reduce harm – but one has stood out prominently over the years: impostor syndrome.
SecurityWeek - New StrelaStealer Phishing Attacks Hit Over 100 Organizations in E.U. and U.S.
Cybersecurity researchers have detected a new wave of phishing attacks that aim to deliver an ever-evolving information stealer referred to as StrelaStealer. The campaigns impact more than 100 organizations in the E.U. and the U.S., Palo Alto Networks Unit…
The Hacker News - In Other News: Google’s PQC Threat Model, Keyboard Sounds Expose Data, AI Roadmap
Noteworthy stories that might have slipped under the radar: Google’s post-quantum cryptography threat model, keyboard typing sounds can expose data, DHS publishes AI roadmap.
SecurityWeek - 8 Strategies for Enhancing Code Signing Security
Strong code-signing best practices are an invaluable way to build trust in the development process and enable a more secure software supply chain.
Dark Reading - AWS Patches Critical 'FlowFixation' Bug in Airflow Service to Prevent Session Hijacking
Cybersecurity researchers have shared details of a now-patched security vulnerability in Amazon Web Services (AWS) Managed Workflows for Apache Airflow (MWAA) that could be potentially exploited by a malicious actor to hijack victims' sessions and achieve…
The Hacker News - Kenya to TikTok: Prove Compliance With Our Privacy Laws
Beleaguered social media platform now faces scrutiny by the Kenyan government over cybersecurity and data privacy.
Dark Reading - 39,000 Websites Infected in ‘Sign1’ Malware Campaign
Over 39,000 websites have been infected with the Sign1 malware that redirects visitors to scam domains.
SecurityWeek - Why AI Obituary Scams Are a Cyber-Risk for Businesses
Scammers now use AI to instantly whip up SEO-friendly bereavement scams, and it's never been easier to swindle mourners or use them to get to their employers.
Dark Reading - Critical SQL Injection Vulnerability in PgJDBC Affects Atlassian Bamboo Data Center and Server (CVE-2024-1597)
No content available.
SOCRadar - US Government Issues New DDoS Mitigation Guidance
CISA, the FBI, and MS-ISAC have released new guidance on how federal agencies can defend against DDoS attacks.
SecurityWeek - China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws
A China-linked threat cluster leveraged security flaws in Connectwise ScreenConnect and F5 BIG-IP software to deliver custom malware capable of delivering additional backdoors on compromised Linux hosts as part of an "aggressive" campaign. Google-owned…
The Hacker News - Massive Sign1 Campaign Infects 39,000+ WordPress Sites with Scam Redirects
A massive malware campaign dubbed Sign1 has compromised over 39,000 WordPress sites in the last six months, using malicious JavaScript injections to redirect users to scam sites. The most recent variant of the malware is estimated to have infected no less…
The Hacker News - Implementing Zero Trust Controls for Compliance
The ThreatLocker® Zero Trust Endpoint Protection Platform implements a strict deny-by-default, allow-by-exception security posture to give organizations the ability to set policy-based controls within their environment and mitigate countless cyber threats,…
The Hacker News - BlueFlag Security Emerges From Stealth With $11.5M in Funding
BlueFlag Security emerges from stealth mode with $11.5 million in a seed funding round led by Maverick Ventures and Ten Eleven Ventures.
SecurityWeek - Cybersecurity in the Skies: SOCRadar Aviation Industry Threat Landscape Report
No content available.
SOCRadar - Saflok Lock Vulnerability Can Be Exploited to Open Millions of Doors
Vulnerability in Dormakaba’s Saflok electronic locks allow hackers to forge keycards and open millions of doors.
SecurityWeek - Pwn2Own Vancouver 2024: participants earned $1,132,500 for 29 unique 0-days
Pwn2Own Vancouver 2024 hacking competition has ended, and participants earned $1,132,500 for demonstrating 29 unique zero-days. Trend Micro’s Zero Day Initiative (ZDI) announced that participants earned $1,132,500 on the Pwn2Own Vancouver 2024 hacking…
Security Affairs - New ‘GoFetch’ Apple CPU Attack Exposes Crypto Keys
Researchers detail GoFetch, a new side-channel attack impacting Apple CPUs that could allow an attacker to obtain secret keys.
SecurityWeek