News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 19 so far | 5 |
Developing
Wed 3 Apr 202469 articles
- Scathing Federal Report Rips Microsoft for Shoddy Security, Insincerity in Response to Chinese Hack
Cyber Safety Review Board, said “a cascade of errors” by Microsoft let state-backed Chinese cyber operators break into email accounts of senior U.S. officials.
SecurityWeek - Google Chrome Beta Tests New DBSC Protection Against Cookie-Stealing Attacks
Google on Tuesday said it's piloting a new feature in Chrome called Device Bound Session Credentials (DBSC) to help protect users against session cookie theft by malware. The prototype – currently tested against "some" Google Account users running Chrome…
The Hacker News - GenAI: The next frontier in AI security threats
Threat actors aren’t attacking generative AI (GenAI) at scale yet, but these AI security threats are coming. That prediction comes from the 2024 X-Force Threat Intelligence Index. Here’s a review of the threat intelligence types underpinning that report.…
securityintelligence.com - Microsoft’s Exchange Server Hack: Key Rotation Flaw Triggers Breach
Storm-0558, a cyberespionage group affiliated with the People’s Republic of China, has reportedly compromised Microsoft Exchange mailboxes of 22 organizations and over 500 individuals between May and June 2023. This was done by using authentication tokens of…
gbhackers.com - Critical Vulnerability Found in LayerSlider Plugin Installed on a Million WordPress Sites
A critical SQL injection vulnerability in the LayerSlider WordPress plugin allows attackers to extract sensitive information.
SecurityWeek - Missouri County Hit by Ransomware
Jackson County, Missouri, discloses ‘significant disruptions’ to IT systems, says ransomware attack likely at fault.
SecurityWeek - Critical OS Command Injection Flaw in Progress Flowmon: CVE-2024-2389
Critical OS Command Injection Flaw in Progress Flowmon: CVE-2024-2389 Progress disclosed a highly critical vulnerability, CVE-2024-2389, that affects the Flowmon product. Exploiting this vulnerability could let attackers obtain sensitive data and network…
SOCRadar - Attack Surface Management vs. Vulnerability Management
Attack surface management (ASM) and vulnerability management (VM) are often confused, and while they overlap, they’re not the same. The main difference between attack surface management and vulnerability management is in their scope: vulnerability management…
The Hacker News - Google Patches Chrome Flaw That Earned Hackers $42,500 at Pwn2Own
Google pushes a new Chrome update to patch another zero-day vulnerability demonstrated at a hacking contest.
SecurityWeek - XZ Utils Backdoor Attack Brings Another Similar Incident to Light
The discovery of the XZ Utils backdoor reminds an F-Droid developer of a similar incident that occurred a few years ago.
SecurityWeek - CVE-2024-29745 & CVE-2024-29748: Critical Google Pixel Flaws Exploited – Update Immediately
Google has revealed in their April 2024 Pixel Update Bulletin that several serious security flaws could be putting your Pixel device at risk. Two of these vulnerabilities, labeled CVE-2024-29745 and CVE-2024-29748, are already being...
SecurityOnline - Google Patches Exploited Pixel Vulnerabilities
Google patches 28 vulnerabilities in Android and 25 bugs in Pixel devices, including two flaws exploited in the wild.
SecurityWeek - Mispadu Trojan Targets Europe, Thousands of Credentials Compromised
The banking trojan known as Mispadu has expanded its focus beyond Latin America (LATAM) and Spanish-speaking individuals to target users in Italy, Poland, and Sweden. Targets of the ongoing campaign include entities spanning finance, services, motor vehicle…
The Hacker News - Hackers Exploit YouTube for Game Cracks, Steal Your Data
A new report by Proofpoint security reveals a disturbing trend: hackers are hijacking YouTube to prey on gamers seeking a free ride. Popular games and software are offered as “free” downloads or cheats in...
SecurityOnline - secator: The pentester’s swiss knife
secator secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters and security researchers. Feature A curated...
SecurityOnline - Jackson County Missouri Ransomware Attack Impacts IT Systems
Jackson County, Missouri, has become the latest victim of a ransomware attack, which has caused substantial disruptions within its Information Technology (IT) systems. This attack has highlighted the vulnerabilities in digital infrastructures and the…
gbhackers.com - 'Unfaking' News: How to Counter Disinformation Campaigns in Global Elections
What cybersecurity professionals around the world can do to defend against the scourge of online disinformation in this year's election cycle.
Dark Reading - Highly sensitive files mysteriously disappeared from EUROPOL headquarters
Serious security breach hits EU police agency A batch of highly sensitive files containing the personal information of top Europol executives mysteriously disappeared last summer The website Politico reported that the Europol has suffered a serious security…
Security Affairs - Beware of New Mighty Stealer That Takes Webcam Pictures & Capture Cookies
A new menace has emerged that targets personal information with alarming precision. Dubbed the “Mighty Stealer,” this malicious software is designed to infiltrate devices and extract a wide range of sensitive data. The Mighty Stealer is a sophisticated…
gbhackers.com - DarkGate Malware Abusing Cloud Storage & SEO Following Delivery Over Teams
DarkGate loader delivery surged after the Qakbot takedown, with financially motivated actors like TA577 and ransomware groups (BianLian, Black Basta) using it to target financial institutions (US, Europe) for double extortion. It establishes an initial…
gbhackers.com - Critical Security Flaw Found in Popular LayerSlider WordPress Plugin
A critical security flaw impacting the LayerSlider plugin for WordPress could be abused to extract sensitive information from databases, such as password hashes. The flaw, designated as CVE-2024-2879, carries a CVSS score of 9.8 out of a maximum of 10.0. It…
The Hacker News - Cybercrime Actors Behind Agent Tesla Campaigns Unmasked
In a report, Check Point Research (CPR) has lifted the veil of anonymity surrounding two cybercrime actors responsible for recent Agent Tesla malware campaigns. Through meticulous investigation, the researchers exposed the identities, tactics, and...
SecurityOnline - VMware SD-WAN Vulnerabilities Pose Risk to Network Security, Patches Released
VMware has released critical security patches to address multiple vulnerabilities in its SD-WAN (Software-Defined Wide Area Network) solution. These vulnerabilities, if left unpatched, could present significant risks to organizations relying on VMware SD-WAN…
SecurityOnline - “The Com” Phishing Attacks Escalate, Targeting Businesses with Fake Login Pages
A new report from Intel 471 highlights a disturbing increase in targeted phishing attacks launched by a loosely affiliated group of cybercriminals known as “The Com” which is short for “The Community.” These persistent...
SecurityOnline - CVE-2024-3159: Google Chrome Zero-Day Exploit Demonstrated at Pwn2Own
Google has released an urgent security update for its Chrome web browser, patching a critical zero-day vulnerability that was successfully exploited during the recent Pwn2Own Vancouver 2024 hacking competition. The flaw, designated CVE-2024-3159, involves...
SecurityOnline - Threat Actors Weaponize PikaBot Malware with Evolving Attack Techniques
A new report from McAfee Labs reveals a troubling evolution in the PikaBot malware campaign, showcasing an alarming range of infection vectors and techniques. Once limited in its distribution methods, PikaBot is now spreading...
SecurityOnline - Major WordPress Plugin Exposes Millions of Sites to Data Theft
A severe security flaw discovered in the popular LayerSlider WordPress plugin has potentially put over a million websites at risk of data breaches. The vulnerability, designated CVE-2024-2879 with a CVSS score of 9.8 (critical),...
SecurityOnline - European Organizations Targeted by Updated StrelaStealer Malware Campaign
A newly updated variant of the StrelaStealer malware is actively targeting organizations across Europe, according to a recent report from SonicWall Capture Labs. This information-stealing malware, originally observed in November 2022, has a history...
SecurityOnline - Ransomware, Junk Bank Accounts: Cyber Threats Proliferate in Vietnam
An economic success story in Asia, Vietnam is seeing more manufacturing and more business investment. But with that comes a significant uptick in cybercrime as well.
Dark Reading