News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 37 so far | 8 |
Developing
Thu 4 Apr 202466 articles
- SurveyLama Data Breach Impacts 4.4 Million Users
Data breach impacting users’ personal information prompts survey rewards platform SurveyLama to reset passwords.
SecurityWeek - Pixel Phone Zero-Days Exploited by Forensic Firms
Google this week patched two Pixel phone zero-day vulnerabilities actively exploited by forensic companies to obtain data from devices.
SecurityWeek - Google’s Response to Pixel Zero-Days: CVE-2024-29745, CVE-2024-29748; Chrome V8 Zero-Day, CVE-2024-3159
Google’s Response to Pixel Zero-Days: CVE-2024-29745, CVE-2024-29748; Chrome V8 Zero-Day, CVE-2024-3159 Google addressed two zero-day vulnerabilities affecting Google Pixel devices, which are reportedly under exploitation. Despite the Android April 2024…
SOCRadar - Considerations for Operational Technology Cybersecurity
Operational Technology (OT) refers to the hardware and software used to change, monitor, or control the enterprise's physical devices, processes, and events. Unlike traditional Information Technology (IT) systems, OT systems directly impact the physical…
The Hacker News - New HTTP/2 Vulnerability Exposes Web Servers to DoS Attacks
New research has found that the CONTINUATION frame in the HTTP/2 protocol can be exploited to conduct denial-of-service (DoS) attacks. The technique has been codenamed HTTP/2 CONTINUATION Flood by security researcher Bartek Nowotarski, who reported the issue…
The Hacker News - New HTTP/2 DoS Attack Potentially More Severe Than Record-Breaking Rapid Reset
New HTTP/2 DoS method named Continuation Flood can pose a greater risk than Rapid Reset, which has been used for record-breaking attacks.
SecurityWeek - Shedding Light on the Ancient Continent: Insights from Southern Africa
Shedding Light on the Ancient Continent: Insights from Southern Africa Today’s online world is full of risks. Our report on cyber threats in Southern Africa is key for anyone wanting to protect their business. It shares important information on the cyber…
SOCRadar - Hosting Providers VMware ESXi Servers Hit by New SEXi Ransomware
A new ransomware variant is targeting VMware ESXi servers, a popular virtualization platform used by hosting providers worldwide. Dubbed “SEXi” by its creators, this ransomware has already made significant waves, with Powerhost’s CEO revealing a staggering…
gbhackers.com - Researchers Observed Visual Studio Code Extensions Stealing Users’ Sensitive Data
ReversingLabs has uncovered a series of Visual Studio Code (VS Code) extensions designed to transfer sensitive information from unsuspecting users. This discovery highlights the growing trend of supply chain attacks increasingly targeting open-source…
gbhackers.com - Zoom Paid Out $10 Million via Bug Bounty Program Since 2019
Video conferencing giant Zoom has paid out $10 million through its bug bounty program since it was launched in 2019.
SecurityWeek - Microsoft’s Security Chickens Have Come Home to Roost
News analysis: SecurityWeek editor-at-large Ryan Naraine reads the CSRB report on China's audacious Microsoft’s Exchange Online hack and isn't at all surprised by the findings.
SecurityWeek - Ivanti fixed for 4 new issues in Connect Secure and Policy Secure
Ivanti addressed four flaws impacting Connect Secure and Policy Secure Gateways that could lead to code execution and denial-of-service (DoS) condition. Ivanti has released security updates to address four security flaws impacting Connect Secure and Policy…
Security Affairs - Gesture Jacking – New Attack That Deceives Website Visitors
The Web Platform is incredibly powerful, but regrettably, malicious websites will do all in their capacity to misuse it. To prevent such exploitation, blocking actions that weren’t accompanied by a “User Gesture” is one of the weakest (but easiest to…
gbhackers.com - Jackson County, Missouri, discloses a ransomware attack
Jackson County, Missouri, confirmed that a ransomware attack has disrupted several county services. A ransomware attack disrupted several services of the Jackson County, Missouri. The County Executive Frank White, Jr. declared a state of emergency. “Jackson…
Security Affairs - Ivanti Rushes Patches for 4 New Flaw in Connect Secure and Policy Secure
Ivanti has released security updates to address four security flaws impacting Connect Secure and Policy Secure Gateways that could result in code execution and denial-of-service (DoS). The list of flaws is as follows - CVE-2024-21894 (CVSS score: 8.2) - A…
The Hacker News - CVE-2024-3273: D-Link NAS Vulnerability Threatens 92,000 Devices
Security researchers have uncovered a serious vulnerability in several D-Link Network Attached Storage (NAS) devices, including DNS-320L, DNS-327L, and others. This flaw leaves devices wide open to attack, giving hackers the ability to execute...
SecurityOnline - Node.js Security Update Addresses Server Crash, Request Smuggling Vulnerabilities
The Node.js project has released a critical security update addressing vulnerabilities in active release lines (v18.x, v20.x, and v21.x) of the popular JavaScript runtime environment. One of the flaws could allow attackers to crash...
SecurityOnline - Multi Vulnerabilities Discovered in VeridiumID Authentication Platform – Patch Now
A recent security advisory from Veridium has exposed a series of significant vulnerabilities in their popular VeridiumID authentication platform. These vulnerabilities, if left unpatched, could allow attackers to steal sensitive user data, hijack user...
SecurityOnline - Hackers Claiming Breach of Five Eyes Intelligence Group (FVEY) Documents
A group of hackers has announced the release of sensitive documents purportedly belonging to the Five Eyes Intelligence Group (FVEY), a prominent intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom, and the United States. The…
gbhackers.com - Rhadamanthys Stealer: MaaS Malware Hits Oil & Gas
Cofense Intelligence has identified a highly advanced phishing campaign aimed directly at the Oil and Gas sector. This campaign delivers the Rhadamanthys Stealer, an advanced Malware-as-a-Service (MaaS), through a complex and deceptive strategy that...
SecurityOnline - Critical Vulnerabilities Discovered in Ivanti Connect Secure and Policy Secure
Ivanti has released an urgent security advisory detailing multiple critical vulnerabilities affecting their popular Connect Secure (ICS) and Policy Secure gateways. These vulnerabilities, if left unpatched, could allow unauthenticated attackers to take down…
SecurityOnline - Developers Beware: Supply Chain Attacks Target Visual Studio Code Extensions
In a concerning development for the software industry, security researchers at ReversingLabs have uncovered a new threat vector within the popular Visual Studio Code (VS Code) Marketplace. Malicious actors are disguising data-stealing extensions as...
SecurityOnline - Urgent: Patch Critical Vulnerabilities in Widely-Used REHub WordPress Theme & Plugin
The security researcher Rafie Muhammad has found multiple high-severity vulnerabilities in the REHub WordPress theme (premium version) and the associated REHub Framework plugin. These weaknesses, if left unpatched, could have devastating consequences for…
SecurityOnline - Fake Shops, Real Theft: Android Malware Targets Banks
In a disturbing development, a long-running scam campaign using fake e-commerce sites has significantly increased its danger. Initially focused on Malaysia, researchers at Cyble Research and Intelligence Lab (CRIL) reveal that this operation now...
SecurityOnline - Singapore Sets High Bar in Cybersecurity Preparedness
While Singaporean organizations have adopted the majority of their government's cybersecurity recommendations, they aren't immune: More than eight in 10 experienced a cybersecurity incident over the course of the year.
Dark Reading - Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack
The U.S. Department of Homeland Security's Cyber Safety Review Board (CSRB) has released a scathing report on how Microsoft handled its 2023 Exchange Online attack, warning that the company needs to do better at securing data and be more truthful about how…
BleepingComputer