News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Today, Sat 31 Oct | 11 so far | 2 |
Developing
Mon 1 Jul 202463 articles
- Papua New Guinea Sets High Bar in Data Security
The small island nation's new data protection and governance policy reflects a forward-thinking cybersecurity strategy.
Dark Reading - Multi-Malware 'Cluster Bomb' Campaign Drops Widespread Cyber Havoc
"Unfurling Hemlock" has deployed malware on tens of thousands of systems worldwide by nesting multiple malicious files inside other malicious files.
Dark Reading - Prudential Financial now says 2.5 million impacted by data breach
Prudential Financial, a global financial services company, has revealed that over 2.5 million people had their personal information compromised in a February data breach. [...]
BleepingComputer - Google Opens $250K Bug Bounty Contest for VM Hypervisor
If security researchers can execute a guest-to-host attack using a zero-day vulnerability in the KVM open source hypervisor, Google will make it worth their while.
Dark Reading - 'RegreSSHion' Bug Threatens Takeover of Millions of Linux Systems
The high-severity CVE-2024-6387 in OpenSSH is a reintroduction of a 2006 flaw, and it allows unauthenticated RCE as root.
Dark Reading - CDK Global says all dealers will be back online by Thursday
CDK Global says that its dealer management system (DMS), impacted by a massive IT outage following a June 18th ransomware attack, will be back online by Thursday for all car dealerships. [...]
BleepingComputer - Prudential Data Breach Victim Count Soars to 2.5M
The company seemingly underestimated the severity of the breach after originally providing a head count of roughly 36,000 impacted individuals.
Dark Reading - Australian charged for ‘Evil Twin’ WiFi attack on plane
An Australian man was charged by Australia's Federal Police (AFP) for allegedly conducting an 'evil twin' WiFi attack on various domestic flights and airports in Perth, Melbourne, and Adelaide to steal other people's email or social media credentials. [...]
BleepingComputer - Juniper Rushes Out Emergency Patch for Critical Smart Router Flaw
Although not yet exploited in the wild, the max-critical authentication bypass bug could allow adversaries to take over unpatched Juniper Session Smart Routers and Conductors, and WAN Assurance Routers, the company warns.
Dark Reading - PortSwigger Scores Hefty $112 Million Investment
The British company behind the popular Burp Suite pen-test utilities has banked a massive $112 million investment from Brighton Park Capital.
SecurityWeek - Cisco warns of NX-OS zero-day exploited to deploy custom malware
Cisco has patched an NX-OS zero-day exploited in April attacks to install previously unknown malware as root on vulnerable switches. [...]
BleepingComputer - CVE-2024-20399: Cisco NX-OS Zero-Day Vulnerability Under Active Attack
A zero-day vulnerability (CVE-2024-20399) has been discovered in Cisco NX-OS Software, the operating system powering a wide range of Cisco’s networking devices. This flaw could allow an attacker with administrative credentials to execute commands...
SecurityOnline - Critical Flaws in CocoaPods Expose iOS and macOS Apps to Supply Chain Attacks
A trio of security flaws has been uncovered in the CocoaPods dependency manager for Swift and Objective-C Cocoa projects that could be exploited to stage software supply chain attacks, putting downstream customers at severe risks. The vulnerabilities allow…
The Hacker News - Personal data stolen from unsuspecting airport visitors and plane passengers in “evil twin” attacks, man charged
The Australian Federal Police (AFP) have charged a man for setting up fake free WiFi access points in order to steal personal data from people. The crime was discovered when an airline reported a suspicious WiFi network identified by its employees during a…
Malwarebytes - Google Offering $250k For Full VM Escape In New KVM Bug Bounty Program
No content available.
packetstormsecurity.com - regreSSHion: Remote Unauthenticated Code Execution Vulnerability In OpenSSH Server
No content available.
packetstormsecurity.com - Juniper Issues Emergency Patches For Perfect 10 Router Vuln
No content available.
packetstormsecurity.com - HubSpot Warns of Ongoing Cyberattacks Targeting Customer Accounts
HubSpot is "actively investigating and blocking attempts” to hack into customer accounts but some targets have already been compromised.
SecurityWeek - New Security Vulnerability “regreSSHion” Exposes Millions of Linux OpenSSH Servers to RCE Attacks (CVE-2024-6387)
New Security Vulnerability “regreSSHion” Exposes Millions of Linux OpenSSH Servers to RCE Attacks (CVE-2024-6387) A newly discovered security vulnerability, dubbed “regreSSHion” (CVE-2024-6387), puts millions of OpenSSH server instances at risk of…
SOCRadar - Busted for book club? Why cops want to see what you’re reading, with Sarah Lamdan (Lock and Code S05E14)
This week on the Lock and Code podcast… More than 20 years ago, a law that the United States would eventually use to justify the warrantless collection of Americans’ phone call records actually started out as a warning sign against an entirely different…
Malwarebytes - Hacker Conversations: Chris Evans, Hacker and CISO
Chris Evans, CISO and chief hacking officer at HackerOne, challenges the common perception of both hackers and their motivation.
SecurityWeek - Latest Intel CPUs impacted by new Indirector side-channel attack
Modern Intel processors, including chips from the Raptor Lake and the Alder Lake generations are susceptible to a new type of a high-precision Branch Target Injection (BTI) attack dubbed 'Indirector,' which could be used to steal sensitive information from…
BleepingComputer - Apple CocoaPods Bugs Expose Millions of Apps to Code Injection
Critical dependency manager supply chain vulnerabilities have exposed millions and millions of devices to arbitrary malware for the better part of decade.
Dark Reading - Critical unauthenticated remote code execution flaw in OpenSSH server
A critical flaw in the OpenSSH server can be exploited to achieve unauthenticated remote code execution with root privileges in glibc-based Linux systems. OpenSSH maintainers addressed a critical vulnerability, tracked as CVE-2024-6387, that can lead to…
Security Affairs - Apple's AI Moves Will Impact Future Chip, Cloud Security Plans
Analysts say Apple's black-box approach provides a blueprint for rival chip makers and cloud providers.
Dark Reading - Name That Edge Toon: Cyber Cloudburst
Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.
Dark Reading - Thinking About Security, Fast & Slow
To be effective, managing risk demands both fast responses and strategic thinking.
Dark Reading - New regreSSHion OpenSSH RCE bug gives root on Linux servers
A new OpenSSH unauthenticated remote code execution (RCE) vulnerability dubbed "regreSSHion" gives root privileges on glibc-based Linux systems. [...]
BleepingComputer - Landmark Admin Discloses Data Breach Impacting Personal, Medical Information
Life insurance company Landmark Admin says personal, medical, and insurance information was compromised in a May data breach.
SecurityWeek - Google Offering $250,000 for Full VM Escape in New KVM Bug Bounty Program
Google has announced a new KVM bug bounty program named kvmCTF with rewards of up to $250,000 for a full VM escape.
SecurityWeek - CapraRAT Spyware Disguised as Popular Apps Threatens Android Users
The threat actor known as Transparent Tribe has continued to unleash malware-laced Android apps as part of a social engineering campaign to target individuals of interest. "These APKs continue the group's trend of embedding spyware into curated video…
The Hacker News - ChatGPT 4 can exploit 87% of one-day vulnerabilities
Since the widespread and growing use of ChatGPT and other large language models (LLMs) in recent years, cybersecurity has been a top concern. Among the many questions, cybersecurity professionals wondered how effective these tools were in launching an…
securityintelligence.com - Indian Software Firm's Products Hacked to Spread Data-Stealing Malware
Installers for three different software products developed by an Indian company named Conceptworld have been trojanized to distribute information-stealing malware. The installers correspond to Notezilla, RecentX, and Copywhiz, according to cybersecurity firm…
The Hacker News - Hackers Target Vulnerability Found Recently in Long-Discontinued D-Link Routers
GreyNoise observes the first attempts to exploit a path traversal vulnerability in discontinued D-Link DIR-859 WiFi routers.
SecurityWeek - Millions of OpenSSH Servers Potentially Vulnerable to Remote regreSSHion Attack
Millions of OpenSSH servers could be vulnerable to unauthenticated remote code execution due to a vulnerability tracked as regreSSHion and CVE-2024-6387.
SecurityWeek - Threat Actor IntelBroker Claims Leak of Cognizant OIPA Database
The notorious threat actor known as IntelBroker has claimed responsibility for leaking a database belonging to Cognizant’s Oracle Insurance Policy Administration (OIPA) system. The announcement was made via Twitter on the dark web, sending shockwaves through…
gbhackers.com - Monti gang claims the hack of the Wayne Memorial Hospital in Pennsylvania
Wayne Memorial Hospital in Pennsylvania was the victim of a cyber attack, Monti gang claimed to have hacked the healthcare infrastructure. Another critical infrastructure healthcare suffered a security breach, this time the victim is the Wayne Memorial…
Security Affairs - End-to-End Secrets Security: Making a Plan to Secure Your Machine Identities
At the heart of every application are secrets. Credentials that allow human-to-machine and machine-to-machine communication. Machine identities outnumber human identities by a factor of 45-to-1 and represent the majority of secrets we need to worry about.…
The Hacker News - New OpenSSH Vulnerability Could Lead to RCE as Root on Linux Systems
OpenSSH maintainers have released security updates to contain a critical security flaw that could result in unauthenticated remote code execution with root privileges in glibc-based Linux systems. The vulnerability has been assigned the CVE identifier…
The Hacker News