News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Today, Mon 2 Nov | 64 so far | 7 |
Developing
Wed 21 Aug 202460 articles
- Man sentenced for hacking state registry to fake his own death
A 39-year old man from Somerset, Kentucky, was sentenced to 81 months in federal prison for identity theft and faking his own death in government registry systems. [...]
BleepingComputer - Google fixes ninth Chrome zero-day exploited in attacks this year
Today, Google released a new Chrome emergency security update to patch a zero-day vulnerability, the ninth one exploited in attacks this year. [...]
BleepingComputer - Fraudulent Slack ad shows malvertiser’s patience and skills
In the past year alone, we have reported almost five hundred unique malvertising incidents related to Google search ads. While it can be difficult to attribute each incident to a specific threat actor, we usually notice similarities between campaigns. Some…
Malwarebytes - Hackers steal banking creds from iOS, Android users via PWA apps
Threat actors started to use progressive web applications to impersonate banking apps and steal credentials from Android and iOS users. [...]
BleepingComputer - My child had her data stolen—here’s how to protect your kids from identity theft
Recently, I received a letter in the mail from a company about a data breach. The letter said that the company had been a victim of a cyberattack back in March in which files were scrambled (what we know as ransomware). The attacker had also accessed…
Malwarebytes - Experts disclosed a critical information-disclosure flaw in Microsoft Copilot Studio
Researchers have disclosed a critical security vulnerability in Microsoft’s Copilot Studio that could lead to the exposure of sensitive information. Researchers disclosed a critical security vulnerability, tracked as CVE-2024-38206 (CVSS score: 8.5),…
Security Affairs - Microsoft to roll out Windows Recall to Insiders in October
Microsoft announced today that it will start rolling out its AI-powered Windows Recall feature to Insiders with Copilot+ PCs in October. [...]
BleepingComputer - Microsoft to rollout Windows Recall to Insiders in October
Microsoft announced today that it will start rolling out its AI-powered Windows Recall feature to Insiders with Copilot+ PCs in October. [...]
BleepingComputer - QNAP adds NAS ransomware protection to latest QTS version
Taiwanese hardware vendor QNAP has added a Security Center with ransomware protection capabilities to the latest version of its QTS operating system for network-attached storage (NAS) devices. [...]
BleepingComputer - North Korea-linked APT used a new RAT called MoonPeak
North Korea-linked APT Kimsuky is likely behind a new remote access trojan called MoonPeak used in a recent campaign spotted by Cisco Talos. Cisco Talos researchers uncovered the infrastructure used by the North Korea-linked APT group tracked as UAT-5394,…
Security Affairs - Litespeed Cache bug exposes millions of WordPress sites to takeover attacks
A critical vulnerability in the LiteSpeed Cache WordPress plugin can let attackers take over millions of websites after creating rogue admin accounts. [...]
BleepingComputer - Microsoft Patches Critical Copilot Studio Vulnerability Exposing Sensitive Data
Cybersecurity researchers have disclosed a critical security flaw impacting Microsoft's Copilot Studio that could be exploited to access sensitive information. Tracked as CVE-2024-38206 (CVSS score: 8.5), the vulnerability has been described as an…
The Hacker News - Critical Authentication Flaw Haunts GitHub Enterprise Server
GitHub patches a trio of security defects in the GitHub Enterprise Server product and recommends urgent patching for corporate users.
SecurityWeek - Microsoft, Linux, Dahua Flaws Exploited: CISA Warns
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert, adding four critical security vulnerabilities impacting Microsoft Exchange Server, the Linux kernel, and Dahua IP Cameras to...
SecurityOnline - Phrack hacker zine publishes new edition after three years
Phrack #71 has been released online and is available to read for free. This issue is the first to be released since 2021, marking a new chapter in the influential online magazine's history. [...]
BleepingComputer - North Korean Hackers Deploy New MoonPeak Trojan in Cyber Campaign
A new remote access trojan called MoonPeak has been discovered as being used by a state-sponsored North Korean threat activity cluster as part of a new campaign. Cisco Talos attributed the malicious cyber campaign to a hacking group it tracks as UAT-5394,…
The Hacker News - CVE-2024-28000 (CVSS 9.8): Active Exploitation of Litespeed Cache Vulnerability, 5 Million WordPress Sites at Risk of Complete Takeover
A critical security vulnerability (CVE-2024-28000, CVSS 9.8) in the widely-used Litespeed Cache plugin for WordPress has been disclosed, leaving over 5 million websites at risk of complete takeover. The vulnerability...
SecurityOnline - New Phishing Technique Bypasses Security on iOS and Android to Steal Bank Credentials
New phishing attacks target iOS and Android users with Progressive Web Applications and WebAPKs to steal banking information.
SecurityWeek - GitHub Enterprise Server vulnerable to critical auth bypass flaw
A critical vulnerability affecting multiple versions of GitHub Enterprise Server could be exploited to bypass authentication and enable an attacker to gain administrator privileges on the machine. [...]
BleepingComputer - Arden Claims Service Reports Data Breach, 139,000 Affected
Personal information for about 39,000 individuals was stolen in October 2023 from class action settlement administrator Arden Claims Service.
SecurityWeek - Man certifies his own (fake) death after hacking into registry system using stolen identity
A 39-year-old man has been sentenced to 81 months in jail after hacking governments systems to fake his own death to dodge paying child support. Yes, you read that right. The press release by the US Attorney’s Office, Eastern District of Kentucky, paints a…
Malwarebytes - Why LinkedIn Developed Its Own AI-Powered Security Platform
An inside look at how LinkedIn developed an internal AI-assisted vulnerability management system to protect its massive infrastructure and user base.
SecurityWeek - Google Play Bug Bounty Program Shutting Down
Google is shutting down its Google Play Security Reward Program (GPSRP) after determining that it has achieved its goal.
SecurityWeek - Thousands of Apps Using AWS ALB Exposed to Attacks Due to Configuration Issue
As many as 15,000 applications using AWS Application Load Balancer (ALB) could be exposed to ALBeast attacks.
SecurityWeek - Deadbeat Dad Faked His Own Death By Hacking Government Databases
No content available.
packetstormsecurity.com - Microsoft Copilot Studio Vuln Led To Information Disclosure
No content available.
packetstormsecurity.com - National Public Data leaked passwords online
Earlier this month, a huge trove of data from scraping service National Public Data was posted online. The dump made international headlines because it included data on hundreds of millions of people, and included Social Security Numbers. As if that wasn’t…
Malwarebytes - Microsoft Copilot Studio Vulnerability Led to Information Disclosure
A vulnerability in Microsoft Copilot Studio exposed information on internal services shared among tenants, potentially impacting multiple customers.
SecurityWeek - What is IOC Management?
What is IOC Management? IOC Management is a critical aspect of cybersecurity that involves identifying, handling, and responding to data points indicating potential security breaches or malicious activity. These indicators can range from IP addresses and…
SOCRadar - Google Cloud Unveils New Security Services and Capabilities
Several security-related enhancements have been announced at the 2024 Google Cloud Security Summit.
SecurityWeek - It's Time To Untangle the SaaS Ball of Yarn
It's no great revelation to say that SaaS applications have changed the way we operate, both in our personal and professional lives. We routinely rely on cloud-based and remote applications to conduct our basic functions, with the result that the only true…
The Hacker News - Styx Stealer Creator's OPSEC Fail Leaks Client List and Profit Details
In what's a case of an operational security (OPSEC) lapse, the operator behind a new information stealer called Styx Stealer leaked data from their own computer, including details related to the clients, profit information, nicknames, phone numbers, and…
The Hacker News - New macOS Malware TodoSwift Linked to North Korean Hacking Groups
Cybersecurity researchers have uncovered a new macOS malware strain dubbed TodoSwift that they say exhibits commonalities with known malicious software used by North Korean hacking groups. "This application shares several behaviors with malware we've seen…
The Hacker News - Unlocking the Power of AI in Cybersecurity
As adversaries increasingly exploit AI, security practitioners must not fall behind. What does it take to unlock the full potential of AI in cybersecurity?
SecurityWeek - Azure Kubernetes Services Vulnerability Exposed Sensitive Information
A vulnerability in Azure Kubernetes Services could have allowed attackers to escalate privileges and access sensitive information on the clusters.
SecurityWeek - North Korean Hackers Upgrade Arsenal with MoonPeak RAT
In a recent disclosure, cybersecurity researchers at Cisco Talos have uncovered a newly developed Remote Access Trojan (RAT) named “MoonPeak,” attributed to a North Korean nexus cluster identified as “UAT-5394.”...
SecurityOnline - Critical Infrastructure at Risk: BVIEC Confirms Cyberattack
The British Virgin Islands Electric Corporation (BVIEC) has encountered severe challenges after falling victim to a cyberattack, as officially announced on Monday, August 19th. This attack affected both the company’s...
SecurityOnline - Toyota confirms customer and employee data stolen, says breach at third party to blame
Last week, a cybercriminal using the handle ZeroSevenGroup dumped 240GB of data on the infamous stolen data site BreachForums, that they said came from a hack on the US branch of car manufacturer Toyota. ZeroSevenGroup claims the dump includes customer and…
Malwarebytes