News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Today, Mon 2 Nov | 68 so far | 7 |
Developing
Tue 27 Aug 202474 articles
- SMS scammers use toll fees as a lure
In April 2024, the FBI warned about a new type of smishing scam. Smishing is the term we use for phishing attacks sent via text message. This particular smishing scam tries to trick users into clicking a link by telling them they owe a “small amount” in toll…
Malwarebytes - CTEM in the Spotlight: How Gartner's New Categories Help to Manage Exposures
Want to know what’s the latest and greatest in SecOps for 2024? Gartner’s recently released Hype Cycle for Security Operations report takes important steps to organize and mature the domain of Continuous Threat Exposure Management, aka CTEM. Three categories…
The Hacker News - Microsoft 365 Flags Emails with Images as Malware: A Growing Concern for Users
Microsoft 365 users have reported a troubling issue in which email messages containing images are incorrectly flagged as malware and subsequently quarantined. This incident, identified as Issue ID: EX873252, has sparked widespread concern among businesses…
gbhackers.com - Alleged Sales: AMD Breach, U.S. Tax Portal Access, and Fortinet Exploit
Alleged Sales: AMD Breach, U.S. Tax Portal Access, and Fortinet Exploit Recent findings by the SOCRadar Dark Web Team highlight several significant cyber threats targeting various organizations. Among the most notable incidents are the alleged unauthorized…
SOCRadar - Cost of data breaches: The business case for security AI and automation
As Yogi Berra said, “It’s déjà vu all over again.” If the idea of the global average costs of data breaches rising year over year feels like more of the same, that’s because it is. Data protection solutions get better, but so do threat actors. The other…
securityintelligence.com - When Convenience Costs: CISOs Struggle With SaaS Security Oversight
SaaS applications are so easy to use, the decision, and the deployment, is sometimes undertaken by the business unit user with little reference to, nor oversight from, the security team.
SecurityWeek - Microsoft Convenes Endpoint Security Firms Following CrowdStrike Incident
Microsoft has called together cybersecurity firms and government representatives for its Windows Endpoint Security Ecosystem Summit.
SecurityWeek - TDECU data breach affects half a million people
The Texas Dow Employees Credit Union (TDECU) has filed a data breach notification, reporting that the data of 500,474 people has been accessed in an external system breach. TDECU is the largest Houston-area credit union, and the fourth largest in the state…
Malwarebytes - Microsoft Copilot Prompt Injection Vulnerability Let Hackers Exfiltrate Sensitive Data
A security researcher revealed a critical vulnerability in Microsoft Copilot, a tool integrated into Microsoft 365, which allowed hackers to exfiltrate sensitive data. The exploit, disclosed to Microsoft Security Response Center (MSRC) earlier this year,…
gbhackers.com - Researchers unmasked the notorious threat actor USDoD
CrowdStrike researchers have identified the notorious hacker USDoD who is behind several high-profile data leaks. The notorious hacker USDoD (aka EquationCorp), who is known for high-profile data leaks, is a man from Brazil, according to a CrowdStrike…
Security Affairs - Cisco to Acquire AI Security Firm Robust Intelligence
Cisco intends to acquire Robust Intelligence, a California-based company that specializes in securing AI applications.
SecurityWeek - Seattle Airport Blames Outages on Possible Cyberattack
The Port of Seattle, including the SEA Airport, is experiencing system outages likely caused by a cyberattack.
SecurityWeek - HZ Rat backdoor for macOS attacks users of China’s DingTalk and WeChat
In June 2024, we discovered a macOS version of the HZ Rat backdoor targeting users of the enterprise messenger DingTalk and the social network and messaging platform WeChat. The samples we found almost exactly replicate the functionality of the Windows…
securelist.com - Tracking the Cookies: The World of Data Brokers
Tracking the Cookies: The World of Data Brokers Data brokers are companies that specialize in collecting, processing, and selling large amounts of personal and business data. They gather information from numerous sources, employ data mining and analytics…
SOCRadar - Identity of Notorious Hacker USDoD Revealed
USDoD, the hacker known for high-profile data leaks, is a man from Brazil, according to CrowdStrike and others.
SecurityWeek - Google Warns of Exploited Chrome Vulnerability
Google flags another high-severity vulnerability patched with the latest Chrome 128 release as exploited in the wild.
SecurityWeek - News Chrome 0-Day Vulnerability (CVE-2024-7965) Actively Exploited in the Wild
The Chrome team announced that Chrome 128 has been promoted to the stable channel for Windows, Mac, and Linux. This update, Chrome 128.0.6613.84/.85, includes numerous fixes and improvements. However, a critical security vulnerability, CVE-2024-7965, has…
gbhackers.com - Linux Leaps to Record 4.44% Market Share: Open-Source OS Hits All-Time High in July
Recent data from StatCounter indicates that Linux’s market share has ascended to an unprecedented 4.44% in July. This marks a substantial increase from the 3.12% recorded during the corresponding period...
SecurityOnline - Vesra File Type Upload Vulnerability Lets Attackers Gain Sys-Admin Access from MSP
A critical vulnerability has been identified in Versa Director, a vital component of the company’s SD-WAN solution. The vulnerability, officially designated as CVE-2024-39717, allows attackers to upload potentially malicious files, granting them system…
gbhackers.com - CVE-2024-31214 & CVE-2024-24809: Traccar Users Urged to Update Immediately
Two critical vulnerabilities have been discovered in the popular GPS tracking system Traccar, which is used for both personal and corporate applications. The vulnerabilities, identified as CVE-2024-31214 and CVE-2024-24809, could...
SecurityOnline - Argentina Busts Crypto Ring Linked to North Korea, Seizes Millions
In Argentina, the police have uncovered an illegal financial organization engaged in the exchange of fiat and cryptocurrencies, which may be connected to North Korean hackers. The organization was led...
SecurityOnline - Microsoft Fixes ASCII Smuggling Flaw That Enabled Data Theft from Microsoft 365 Copilot
Details have emerged about a now-patched vulnerability in Microsoft 365 Copilot that could enable the theft of sensitive user information using a technique called ASCII smuggling. "ASCII Smuggling is a novel technique that uses special Unicode characters…
The Hacker News - Google Warns of CVE-2024-7965 Chrome Security Flaw Under Active Exploitation
Google has revealed that a security flaw that was patched as part of a security update rolled out last week to its Chrome browser has come under active exploitation in the wild. Tracked as CVE-2024-7965, the vulnerability has been described as an…
The Hacker News - CVE-2024-42531 (CVSS 9.8): Ezviz Camera Flaw Exposes Live Feeds to Unauthenticated Access
A critical vulnerability, identified as CVE-2024-42531 and rated with a CVSS score of 9.8 (Critical), has been discovered in the Ezviz Internet PT Camera CS-CV246. This flaw enables unauthorized individuals...
SecurityOnline - The Dutch Data Protection Authority (DPA) has fined Uber a record €290M
The Dutch Data Protection Authority (DPA) has fined Uber a record €290M for violating the EU data protection regulation while sending sensitive driver data to the U.S. The Dutch Data Protection Authority (DPA) has fined Uber €290 million ($324 million) for…
Security Affairs - Zero-Click Windows RCE Threat: Researcher Publishes PoC Exploit for CVE-2024-38063
In a significant development for cybersecurity professionals, security researcher Ynwarcs has published an in-depth analysis and proof-of-concept (PoC) exploit code for a critical zero-click CVE-2024-38063 vulnerability in Windows TCP/IP. This...
SecurityOnline - Pidgin Users Beware! Malicious Plugin Discovered with Keylogger
In a recent and alarming development, the popular messaging client Pidgin has removed a third-party plugin, “ss-otr,” from its plugin list after it was discovered to contain a malicious keylogger....
SecurityOnline - CVE-2024-6386 (CVSS 9.9) in WPML Plugin Exposes Millions of WordPress Sites to RCE Attacks
A severe security flaw (CVE-2024-6386, CVSS 9.9) has been discovered in the widely-used WPML plugin for WordPress, potentially exposing over one million websites to the risk of complete takeover. The...
SecurityOnline - Exploitation of URL Rewriting: A New Phishing Paradigm Threatens Cybersecurity
Perception Point security researchers have recently uncovered a disturbing trend in phishing attacks: the exploitation of URL rewriting features, a mechanism designed to protect users, is now being weaponized by...
SecurityOnline - Google Chrome Faces Double Blow with New Zero-Day Flaw Exploits: CVE-2024-7965 and CVE-2024-7971
In a significant update to its security advisory, Google has confirmed that CVE-2024-7965, a high-severity zero-day vulnerability in the Chrome browser, has been actively exploited in the wild. This revelation...
SecurityOnline - Iranian Hackers Target US Politicians on Meta Platforms
Meta, the company that owns the popular social networks Facebook, Instagram, and the messaging service WhatsApp, has uncovered attempts to hack the accounts of American officials. The hackers targeted representatives...
SecurityOnline - Digital Wallets: Unveiling Critical Security Risks
A group of security researchers has uncovered vulnerabilities in Apple Pay, Google Pay, and PayPal systems, which allow stolen and canceled payment cards to be used for transactions. The findings...
SecurityOnline - Firefox Klar’s Quiet Change: Adjust Removed Amidst Privacy Concerns
Mozilla has removed the integration with Adjust from its Firefox and Firefox Klar (Firefox Focus) browsers for Android and iOS. The Adjust SDK was used to measure the effectiveness of...
SecurityOnline - Centreon Issues Critical Security Update: SQL Injection Vulnerabilities Threaten IT Monitoring
Centreon, a widely-used open-source monitoring solution, has issued a critical security bulletin addressing multiple SQL injection vulnerabilities in its Centreon Web interface. These vulnerabilities, identified as CVE-2024-32501, CVE-2024-33852,…
SecurityOnline