News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 13–17 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 21 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 16 |
| Thu 29 Oct | 78 | 17 |
| Fri 30 Oct | 69 | 10 |
| Sat 31 Oct | 14 | 3 |
| Sun 1 Nov | 17 | 0 |
| Mon 2 Nov | 80 | 7 |
| Tue 3 Nov | 94 | 4 |
| Today, Wed 4 Nov | 64 so far | 7 |
Developing
Tue 17 Sep 202467 articles
- Remote attack on pagers used by Hezbollah caused 9 deaths and thousands of injuries
Remote attack on pagers used by Hezbollah in Lebanon and Syria caused their explosion; at least 8 nine people dead and more than 2,800 injured. At least nine eight individuals, including a child, were killed and over 2,800 were injured due to the explosion…
Security Affairs - Zero-Click RCE Bug in macOS Calendar Exposes iCloud Data
A researcher bypassed the Calendar sandbox, Gatekeeper, and TCC in a chain attack that allowed for wanton theft of iCloud photos.
Dark Reading - Temu denies breach after hacker claims theft of 87 million data records
Temu denies it was hacked or suffered a data breach after a threat actor claimed to be selling a stolen database containing 87 million records of customer information. [...]
BleepingComputer - 'Marko Polo' Creates Globe-Spanning Cybercrime Juggernaut
The Eastern European group is actively expanding its financial fraud activities, with its pipelines representing a veritable Silk Road for the transfer of cryptocurrency, and lucrative and exploitable data.
Dark Reading - Hundreds of Pagers Exploded in Lebanon and Syria in a Deadly Attack. Here’s What We Know.
Very small explosive devices may have been built into the pagers prior to their delivery to Hezbollah, and then all remotely triggered simultaneously.
SecurityWeek - RT News Hosted Russian Cyber Spy Unit, US Says
US State Department warns that Kremlin-backed media outlets in democracies around the world are hiding Russian cyber spies and actively working to sow discord.
Dark Reading - Broadcom fixes critical RCE bug in VMware vCenter Server
Broadcom has fixed a critical VMware vCenter Server vulnerability that attackers can exploit to gain remote code execution on unpatched servers via a network packet. [...]
BleepingComputer - Construction firms breached in brute force attacks on accounting software
Hackers are brute-forcing passwords for highly privileged accounts on exposed Foundation accounting servers, widely used in the construction industry, to breach corporate networks. [...]
BleepingComputer - Cloudflare outage cuts off access to websites in some regions
A rolling Cloudflare outage is impacting access to web sites worldwide, including BleepingComputer, with sites working in some regions and not others. [...]
BleepingComputer - Apple Abandons Spyware Suit to Avoid Sharing Cyber Secrets
Despite more US sanctions against spyware operators, Apple decided the cost in terms of disclosures about its own anti-spyware efforts was too great.
Dark Reading - VMware Patches Remote Code Execution Flaw Found in Chinese Hacking Contest
VMware warned that an attacker with network access could send a specially crafted packet to execute remote code. CVSS severity score 9.8/10.
SecurityWeek - AT&T pays $13 million FCC settlement over 2023 data breach
The Federal Communications Commission (FCC) has reached a $13 million settlement with AT&T to resolve a probe into whether the telecom giant failed to protect customer data after a vendor's cloud environment was breached three years ago. [...]
BleepingComputer - CISA urges software devs to weed out XSS vulnerabilities
CISA and the FBI urged tech companies to review their software and eliminate cross-site scripting (XSS) vulnerabilities before shipping. [...]
BleepingComputer - Intezer Raises $33M to Extend AI-Powered SOC Platform
Intezer is looking to tap into booming market for AI-powered tooling to address the severe shortage of skilled cybersecurity professionals.
SecurityWeek - Ransomware gangs now abuse Microsoft Azure tool for data theft
Ransomware gangs like BianLian and Rhysida increasingly use Microsoft's Azure Storage Explorer and AzCopy to steal data from breached networks and store it in Azure Blob storage. [...]
BleepingComputer - C/side Raises $6 Million to Secure the Browser Supply Chain
C/side has raised $6 million in a seed-stage funding round to help organizations protect against malicious browser third-party scripts.
SecurityWeek - France Uses Tough, Untested Cybercrime Law To Target Durov
No content available.
packetstormsecurity.com - Hezbollah Members Among Hundreds Wounded after Pagers Explode in Lebanon and Syria, Officials Say
A Hezbollah official speculated that malware may have caused the pagers to heat up and explode.
SecurityWeek - Chinese man charged for spear-phishing against NASA and US Government
US DoJ charged a Chinese national who used spear-phishing emails to obtain sensitive info from NASA, the U.S. Air Force, Navy, Army, and the FAA. The U.S. DoJ charged a Chinese national, Song Wu (39), who used spear-phishing emails to target employees of…
Security Affairs - The Current Cybersecurity Landscape: New Threats, Same Security Mistakes
It is imperative to develop robust policies for new tech and future-proofing by favoring investments in security.
Dark Reading - Software Security Firm RunSafe Raises $12 Million in Series B Funding
RunSafe Security has raised $12 million in a Series B funding round for a solution designed to help companies develop secure software.
SecurityWeek - The AI Threat: Deepfake or Deep Fake? Unraveling the True Security Risks
When it comes to adversarial use of AI, the real question is whether the AI threat is a deep fake, or whether the deepfake is the AI threat.
SecurityWeek - PKfail Secure Boot bypass remains a significant risk two months later
Roughly nine percent of tested firmware images use non-production cryptographic keys that are publicly known or leaked in data breaches, leaving many Secure Boot devices vulnerable to UEFI bootkit malware attacks. [...]
BleepingComputer - D-Link Patches Critical Router Vulnerabilities
D-Link has released patches for critical vulnerabilities that could allow attackers to execute arbitrary code and commands on routers.
SecurityWeek - Hydden Raises $4.4M in Seed Funding for Identity Security Platform
Hydden has raised $4.4 million in seed funding for a solution designed to provide deep visibility into identities, accounts and privileges.
SecurityWeek - CVE backlog update: The NVD struggles as attackers change tactics
In February, the number of vulnerabilities processed and enriched by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) started to slow. By May, 93.4% of new vulnerabilities and 50.8% of known exploited…
securityintelligence.com - iOS 18 is out. Here are the new privacy and security features
On September 16, 2024, Apple released iOS 18. Besides a lot of exciting new features, iOS 18 comes with some privacy and security enhancements. One of the most promising new features is the new Passwords app. Built on the foundation of Apple’s password…
Malwarebytes - Google Chrome Switches to ML-KEM for Post-Quantum Cryptography Defense
Google has announced that it will be switching from KYBER to ML-KEM in its Chrome web browser as part of its ongoing efforts to defend against the risk posed by cryptographically relevant quantum computers (CRQCs). "Chrome will offer a key share prediction…
The Hacker News - U.S. Treasury Sanctions Executives Linked to Intellexa Predator Spyware Operation
The U.S. Department of Treasury has imposed fresh sanctions against five executives and one entity with ties to the Intellexa Consortium for their role in the development, operation, and distribution of a commercial spyware called Predator. "The United…
The Hacker News - SOCRadar Threat Actor Tracking: Your Ultimate Guide to Staying Ahead of Cyber Threats
SOCRadar Threat Actor Tracking: Your Ultimate Guide to Staying Ahead of Cyber Threats Cyber threats come in many forms, driven by diverse motivations from ransomware that seeks financial gain to politically motivated attacks, or attacks purely aimed at…
SOCRadar - Meta to Train AI Models Using Public U.K. Facebook and Instagram Posts
Meta has announced that it will begin training its artificial intelligence (AI) systems using public content shared by adult users across Facebook and Instagram in the U.K. in the coming months. "This means that our generative AI models will reflect British…
The Hacker News - Dependency Confusion Could Have Led to RCE in Google Cloud Platform
Tenable shares details on a dependency confusion attack that led to the execution of code on Google’s internal servers.
SecurityWeek - BlackCloak Raises $17 Million to Protect Executives, High-Profile Individuals
BlackCloak has raised $17 million in Series B funding to protect high-profile individuals from sophisticated cyberattacks.
SecurityWeek - CISA Warns of Windows MSHTML & Progress WhatsUp Gold Flaw Exploited Widely
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two critical vulnerabilities affecting Microsoft Windows MSHTML and Progress WhatsUp Gold. These vulnerabilities, identified as CVE-2024-43461 and…
gbhackers.com - Element Security Emerges From Stealth With CTEM Solution, $5M in Funding
Israeli startup Element Security has emerged from stealth with $5 million in funding and a Continuous Threat Exposure Management (CTEM) solution.
SecurityWeek - How to Investigate ChatGPT activity in Google Workspace
Since launching ChatGPT in 2022, OpenAI has defied expectations with a steady stream of product announcements and enhancements. One such announcement came on May 16, 2024, and for most consumers, it probably felt innocuous. Titled “Improvements to data…
The Hacker News