News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 10 so far | 1 |
Developing
Wed 22 Jan 202569 articles
- Critical zero-days impact premium WordPress real estate plugins
The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges. [...]
BleepingComputer - Trump Overturns Biden Rules on AI Development, Security
The new administration moved quickly to remove any constraints on AI development and collected $500 billion in investment pledges for an American-owned AI joint venture.
Dark Reading - Pwn2Own Automotive 2025 Day 1: organizers awarded $382,750 for 16 zero-days
Trend Micro’s Zero Day Initiative (ZDI) announced that $380K was awarded on Day 1 of Pwn2Own Automotive 2025. Trend Micro’s Zero Day Initiative (ZDI) announced that over $380,000 was awarded on Day 1 of Pwn2Own Automotive 2025, a hacking contest that was…
Security Affairs - Cloudflare CDN flaw leaks user location data, even through secure chat apps
A security researcher discovered a flaw in Cloudflare's content delivery network (CDN), which could expose a person's general location by simply sending them an image on platforms like Signal and Discord. [...]
BleepingComputer - Chinese Cyberspies Target South Korean VPN in Supply Chain Attack
Advanced persistent threat group PlushDaemon, active since 2019, is using a sophisticated modular backdoor to collect data from infected systems in South Korea.
Dark Reading - Two ransomware groups abuse Microsoft’s Office 365 platform to gain access to target organizations
Two ransomware groups exploiting Microsoft 365 services and default settings to target internal enterprise users. Sophos researchers started investigating two distinct clusters of activity, tracked as STAC5143 and STAC5777, in response to customer ransomware…
Security Affairs - Telegram captcha tricks you into running malicious PowerShell scripts
Threat actors on X are exploiting the news around Ross Ulbricht to direct unsuspecting users to a Telegram channel that tricks them into executing PowerShell code that infects them with malware. [...]
BleepingComputer - Trump Pardons 'Silk Road' Dark Web Drug Market Creator
The pardon comes after 11 years in prison for Ross Ulbricht, who was sentenced to life without parole on several charges, including computer hacking, distribution of narcotics, and money laundering.
Dark Reading - Cisco warns of denial of service flaw with PoC exploit code
Cisco has released security updates to patch a ClamAV denial-of-service (DoS) vulnerability, which has proof-of-concept (PoC) exploit code. [...]
BleepingComputer - PowerSchool hacker claims they stole data of 62 million students
The hacker who breached education tech giant PowerSchool claimed in an extortion demand that they stole the personal data of 62.4 million students and 9.5 million teachers. [...]
BleepingComputer - DHS Disbands Cyber Safety Review Board, Ending One of CISA’s Few Bright Spots
The Trump administration has disbanded the Cyber Safety Review Board (CSRB), ending one of the few bright spots at CISA.
SecurityWeek - Application Security Firm DryRun Raises $8.7 Million in Seed Funding
DryRun Security has raised $8.7 million in a seed funding round for its AI-powered application security solutions.
SecurityWeek - Conduent confirms cybersecurity incident behind recent outage
American business services giant and government contractor Conduent confirmed today that a recent outage resulted from what it described as a "cyber security incident." [...]
BleepingComputer - Trump Terminates DHS Advisory Committee Memberships, Disrupting Cybersecurity Review
The new Trump administration has terminated all memberships of advisory committees that report to the Department of Homeland Security (DHS). "In alignment with the Department of Homeland Security's (DHS) commitment to eliminating the misuse of resources and…
The Hacker News - Doti AI Raises £7 Million Seed Funding for Instant Access to Internal Company Data
Doti's platform uses AI to improve, automate, and streamline standard office and business processes across distributed and hybrid environments.
SecurityWeek - MasterCard DNS Error Went Unnoticed for Years
The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for…
Krebs on Security - Windows 11 24H2 now also offered to all eligible Windows 10 PCs
Microsoft says Windows 11 24H2 has entered the broad deployment phase and is now available to all seekers via Windows Update. [...]
BleepingComputer - IPany VPN breached in supply-chain attack to push custom malware
South Korean VPN provider IPany was breached in a supply chain attack by the "PlushDaemon" China-aligned hacking group, who compromised the company's VPN installer to deploy the custom 'SlowStepper' malware. [...]
BleepingComputer - Use this AI chatbot prompt to create a password-exclusion list
Creating a custom password-exclusion list can help prevent employees from using passwords that are likely to be guessed. Learn from Specops Software on using AI to generate password dictionary for securing your organization's credentials. [...]
BleepingComputer - Will 2025 See a Rise of NHI Attacks?
The flurry of non-human identity attacks at the end of 2024 demonstrates extremely strong momentum heading into the new year. That does not bode well.
Dark Reading - Hackers exploit 16 zero-days on first day of Pwn2Own Automotive 2025
On the first day of Pwn2Own Automotive 2025, security researchers exploited 16 unique zero-days and collected $382,750 in cash awards. [...]
BleepingComputer - Dark Web Profile: OilRig (APT34)
Dark Web Profile: OilRig (APT34) OilRig, also known as APT34, is a state-sponsored Advanced Persistent Threat (APT) group with strong ties to Iranian intelligence. Known for its sophisticated cyber-espionage campaigns, OilRig primarily targets government,…
SOCRadar - Call for Presentations Open for SecurityWeek’s 2025 Supply Chain Security & Third-Party Risk Summit
Join Us in Shaping the Future of Supply Chain Security Don’t miss this chance to be part of the conversation addressing one of the most pressing cybersecurity challenges .
SecurityWeek - Cyber Insights 2025: APIs – The Threat Continues
APIs are easy to develop, simple to implement, and frequently attacked. They are prime and lucrative targets for cybercriminals.
SecurityWeek - Hackers Exploit Zero-Day in cnPilot Routers to Deploy AIRASHI DDoS Botnet
Threat actors are exploiting an unspecified zero-day vulnerability in Cambium Networks cnPilot routers to deploy a variant of the AISURU botnet called AIRASHI to carry out distributed denial-of-service (DDoS) attacks. According to QiAnXin XLab, the attacks…
The Hacker News - NY Attorney General James Announces Court Win Allowing Lawsuit Against Citibank to Continue
AG James Sued Citi for Failing to Protect Customers from Fraud, Costing New Yorkers Millions NEW YORK – New York Attorney General Letitia James today announced a significant victory in her case against Citibank (Citi) after a judge denied Citi’s motion to…
DataBreaches - Over $380,000 Paid Out on First Day of Pwn2Own Automotive 2025
$380,000 paid out on the first day of Pwn2Own Automotive 2025 for exploits targeting car infotainment units, operating systems, and chargers.
SecurityWeek - 7-Zip bug could allow a bypass of a Windows security feature. Update now
A patch is available for a vulnerability in 7-Zip that could have allowed attackers to bypass the Mark-of-the-Web (MotW) security feature in Windows. The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location,…
Malwarebytes - Insider Threats: The Overlooked Risks of Departing Employees and Sensitive Data Theft
Joe Lazzarotti of JacksonLewis has a post on one of my favorite topics: insider threats. Insider threats continue to present a significant challenge for organizations of all sizes. One particularly concerning scenario involves employees who leave an…
DataBreaches - The Growing Role of AI-Powered SAST in the Developer Toolkit
In today’s app dev world, where new apps and millions of lines of code are being deployed every day, the need for fast and secure development practices has never been greater. Static Application Security Testing (SAST) plays a big role in meeting this need…
gbhackers.com - Murdoc Botnet Ensnaring Avtech, Huawei Devices
The Mirai-based Murdoc botnet has been actively targeting Avtech and Huawei devices for roughly half a year.
SecurityWeek - Unlock Threat Intelligence Insights with SOCRadar’s AI-Powered Podcast
Unlock Threat Intelligence Insights with SOCRadar’s AI-Powered Podcast The cyber world is constantly changing. As technology advances, so do the threats that jeopardize organizations’ security. December 2024 was no exception, bringing a wave of significant…
SOCRadar - Oracle Patches 200 Vulnerabilities With January 2025 CPU
Oracle has released 318 new security patches to address roughly 200 unique CVEs as part of its January 2025 Critical Patch Update.
SecurityWeek - Record-Breaking DDoS Attack Reached 5.6 Tbps
Cloudflare saw a 53% increase in DDoS attack frequency last year, when it blocked a record-breaking 5.6 Tbps attack.
SecurityWeek - Researcher Says ABB Building Control Products Affected by 1,000 Vulnerabilities
ABB has patched building control product vulnerabilities that can expose many facilities to remote attacks.
SecurityWeek - Book Review: Infected – A Candid Look at VirusTotal’s Birth and Legacy
Part entrepreneurial adventure, part security history, Bernardo Quintero's 'Infected' documents how the VirusTotal side project became a threat-intel cornerstone.
SecurityWeek - Discover Hidden Browsing Threats: Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks
As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Forward-thinking security teams are looking for…
The Hacker News - President Trump Pardons Silk Road Creator Ross Ulbricht After 11 Years in Prison
U.S. President Donald Trump on Tuesday granted a "full and unconditional pardon" to Ross Ulbricht, the creator of the infamous Silk Road drug marketplace, after spending 11 years behind bars. "I just called the mother of Ross William Ulbricht to let her know…
The Hacker News - Ex-CIA Analyst Pleaded Guilty For Leaking Top Secret National Defense Information
A former CIA analyst, Asif William Rahman, has pleaded guilty to charges of retaining and transmitting Top Secret National Defense Information to unauthorized recipients. This alarming breach of national security came to light after classified information…
gbhackers.com - Trump Pardons Founder of Silk Road Website
President Donald Trump has pardoned Ross Ulbricht, the founder of Silk Road, an underground website for selling drugs.
SecurityWeek