News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 75 | 20 |
| Today, Tue 27 Oct | 93 so far | 18 |
Developing
Wed 29 Jan 202564 articles
- PrintNightmare Aftermath: Windows Print Spooler is Better. What's Next?
While Microsoft has boosted the security of Windows Print Spooler in the three years since the disclosure of the PrintNightmare vulnerability, the service remains a spooky threat that organizations cannot afford to ignore.
Dark Reading - New York Blood Center Enterprises Ransomware Attack Update
A personal message to whatever threat actor or ransomware group hit the New York Blood Center: You are endangering lives, and every day that goes by will put more lives at risk. Do the morally right thing and give them a decryptor now. — Dissent. A statement…
DataBreaches - Researchers Uncover Lazarus Group Admin Layer for C2 Servers
The threat actor is using a sophisticated network of VPNs and proxies to centrally manage command and control servers from Pyongyang.
Dark Reading - FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent
Sergiu Gatlan reports: Update January 29, 14:15 EST: Seizure banners were added to the cracked[.] io, nulled [.] to, starkrdp [.] io, mysellix [.] io, and sellix [.] io, confirming that the domains had been seized in a joint law enforcement action dubbed…
DataBreaches - With his criminal trial looming, the hacker known as “DR32” pleaded guilty in federal court
With only two weeks until his trial was scheduled to start, Australian national David Kee Crees informed a federal court in Colorado that he wanted to change his plea to guilty. On January 15, he pleaded guilty to 14 out of 22 counts. Background Crees, a 26…
DataBreaches - U.S. CISA adds Apple products’ flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apple products’ flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Apple Multiple Products Use-After-Free…
Security Affairs - Aquabot variant v3 targets Mitel SIP phones
A new variant of the Mirai-based botnet Aquabot targets vulnerable Mitel SIP phones to recruit them into a DDoS botnet. Akamai researchers spotted a new variant of the Mirai-based botnet Aquabot that is targeting vulnerable Mitel SIP phones. Aquabot is a…
Security Affairs - Unpatched Zyxel CPE Zero-Day Pummeled by Cyberattackers
VulnCheck initially disclosed the critical command-injection vulnerability (CVE-2024-40891) six months ago, but Zyxel has yet to mention its existence or offer users a patch to mitigate threats.
Dark Reading - Laravel admin package Voyager vulnerable to one-click RCE flaw
Three vulnerabilities discovered in the open-source PHP package Voyager for managing Laravel applications could be used for remote code execution attacks. [...]
BleepingComputer - Microsoft investigates Microsoft 365 outage affecting users, admins
Microsoft is investigating an ongoing outage preventing users and admins from accessing some Microsoft 365 services and the admin center. [...]
BleepingComputer - These are the 10 worst PIN codes
Australian news outlet ABC NEWS analyzed a data set of 29 million 4-digit PIN numbers that people actually used to secure their devices, ATM withdrawals, building access, and more. What the outlet discovered is both expected and disappointing: Too many…
Malwarebytes - Mirai Variant ‘Aquabot’ Exploits Mitel Device Flaws
Yet another spinoff of the infamous DDoS botnet is exploiting a known vulnerability in active attacks, while its threat actors are promoting it on Telegram for other attackers to use as well, in a DDoS-as-a-service model.
Dark Reading - FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent
The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks. [...]
BleepingComputer - FBI seizes domains for Cracked.io, Nulled.to hacking forums
The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks. [...]
BleepingComputer - Russian APT28 Hackers Exploit Zero-Day Vulnerabilities to Target Government and Security Sectors
A detailed analysis from Maverits, a leading cybersecurity firm, reveals a significant evolution in the strategies and objectives of APT28, a cyber-espionage group linked to Russia’s GRU military intelligence unit. Covering activities from 2022 to 2024, the…
gbhackers.com - Lynx Ransomware Architecture to Attack Windows, Linux, ESXi Uncovered
The emergence of the Lynx Ransomware-as-a-Service (RaaS) platform has drawn significant attention in cybersecurity circles, owing to its advanced technical capabilities, structured affiliate workflow, and expansive ransomware arsenal. Lynx has proven to be a…
gbhackers.com - Lazarus Group Uses React-Based Admin Panel to Control Global Cyber Attacks
The North Korean threat actor known as the Lazarus Group has been observed leveraging a "web-based administrative platform" to oversee its command-and-control (C2) infrastructure, giving the adversary the ability to centrally supervise all aspects of their…
The Hacker News - Windows 11's Start menu is getting iPhone and Android integration
Windows 11's Start menu is getting a big update with full-fledged Android and iPhone integration. [...]
BleepingComputer - Personal medical information might have been exposed on Chicago Department of Public Health dashboard
Todd Feuer reports: Some people might have had their names and medical information exposed on a Chicago Department of Public Health online dashboard last fall, city officials said. On Oct. 8, 2024, the department learned about an “inadvertent potential…
DataBreaches - New Zyxel Zero-Day Under Attack, No Patch Available
GreyNoise reports active exploitation of a newly discovered zero-day vulnerability in Zyxel CPE devices. There are no patches available.
SecurityWeek - Oligo Raises $50M to Tackle Application Detection and Response
Oligo Security has raised $50 million in Series B funding for its application detection and response (ADR) platform.
SecurityWeek - Uncover Hidden Browsing Threats: Get a Free Risk Assessment for GenAI, Identity, Web, and SaaS Risks
As GenAI tools and SaaS platforms become a staple component in the employee toolkit, the risks associated with data exposure, identity vulnerabilities, and unmonitored browsing behavior have skyrocketed. Learn how a complimentary LayerX risk assessment can…
BleepingComputer - The Old Ways of Vendor Risk Management Are No Longer Good Enough
Managing third-party risk in the SaaS era demands a proactive, data-driven approach beyond checkbox compliance.
Dark Reading - Hackers exploit critical unpatched flaw in Zyxel CPE devices
Hackers are exploiting a critical command injection vulnerability in Zyxel CPE Series devices that is currently tracked as CVE-2024-40891 and remains unpatched since last July. [...]
BleepingComputer - TorNet Backdoor: A Stealthy Cyber Threat Targeting Poland and Beyond
TorNet Backdoor: A Stealthy Cyber Threat Targeting Poland and Beyond Put in peril by financial motives, an actor described as a financial threat actor has been conducting an ongoing malicious campaign against users in Poland and Germany since at least July…
SOCRadar - Critical remote code execution bug found in Cacti framework
A critical flaw in Cacti open-source network monitoring and fault management framework that could allow remote code execution. Cacti is an open-source platform that provides a robust and extensible operational monitoring and fault management framework for…
Security Affairs - January Windows 10 preview update force installs new Outlook
Microsoft has started force-installing the new Outlook email client on Windows 10 systems for users who deploy this month's KB5050081 non-security preview update. [...]
BleepingComputer - AI and cloud vulnerabilities aren’t the only threats facing CISOs today
With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and…
securityintelligence.com - Top 10 Exploited Vulnerabilities of 2024
Top 10 Exploited Vulnerabilities of 2024 Organizations face a relentless battle against vulnerabilities that threaten their critical assets, and 2024 has proven to be no exception. Cybersecurity teams constantly juggle priorities, racing to patch gaps before…
SOCRadar - Windows 11 KB5050094 update fixes bugs causing audio issues
Microsoft has released the optional KB5050094 Preview cumulative update for Windows 11 24H2 with 28 bug fixes and changes, including fixes for bugs causing audio playback issues on systems with USB audio device drivers. [...]
BleepingComputer - A Security Loophole in WhatsApp’s “View Once” Mode
Privacy is the cornerstone of digital communication in today’s world, and platforms like WhatsApp consistently introduce features to enhance user security. One such feature is WhatsApp’s “View Once” option, which ensures that sensitive photos and videos…
gbhackers.com - New SLAP and FLOP CPU Attacks Expose Data From Apple Computers, Phones
New CPU side-channel attacks named SLAP and FLOP can be exploited to remotely steal data from Apple mobile and desktop devices.
SecurityWeek - How Interlock Ransomware Infects Healthcare Organizations
The Hacker News reports on Interlock: The Interlock ransomware group begins its attack with a strategic and highly deceptive method known as a Drive-by Compromise. This technique allows the group to gain initial access to targeted systems by exploiting…
DataBreaches - Ransomware attack kept ENGlobal out of some systems for 6 weeks
Jonathan Greig reports: Officials at a large energy industry and federal government contractor were locked out of company financial systems for six weeks due to a recent ransomware attack. ENGlobal Corporation revealed the extended disruptions in an update…
DataBreaches - Aquabot Botnet Targeting Vulnerable Mitel Phones
The Mirai-based Aquabot botnet has been targeting a vulnerability in Mitel SIP phones for which a proof-of-concept (PoC) exploit exists.
SecurityWeek - Is DeepSeek Safe? A Q&A on the Cybersecurity Risks of the AI Platform
Is DeepSeek Safe? A Q&A on the Cybersecurity Risks of the AI Platform DeepSeek, a rising AI platform, has recently made headlines for both its technological advancements and its cybersecurity challenges. The platform, which quickly surpassed ChatGPT as the…
SOCRadar - Smiths Group Scrambling to Restore Systems Following Cyberattack
Engineering firm Smiths Group has disclosed a cyberattack that forced it to take some systems offline and activate business continuity plans.
SecurityWeek - AI in Cybersecurity: What's Effective and What’s Not – Insights from 200 Experts
Curious about the buzz around AI in cybersecurity? Wonder if it's just a shiny new toy in the tech world or a serious game changer? Let's unpack this together in a not-to-be-missed webinar that goes beyond the hype to explore the real impact of AI on…
The Hacker News - New Aquabot Malware Actively Exploiting Mitel SIP phones injection vulnerability
Akamai’s Security Intelligence and Response Team (SIRT) has uncovered a novel variant of the Mirai-based botnet malware, dubbed Aquabotv3, actively targeting Mitel SIP phones via a critical vulnerability. This marks the third observed iteration of Aquabot,…
gbhackers.com - Hackers Attacking Windows, macOS, and Linux systems With SparkRAT
Researchers have uncovered new developments in SparkRAT operations, shedding light on its persistent use in malicious campaigns targeting macOS users and government organizations. The findings, detailed in a recent report, underscore the evolving tactics of…
gbhackers.com