News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 19 so far | 5 |
Developing
Thu 13 Feb 202572 articles
- whoAMI attacks give hackers code execution on Amazon EC2 instances
Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name. [...]
BleepingComputer - Roundtable: Is DOGE Flouting Cybersecurity for US Data?
Cybersecurity experts weigh in on the red flags flying around the new Department of Government Efficiency's handling of the mountains of US data it now has access to, potentially without basic information security protections in place.
Dark Reading - Chinese APT 'Emperor Dragonfly' Moonlights With Ransomware
Pivoting from prior cyber espionage, the threat group deployed its backdoor tool set to ultimately push out RA World malware, demanding $2 million from its victim.
Dark Reading - New Microsoft Windows GUI 0-Day Vulnerability Actively Exploited in the Wild
A newly discovered vulnerability in Microsoft Windows, identified by ClearSky Cyber Security, is reportedly being actively exploited by the Chinese state-sponsored Advanced Persistent Threat (APT) group Mustang Panda. The vulnerability, which affects the…
gbhackers.com - How AI was used in an advanced phishing campaign targeting Gmail users
In May, 2024, the FBI warned about the increasing threat of cybercriminals using Artificial Intelligence (AI) in their scams. At the time, FBI Special Agent in Charge Robert Tripp said: “Attackers are leveraging AI to craft highly convincing voice or video…
Malwarebytes - Nearly a Year Later, Mozilla is Still Promoting OneRep
In mid-March 2024, KrebsOnSecurity revealed that the founder of the personal data removal service Onerep also founded dozens of people-search companies. Shortly after that investigation was published, Mozilla said it would stop bundling Onerep with the…
Krebs on Security - Rapid7 Flags New PostgreSQL Zero-Day Connected to BeyondTrust Exploitation
Rapid7 finds a new zero-day vulnerability in PostgreSQL and links it to chain of attacks against a BeyondTrust Remote Support product.
SecurityWeek - Google Hub in Poland to Develop AI Use in Energy and Cybersecurity Sectors
Poland is being targeted by various forms of cyberattacks and sabotage actions believed to be sponsored by Russia.
SecurityWeek - Burp Suite Professional / Community 2025.2 Released With New Built-in AI Integration
PortSwigger has announced the release of Burp Suite Professional and Community Edition 2025.2, introducing significant updates that include AI integration into the Montoya API, enhancing the capabilities for building smarter, AI-powered extensions. Bug Fixes…
gbhackers.com - The Rise of Cyber Espionage: UAV and C-UAV Technologies as Targets
Researchers at cybersecurity firm Resecurity detected a rise in cyberattacks targeting UAV and counter-UAV technologies. Resecurity identified an increase in malicious cyber activity targeting UAV and counter-UAV (C-UAV/C-UAS) technologies. That was…
Security Affairs - Dutch Police seizes 127 XHost servers, dismantles bulletproof hoster
The Dutch Police (Politie) dismantled the ZServers/XHost bulletproof hosting operation after taking offline 127 servers used by the illegal platform. [...]
BleepingComputer - Hacker leaks account data of 12 million Zacks Investment users
Zacks Investment Research (Zacks) last year reportedly suffered another data breach that exposed sensitive information related to roughly 12 million accounts. [...]
BleepingComputer - Circuit Board Maker Unimicron Targeted in Ransomware Attack
The Sarcoma ransomware group is threatening to leak data stolen from Taiwanese printed circuit board manufacturer Unimicron.
SecurityWeek - China-linked APTs’ tool employed in RA World Ransomware attack
A November 2024 RA World ransomware attack on an Asian software firm used a tool linked to China-linked threat actors. Broadcom researchers reported that threat actors behind an RA World ransomware attack against an Asian software and services firm employed…
Security Affairs - CyberArk Expands Identity Security Play with $165M Acquisition of Zilla Security
CyberArk acquires early stage Boston startup Zilla Security for $165M, expanding its identity security and IGA capabilities.
SecurityWeek - DeepSeek Exposes Major Cybersecurity Blind Spot
Millions of uninformed users have flocked to DeepSeek and share personal information without considering security or privacy risks.
SecurityWeek - Hackers Use CAPTCHA Trick on Webflow CDN PDFs to Bypass Security Scanners
A widespread phishing campaign has been observed leveraging bogus PDF documents hosted on the Webflow content delivery network (CDN) with an aim to steal credit card information and commit financial fraud. "The attacker targets victims searching for…
The Hacker News - How Public & Private Sectors Can Better Align Cyber Defense
With investment in cybersecurity capabilities and proactive measures to address emerging challenges, we can work together to navigate the complexities of combating cybercrime.
Dark Reading - Chinese espionage tools deployed in RA World ransomware attack
A China-based threat actor, tracked as Emperor Dragonfly and commonly associated with cybercriminal endeavors, has been observed using in a ransomware attack a toolset previously attributed to espionage actors. [...]
BleepingComputer - North Korean APT43 Uses PowerShell and Dropbox in Targeted South Korea Cyberattacks
A nation-state threat actor with ties to North Korea has been linked to an ongoing campaign targeting South Korean business, government, and cryptocurrency sectors. The attack campaign, dubbed DEEP#DRIVE by Securonix, has been attributed to a hacking group…
The Hacker News - How red teaming helps safeguard the infrastructure behind AI models
Artificial intelligence (AI) is now squarely on the frontlines of information security. However, as is often the case when the pace of technological innovation is very rapid, security often ends up being a secondary consideration. This is increasingly…
securityintelligence.com - Arbitrary File Upload Vulnerability in WordPress Plugin Let Attackers Hack 30,000 Website
A subgroup of the Russian state-sponsored hacking group Seashell Blizzard, also known as Sandworm, has intensified its cyber operations through a campaign dubbed BadPilot. This multi-year initiative has targeted critical infrastructure worldwide, expanding…
gbhackers.com - Dark Web Profile: Fog Ransomware
Dark Web Profile: Fog Ransomware Fog Ransomware emerged in April 2024, was first detected in the wild in early May, primarily targeting US based educational institutions targeting both Windows and Linux endpoints. It operates as a multi-pronged extortion…
SOCRadar - BadPilot Attacking Network Devices to Expand Russian Seashell Blizzard’s Attacks
A newly uncovered cyber campaign, dubbed “BadPilot,” has been linked to a subgroup of the Russian state-sponsored hacking collective Seashell Blizzard, also known as Sandworm. This operation, active since at least 2021, represents a significant expansion in…
gbhackers.com - Chinese Cyberspy Possibly Launching Ransomware Attacks as Side Job
A toolset associated with China-linked espionage intrusions was employed in a ransomware attack, likely by a single individual.
SecurityWeek - Cybercriminals Exploit Pyramid Pentesting Tool for Covert C2 Communications
Cybersecurity analysts have identified that hackers are leveraging the open-source Pyramid pentesting tool to establish stealthy command-and-control (C2) communications. Originally designed as a post-exploitation framework for penetration testers, Pyramid…
gbhackers.com - SecurityWeek Analysis: Over 400 Cybersecurity M&A Deals Announced in 2024
An analysis conducted by SecurityWeek shows that 405 cybersecurity-related mergers and acquisitions were announced in 2024.
SecurityWeek - Why Darktrace / EMAIL excels against APTs
APTs are sophisticated threat actors with the resources to coordinate and achieve long-term objectives. Amidst the skyrocketing numbers of BEC attacks, every organization should be worried about the ability of intruders to infiltrate and exploit. This blog…
darktrace.com - Threat Actors in Russia, China, and Iran Targeting Local communities in the U.S
Foreign adversaries, including Russia, China, and Iran, are intensifying their efforts to manipulate public opinion and destabilize local communities across the United States. These campaigns, once primarily focused on national-level politics, have…
gbhackers.com - New Phishing Attacks Abuses Webflow CDN & CAPTCHAs to Steal Credit Card details
Netskope Threat Labs has uncovered a sophisticated phishing campaign targeting users across various industries, including technology, manufacturing, and banking. This campaign, active since mid-2024, exploits search engine optimization (SEO) techniques to…
gbhackers.com - 30,000 WordPress Sites Exposed to Exploitation via File Upload Vulnerability
A critical security vulnerability in the “Security & Malware scan by CleanTalk” plugin has left over 30,000 WordPress websites exposed to exploitation. The vulnerability, identified as CVE-2024-13365, allows unauthenticated attackers to conduct arbitrary…
gbhackers.com - Palo Alto Firewall Flaw Exploited in RA World Ransomware Attacks
A recent ransomware attack leveraging a vulnerability in Palo Alto Networks’ PAN-OS firewall software (CVE-2024-0012) has raised significant concerns within the cybersecurity community. The attack, which targeted a medium-sized software and services company…
gbhackers.com - Fast Deployments, Secure Code: Watch this Learn to Sync Dev and Sec Teams
Ever felt like your team is stuck in a constant battle? Developers rush to add new features, while security folks worry about vulnerabilities. What if you could bring both sides together without sacrificing one for the other? We invite you to our upcoming…
The Hacker News - Russia-linked APT Seashell Blizzard is behind the long running global access operation BadPilot campaign
A subgroup of the Russia-linked Seashell Blizzard APT group (aka Sandworm) ran a global multi-year initial access operation called BadPilot. Microsoft shared findings on research on a subgroup of the Russia-linked APT group Seashell Blizzard behind the…
Security Affairs - Jscrambler Raises $5.2 Million for Code, Webpage Protection Solution
Jscrambler has received a $5.2 million investment from Iberis Capital to accelerate innovation and research.
SecurityWeek - Ivanti Security Update Addresses Severe Vulnerabilities in ICS, IPS, and ISAC (CVE-2025-22467, CVE-2024-38657, CVE-2024-10644)
Ivanti Security Update Addresses Severe Vulnerabilities in ICS, IPS, and ISAC (CVE-2025-22467, CVE-2024-38657, CVE-2024-10644) In response to newly identified vulnerabilities, Ivanti has released security updates addressing flaws in Ivanti Connect Secure…
SOCRadar - Widespread Exploitation of ThinkPHP and OwnCloud Flaws by Cybercriminals
GreyNoise has detected a significant surge in exploitation activity targeting two vulnerabilities — CVE-2022-47945 and CVE-2023-49103. The alarming uptick in attacks underscores critical issues in vulnerability management and patch prioritization.…
gbhackers.com - Hackers Exploited PAN-OS Flaw to Deploy Chinese Malware in Ransomware Attack
An RA World ransomware attack in November 2024 targeting an unnamed Asian software and services company involved the use of a malicious tool exclusively used by China-based cyber espionage groups, raising the possibility that the threat actor may be…
The Hacker News - Windows 11 Compression Features Pose libarchive Security Threats
Microsoft’s ongoing efforts to enhance user experience in Windows 11 have introduced native support for a variety of new archive formats via the KB5031455 update. While these changes have streamlined user workflows, they have also inadvertently opened…
gbhackers.com - Palo Alto Networks Patches Potentially Serious Firewall Vulnerability
Palo Alto Networks has published 10 new security advisories, including one for a high-severity firewall authentication bypass vulnerability.
SecurityWeek