News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Mon 26 Oct | 75 | 5 |
| Today, Tue 27 Oct | 8 so far | 1 |
Developing
Fri 21 Feb 202564 articles
- Black Basta Goes Dark Amid Infighting, Chat Leaks Show
One of 2024's most active ransomware outfits has been asleep through early 2025, thanks to reality-show-style, behind-the-scenes drama.
Dark Reading - Google Chrome disables uBlock Origin for some in Manifest v3 rollout
Google continues its rollout of gradually disabling uBlock Origin and other Manifest V2-based extensions in the Chrome web browser as part of its efforts to push users to Manifest V3-based extensions. [...]
BleepingComputer - SpyLend Android malware downloaded 100,000 times from Google Play
An Android malware app called SpyLend has been downloaded over 100,000 times from Google Play, where it masqueraded as a financial tool but became a predatory loan app for those in India. [...]
BleepingComputer - Cisco Confirms Salt Typhoon Exploitation in Telecom Hits
In addition to using CVE-2018-0171 and other Cisco bugs to break into telecom networks, the China-sponsored APT is also using using stolen login credentials for initial access.
Dark Reading - SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix
In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer overflow vulnerability CVE-2025-0282 in Ivanti Connect Secure, as confirmed by JPCERT/CC. This vulnerability, disclosed in January 2025, had already been…
gbhackers.com - Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key
A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing attackers to extract private keys used for signing SAML authentication requests. The flaw, tracked as CVE-2022-35202, stems from the use of a Java…
gbhackers.com - NSA Allegedly Hacked Northwestern Polytechnical University, China Claims
Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a cyberattack on Northwestern Polytechnical University, a prominent Chinese institution specializing in aerospace and defense research. The allegations,…
gbhackers.com - ACRStealer Malware Abuses Google Docs as C2 to Steal Login Credentials
The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens, has seen a significant increase in its distribution since the beginning of 2025. Initially distributed in limited volumes in mid-2024, this malware has now…
gbhackers.com - Nations Open 'Data Embassies' to Protect Critical Info
Estonia and Monaco back up their citizens' information to a data center in Luxembourg, while Singapore looks to India as its safe haven for data. But geopolitical challenges remain.
Dark Reading - Hacker steals record $1.46 billion from Bybit ETH cold wallet
Cryptocurrency exchange Bybit revealed today that an unknown attacker stole over $1.46 billion worth of cryptocurrency from one of its ETH cold wallets. [...]
BleepingComputer - Healthcare security lapses keep piling up
Healthcare is one of the sectors that has the most sensitive information about us. At the same time it’s one of the worst at keeping them secret. Because of its access and storage of our personal health information (PHI) and other personally identifiable…
Malwarebytes - Apple Drops iCloud's Advanced Data Protection in the U.K. Amid Encryption Backdoor Demands
Apple is removing its Advanced Data Protection (ADP) feature for iCloud from the United Kingdom with immediate effect following government demands for backdoor access to encrypted user data. The development was first reported by Bloomberg. ADP for iCloud is…
The Hacker News - Data Leak Exposes TopSec's Role in China’s Censorship-as-a-Service Operations
An analysis of a data leak from a Chinese cybersecurity company TopSec has revealed that it likely offers censorship-as-a-service solutions to prospective customers, including a state-owned enterprise in the country. Founded in 1995, TopSec ostensibly offers…
The Hacker News - Freelance Software Developers in North Korean Malware Crosshairs
Hundreds of freelance software developers, ranging from junior developers to highly experienced professionals, have been targeted and infected with North Korean malware over the past year, according to a new report from ESET. The victims, mostly associated…
SecurityWeek - CISA flags Craft CMS code injection flaw as exploited in attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks. [...]
BleepingComputer - Apple Pulls Advanced Data Protection for New UK Users Amid Backdoor Demand
Apple says can no longer offer end-to-end encrypted cloud backups in the UK and insists it will never build a backdoor or master key.
SecurityWeek - Apple pulls iCloud end-to-end encryption feature in the UK
Apple will no longer offer iCloud end-to-end encryption in the United Kingdom after the government requested a backdoor to access Apple customers' encrypted cloud data. [...]
BleepingComputer - 4 Low-Cost Ways to Defend Your Organization Against Deepfakes
Every organization should be exploring a layered approach in which artificial and human intelligences come together to form a rich, dynamic, and multifaceted deepfake defense strategy tailored to its needs.
Dark Reading - Cisco Details ‘Salt Typhoon’ Network Hopping, Credential Theft Tactics
Cisco Talos observed Chinese hackers team pivoting from a compromised device operated by one telecom to target a device in another telecom.
SecurityWeek - B1ack’s Stash released 1 Million credit cards
Experts warn that the carding website B1ack’s Stash released a collection of over 1 million unique credit and debit cards. D3 Lab researchers reported that on February 19, 2025, the carding website B1ack’s Stash released a collection of over&nbs...
Security Affairs - Nagios XI Flaw Exposes User Details and Emails to Unauthenticated Attackers”
A security vulnerability in Nagios XI 2024R1.2.2, tracked as CVE-2024-54961, has been disclosed, allowing unauthenticated attackers to retrieve sensitive user information, including usernames and email addresses, from the network monitoring platform. This…
gbhackers.com - Critical UniFi Protect Camera Vulnerability Enables Remote Code Execution Attacks
Ubiquiti Networks has issued an urgent security advisory (Bulletin 046) warning of multiple critical vulnerabilities in its UniFi Protect camera ecosystem, including a high-severity remote code execution (RCE) flaw that could allow attackers to hijack…
gbhackers.com - Critical Vulnerability in Fluent Bit Exposes Cloud Services to Potential Cyber Attacks
A critical security flaw in Fluent Bit, a widely adopted log processing and metrics collection tool part of the Cloud Native Computing Foundation (CNCF), has exposed enterprise cloud infrastructures to denial-of-service (DoS) attacks. Designated as…
gbhackers.com - In Other News: Black Basta Chats Leaked, New SEC Cyber Unit, DOGE Site Hacked
Noteworthy stories that might have slipped under the radar: Black Basta ransomware chat logs leaked, SEC launches new cyber unit, DOGE website hacked.
SecurityWeek - Top 10 Best Free Cyber Threat Intelligence Sources and Tools in 2025
Top 10 Best Free Cyber Threat Intelligence Sources and Tools in 2025 In 2023, we compiled a list of the top free Cyber Threat Intelligence (CTI) sources to help security teams stay ahead of evolving threats. Since then, the cyber landscape has shifted…
SOCRadar - Vulnerabilities in MongoDB Library Allow RCE on Node.js Servers
OPSWAT details two critical vulnerabilities in the Mongoose ODM library for MongoDB leading to remote code execution on the Node.js server.
SecurityWeek - Cybercriminals Can Now Clone Any Brand’s Site in Minutes Using Darcula PhaaS v3
The threat actors behind the Darcula phishing-as-a-service (PhaaS) platform appear to be readying a new version that allows prospective customers and cyber crooks to clone any brand's legitimate website and create a phishing version, further bringing down…
The Hacker News - How China Pinned University Cyberattacks on NSA Hackers
A researcher dives into Chinese reports attributing cyberattacks on Northwestern Polytechnical University to the NSA’s TAO division.
SecurityWeek - BlackBasta Ransomware Chatlogs Leaked Online
Kevin Poireault reports: Netherlands-based threat intelligence firm Prodaft revealed on February 20 that internal chatlogs from the BlackBasta ransomware gang have been leaked online. BlackBasta is a ransomware strain that was first detected in April 2022.…
DataBreaches - Niva Bupa investigates alleged data leak after cyber threat
Aman Shukla reports: Niva Bupa Health Insurance Company Ltd has recently informed exchanges that the company received an email from an anonymous sender claiming a potential customer data breach. The company is actively investigating the matter and…
DataBreaches - Black Basta’s Internal Chats Leak: Cybercriminals Are Their Own Worst Enemies
Black Basta’s Internal Chats Leak: Cybercriminals Are Their Own Worst Enemies The infamous Black Basta ransomware gang has once again found itself in turmoil. On February 11, 2025, a major leak exposed the group’s internal Matrix chat logs, allegedly because…
SOCRadar - CISA Warns of Attacks Exploiting Craft CMS Vulnerability
CISA has added a Craft CMS flaw tracked as CVE-2025-23209 to its Known Exploited Vulnerabilities (KEV) catalog.
SecurityWeek - Webinar: Learn How to Identify High-Risk Identity Gaps and Slash Security Debt in 2025
In today’s rapidly evolving digital landscape, weak identity security isn’t just a flaw—it’s a major risk that can expose your business to breaches and costly downtime. Many organizations are overwhelmed by an excess of user identities and aging systems,…
The Hacker News - Second Recently Patched Flaw Exploited to Hack Palo Alto Firewalls
Palo Alto Networks is warning customers that a second vulnerability patched in February is being exploited in attacks.
SecurityWeek - AI-Powered Deception is a Menace to Our Societies
Wherever there’s been conflict in the world, propaganda has never been far away. Travel back in time to 515 BC and read the Behistun Inscription, an autobiography by Persian King Darius that discusses his rise to power. More recently, see how different…
The Hacker News - Microsoft Patches Power Pages Zero-Day (CVE-2025-24989) & Recent PAN-OS Flaw (CVE-2025-0111) Joins CISA KEV
Microsoft Patches Power Pages Zero-Day (CVE-2025-24989) & Recent PAN-OS Flaw (CVE-2025-0111) Joins CISA KEV Two major security flaws pose a serious exploitation risk for organizations using Microsoft Power Pages and Palo Alto Networks PAN-OS firewalls.…
SOCRadar - U.S. CISA adds Craft CMS and Palo Alto Networks PAN-OS flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Craft CMS and Palo Alto Networks PAN-OS vulnerabilities to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added SonicWall SonicOS…
Security Affairs - New Darcula 3.0 Tool Generates Phishing Kits to Mimic Global Brands
The cybercriminal group behind the notorious “darcula-suite” platform has unveiled its latest iteration, darcula 3.0, which introduces groundbreaking capabilities for creating phishing kits targeting any brand globally. This “Phishing-as-a-Service” (PhaaS)…
gbhackers.com - Salt Typhoon Hackers Exploit Cisco Vulnerability to Gain Device Access on US.Telecom Networks
A highly advanced threat actor, dubbed “Salt Typhoon,” has been implicated in a series of cyberattacks targeting major U.S. telecommunications networks, according to a report by Cisco Talos. The campaign, which began in late 2024 and was confirmed by the…
gbhackers.com - CL0P Ransomware Launches Large-Scale Attacks on Telecom and Healthcare Sectors
The notorious CL0P ransomware group has intensified its operations in early 2025, targeting critical sectors such as telecommunications and healthcare. Known for its sophisticated tactics, the group has exploited zero-day vulnerabilities to infiltrate…
gbhackers.com