News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 77 so far | 12 |
Developing
Mon 12 May 202568 articles
- NSO Group's Legal Loss May Do Little to Curtail Spyware
The $168 million judgment against NSO Group underscores how citizens put little store in the spyware industry's justifications for circumventing security — but will it matter?
Dark Reading - ASUS DriverHub flaw let malicious sites run commands with admin rights
The ASUS DriverHub driver management utility was vulnerable to a critical remote code execution flaw that allowed malicious sites to execute commands on devices with the software installed. [...]
BleepingComputer - Windows 11 upgrade block lifted after Safe Exam Browser fix
Microsoft has removed an upgrade block that prevented some Safe Exam Browser users from installing the Windows 11 2024 Update due to incompatibility issues. [...]
BleepingComputer - Attackers Lace Fake Generative AI Tools With 'Noodlophile' Malware
Threat actors are scamming users by advertising legitimate-looking generative AI websites that, when visited, install credential-stealing malware onto the victim's computer.
Dark Reading - U.S. CISA adds TeleMessage TM SGNL to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds TeleMessage TM SGNL flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a TeleMessage TM SGNL flaw, tracked as…
Security Affairs - Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques
Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has evolved with sophisticated PowerShell tools and advanced evasion tactics, leveraging fake CAPTCHA sites to deceive users. Active since mid-2022 and offered…
gbhackers.com - New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms
Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a lure. Dubbed Noodlophile Stealer, this previously undocumented infostealer targets unsuspecting users by exploiting their enthusiasm for AI-powered content…
gbhackers.com - Apple Patches Major Security Flaws in iOS, macOS Platforms
Apple rolls out iOS and macOS platform updates to fix serious security bugs that could be triggered simply by opening an image or video file.
SecurityWeek - Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns
The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,” has been active since at least 2012, targeting nations like South Korea, Japan, and the United States with sophisticated cyber espionage…
gbhackers.com - APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations
The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear phishing campaign targeting activists focused on North Korean issues. Named “Operation: ToyBox Story” by Genians Security Center (GSC), this campaign exploited…
gbhackers.com - 4 Hackers Arrested After Millions Made in Global Botnet Business
The cybercriminals infected older wireless Internet routers with Anyproxy and 5socks malware in order to reconfigure them — all without the users' knowledge.
Dark Reading - Hackers now testing ClickFix attacks against Linux targets
A new campaign employing ClickFix attacks has been spotted targeting both Windows and Linux systems using instructions that make infections on either operating system possible. [...]
BleepingComputer - Researchers found one-click RCE in ASUS’s pre-installed software DriverHub
Expert found two flaws in DriverHub, pre-installed on Asus motherboards, which allow remote code execution via crafted HTTP requests. Security researcher ‘MrBruh’ discovered two vulnerabilities, tracked as CVE-2025-3462 (CVSS score of 8.4) and CVE-2025-346...
Security Affairs - Output Messenger flaw exploited as zero-day in espionage attacks
A Türkiye-backed cyberespionage group exploited a zero-day vulnerability to attack Output Messenger users linked to the Kurdish military in Iraq. [...]
BleepingComputer - Türkiye-Linked Hackers Exploit Output Messenger Zero-Day (CVE-2025-27920) in Espionage Campaign
Microsoft Threat Intelligence has linked a regional cyber-espionage campaign exploiting a zero-day vulnerability in Output Messenger to the
SecurityOnline - Marbled Dust leverages zero-day in Output Messenger for regional espionage
Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output Messenger, a…
Microsoft - Moldova arrests suspect linked to DoppelPaymer ransomware attacks
Moldovan authorities have detained a 45-year-old suspect linked to DoppelPaymer ransomware attacks targeting Dutch organizations in 2021. [...]
BleepingComputer - Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!
IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update 194, packed with security enhancements, performance improvements, and new features to safeguard networks of all sizes. Renowned for its robust feature set,…
gbhackers.com - Google to pay $1.375 billion to settle Texas data privacy violations
Google has agreed to a $1.375 billion settlement with the state of Texas over a 2022 lawsuit that alleged it had been collecting and using biometric data of millions of Texans without properly acquiring their consent. [...]
BleepingComputer - Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft
Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by script kiddies and hacktivists, have undergone a sophisticated transformation in today’s complex, hybrid-cloud environments. No longer just blunt instruments…
gbhackers.com - Majority of Browser Extensions Pose Critical Security Risk, A New Report Reveals
99% of enterprise users have browser extensions but over half carry high-risk permissions. LayerX's 2025 report reveals how everyday extensions expose sensitive data, and what security teams must do now. [...]
BleepingComputer - 20-Year-Old Proxy Botnet Network Dismantled After Exploiting 1,000 Unpatched Devices Each Week
A 20-year-old criminal proxy network has been disrupted through a joint operation involving Lumen’s Black Lotus Labs, the U.S. Department of Justice, the Federal Bureau of Investigation (FBI), and the Dutch National Police. This botnet, operational since…
gbhackers.com - Can Cybersecurity Keep Up In the AI Arms Race?
New research shows China is quickly catching up with the US in AI innovation. Experts weigh in on what it means for cyber defenders.
Dark Reading - “PupkinStealer” – .NET Malware Steals Browser Data and Exfiltrates via Telegram
A new information-stealing malware dubbed “PupkinStealer” has emerged as a significant threat to individuals and enterprises. Developed in C# using the .NET framework, this 32-bit GUI-based Windows executable targets sensitive user data with a focused and…
gbhackers.com - Phishing Campaign Uses Blob URLs to Bypass Email Security and Avoid Detection
Cybersecurity researchers at Cofense Intelligence have identified a sophisticated phishing tactic leveraging Blob URIs (Uniform Resource Identifiers) to deliver credential phishing pages directly to users’ inboxes while evading traditional email security…
gbhackers.com - Security Firm Andy Frain Says 100,000 People Impacted by Ransomware Attack
Andy Frain was targeted by the Black Basta ransomware group in 2024 and the hackers have stolen a wide range of information.
SecurityWeek - ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files
ASUS has released updates to address two security flaws impacting ASUS DriverHub that, if successfully exploited, could enable an attacker to leverage the software in order to achieve remote code execution. DriverHub is a tool that's designed to…
The Hacker News - Vulnerability Detection Tops Agentic AI at RSAC's Startup Competition
Agentic-native startups threaten to reduce the zero-day problem to just a zero-hour issue. Of course, AI agents will accelerate offensive attacks as well.
Dark Reading - Threat actors use fake AI tools to deliver the information stealer Noodlophile
Threat actors use fake AI tools to trick users into installing the information stealer Noodlophile, Morphisec researchers warn. Morphisec researchers observed attackers exploiting AI hype to spread malware via fake AI tools promoted in viral posts and…
Security Affairs - Google Agrees to $1.3 Billion Settlement in Texas Privacy Lawsuits
Google has agreed to a $1.375 billion settlement with Texas in lawsuits over location and private browsing tracking, and biometric data collection.
SecurityWeek - VMware Tools Vulnerability Allows Attackers to Modify Files and Launch Malicious Operations
Broadcom-owned VMware has released security patches addressing a moderate severity insecure file handling vulnerability in VMware Tools, tracked as CVE-2025-22247 with a CVSS base score of 6.1. The vulnerability allows non-administrative users to manipulate…
gbhackers.com - ⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI-Powered Scams
What do a source code editor, a smart billboard, and a web server have in common? They’ve all become launchpads for attacks—because cybercriminals are rethinking what counts as “infrastructure.” Instead of chasing high-value targets directly, threat actors…
The Hacker News - 437,000 Impacted by Ascension Health Data Breach
Ascension Health has notified the HHS that more than 437,000 people were affected by a recently disclosed data breach.
SecurityWeek - Asus DriverHub Vulnerabilities Expose Users to Remote Code Execution Attacks
Two vulnerabilities in ASUS’s pre-installed software DriverHub can be exploited for remote code execution.
SecurityWeek - QatarRat Tool Emerges, GST Data Sold, and LockBit Gets Breached
QatarRat Tool Emerges, GST Data Sold, and LockBit Gets Breached SOCRadar’s Dark Web Team has identified a range of notable activities across underground forums this week. Key findings include the sale of a new multi-functional RAT named QatarRat, and a…
SOCRadar - SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths
SUDO_KILLER is a Bash script that audits sudo configurations on Unix-like systems, identifying misconfigurations and vulnerabilities for potential privilege escalation.
darknet.org.uk - US Deportation Airline GlobalX Confirms Hack
Global Crossing Airlines is investigating a cybersecurity incident after Anonymous hackers targeted its systems.
SecurityWeek - The Persistence Problem: Why Exposed Credentials Remain Unfixed—and How to Change That
Detecting leaked credentials is only half the battle. The real challenge—and often the neglected half of the equation—is what happens after detection. New research from GitGuardian's State of Secrets Sprawl 2025 report reveals a disturbing trend: the vast…
The Hacker News - VMware Tools Update Addresses Insecure File Handling Vulnerability
Broadcom has released a security advisory addressing a moderate-severity vulnerability in VMware Tools, identified as CVE-2025-22247, which could
SecurityOnline - A week in security (May 4 – May 10)
Last week on Malwarebytes Labs: The AI chatbot cop squad is here (Lock and Code S06E09) Android fixes 47 vulnerabilities, including one zero-day. Update as soon as you can! “Your privacy is a promise we don’t break”: Dating app Raw exposes sensitive user da...
Malwarebytes