News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Today, Wed 28 Oct | 83 so far | 15 |
Developing
Thu 15 May 202585 articles
- Malicious NPM package uses Unicode steganography to evade detection
A malicious package in the Node Package Manager index uses invisible Unicode characters to hide malicious code and Google Calendar links to host the URL for the command-and-control location. [...]
BleepingComputer - Coinbase data breach exposes customer info and government IDs
Coinbase, a cryptocurrency exchange with over 100 million customers, has disclosed that cybercriminals working with rogue support agents stole customer data and demanded a $20 million ransom not to publish the stolen information. [...]
BleepingComputer - Russian Hackers Exploit XSS Vulnerabilities to Inject Malicious Code into Email Servers
A sophisticated cyberespionage campaign, dubbed Operation RoundPress, has been uncovered by cybersecurity researchers at ESET. Attributed with medium confidence to the Russian-linked Sednit group-also known as APT28, Fancy Bear, and Forest Blizzard-this…
gbhackers.com - Weaponized Google Calendar Invites Deliver Malicious Payload Using a Single Character
Security researchers have unearthed a sophisticated malware distribution method leveraging Google Calendar invites to deliver malicious payloads through seemingly innocuous links. The attack, centered around a deceptive npm package named os-info-checker-es6,…
gbhackers.com - Windows Defender Application Control Bypassed Through Browser Exploit Techniques
Security researchers from the X-Force Red Adversary Simulation team have uncovered a novel method to bypass Windows Defender Application Control (WDAC), a robust Windows security feature designed to prevent unauthorized code execution through strict…
gbhackers.com - Threat landscape for industrial automation systems in Q1 2025
Trends Relative stability from quarter to quarter. The percentage of ICS computers on which malicious objects were blocked remained unchanged from Q4 2024 at 21.9%. Over the last three quarters, the value has ranged from 22.0% to 21.9%. The quarterly figures…
securelist.com - U.S. Officials Probe Rogue Communication Devices in Solar Power Inverters
U.S. energy officials are intensifying scrutiny of Chinese-manufactured power inverters, critical components in renewable energy systems, after discovering undocumented communication equipment embedded within them. These inverters, predominantly produced in…
gbhackers.com - Critical Infrastructure Under Siege: OT Security Still Lags
With critical infrastructure facing constant cyber threats from the Typhoons and other corners, federal agencies and others are warning security for the OT network, a core technology in many critical sectors, is not powered up enough.
Dark Reading - Chinese Hackers Hit Drone Sector in Supply Chain Attacks
Ionut Arghire reports: A Chinese threat actor was seen disrupting the drone supply chain in multi-wave attacks against various organizations in Taiwan and South Korea, Trend Micro reports. Dubbed Earth Ammit and believed to be tied to Chinese APTs, the…
DataBreaches - TransferLoader Malware Enables Attackers to Execute Arbitrary Commands on Infected Systems
A formidable new malware loader, dubbed TransferLoader, has emerged as a significant cybersecurity threat, as detailed in a recent report by Zscaler ThreatLabz. Active since at least February 2025, this sophisticated malware has been observed deploying…
gbhackers.com - DarkCloud Stealer Employs AutoIt to Evade Detection and Steal Login Credentials
Unit 42 researchers from Palo Alto Networks have uncovered a series of attacks in January 2025 involving the DarkCloud Stealer malware. This infostealer, first observed in 2022, has evolved with new tactics to bypass traditional detection mechanisms. By…
gbhackers.com - Interlock Ransomware Targeting Defense Contractors and Supply Chain Networks
The Interlock Ransomware group has emerged as a significant adversary targeting defense contractors and their intricate supply chain networks. First identified in September 2024, Interlock has rapidly shifted from opportunistic attacks across sectors like…
gbhackers.com - Proofpoint to Acquire Hornetsecurity in Reported $1 Billion Deal
Enterprise cybersecurity giant Proofpoint is buying Germany-based Microsoft 365 security solutions provider Hornetsecurity.
SecurityWeek - $28 million in Texas’ cybersecurity funding for schools left unspent
How often have we heard about cyberattacks affecting Texas school districts? And how often have we heard that k-12 districts are underfunded for cybersecurity and/or don’t have trained personnel? Yet when they are offered money, many districts have not…
DataBreaches - Pen Testing for Compliance Only? It's Time to Change Your Approach
Imagine this: Your organization completed its annual penetration test in January, earning high marks for security compliance. In February, your development team deployed a routine software update. By April, attackers had already exploited a vulnerability…
The Hacker News - Chinese Hackers Hit Drone Sector in Supply Chain Attacks
The China-linked hacking group Earth Ammit has launched multi-wave attacks in Taiwan and South Korea to disrupt the drone sector.
SecurityWeek - Cybersecurity incident at Central Point School District 6
Another day, another school district hit. KDRV in Oregon reports: Central Point School District 6 is addressing a cybersecurity incident that impacted its digital systems. According to the district, unauthorized access was detected on Wednesday, leading to…
DataBreaches - Official Indiana .gov email addresses are phishing residents
Colin Wood reports: Indiana state agencies on Tuesday are warning residents to delete phony emails sent using official state government email addresses. Phishing emails emanating from numerous departments — from the Department of Child Services to the…
DataBreaches - Ransomware Groups, Chinese APTs Exploit Recent SAP NetWeaver Flaws
Two ransomware groups and several Chinese APTs have been exploiting two recent SAP NetWeaver vulnerabilities.
SecurityWeek - 5 BCDR Essentials for Effective Ransomware Defense
Ransomware has evolved into a deceptive, highly coordinated and dangerously sophisticated threat capable of crippling organizations of any size. Cybercriminals now exploit even legitimate IT tools to infiltrate networks and launch ransomware attacks. In a…
The Hacker News - Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers
A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting (XSS) vulnerabilities, including a then-zero-day in MDaemon, according to new…
The Hacker News - Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper
Cybersecurity researchers have discovered a malicious package named "os-info-checker-es6" that disguises itself as an operating system information utility to stealthily drop a next-stage payload onto compromised systems. "This campaign employs clever…
The Hacker News - Canadian Electric Utility Lists Customer Information Stolen by Hackers
Nova Scotia Power says a wide range of personal and financial information was stolen in the recent cyberattack.
SecurityWeek - U.S. CISA adds a Fortinet flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Fortinet vulnerability to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Fortinet Multiple Products Stack-Based Buffer…
Security Affairs - Australian Human Rights Commission Discloses Data Breach
The Australian Human Rights Commission says data submitted through the complaint form on its website was inadvertently exposed.
SecurityWeek - High-Risk Flaws in a-blog cms: CVE-2025-36560 Scores Critical 9.2 on CVSS Scale
JPCERT/CC has issued a vulnerability note disclosing multiple security flaws in a-blog cms, a popular content management system
SecurityOnline - Chrome 136 Update Patches Vulnerability With ‘Exploit in the Wild’
Google has rolled out a Chrome 136 update that resolves a high-severity vulnerability for which a public exploit exists.
SecurityWeek - Google fixes high severity Chrome flaw with public exploit
Google has released emergency security updates to patch a high-severity Chrome vulnerability that has a public exploit and can let attackers hijack accounts. [...]
BleepingComputer - Kosovo authorities extradited admin of the cybercrime marketplace BlackDB.cc
Kosovar citizen extradited to the US for running the cybercrime marketplace BlackDB.cc appeared in federal court facing related charges. Kosovo citizen Liridon Masurica (33) of Gjilan, was extradited to the US for running the cybercrime marketplace…
Security Affairs - Critical BitLocker Flaw Exploited in Minutes: Bitpixie Vulnerability Proof of Concept Unveiled
Security researchers have demonstrated a non-invasive method to bypass Microsoft BitLocker encryption on Windows devices in just five minutes without physically modifying the hardware. The Bitpixie vulnerability (CVE-2023-21563) allows attackers with brief…
gbhackers.com - Google Chrome Zero-Day Vulnerability (CVE-2025-4664) Actively Exploited in The Wild
Google has rolled out a fresh Stable Channel update for the Chrome browser across desktop platforms, including Windows, Mac, and Linux. This update elevates Chrome to version 136.0.7103.113/.114 for Windows and Mac, and 136.0.7103.113 for Linux. The…
gbhackers.com - New Chrome Vulnerability Enables Cross-Origin Data Leak via Loader Referrer Policy
Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the wild. The high-severity vulnerability, tracked as CVE-2025-4664 (CVSS score: 4.3), has been…
The Hacker News - URGENT Chrome Update: High-Risk CVE-2025-4664 Flaw Actively Exploited In The Wild – Patch Immediately!
Google has released a critical Stable Channel Update for Chrome Desktop, bumping the version to 136.0.7103.113/.114 for Windows
SecurityOnline - Node.js Alerts: High-Severity Flaw (CVE-2025-23166) Risks Remote System Crashes! Update Immediately!
In an important security announcement released recently, the Node.js team has rolled out vital updates for its 24.x,
SecurityOnline - BitLocker Encryption Bypassed in Minutes via Bitpixie (CVE-2023-21563) – PoC Reveals High-Risk Attack Path
Security researchers have demonstrated a powerful software-only technique to bypass Microsoft BitLocker encryption—without needing a screwdriver, soldering iron,
SecurityOnline - DarkCloud Stealer Returns: AutoIt-Powered Malware Strikes with New Stealth Tactics
First spotted in 2022 and actively developed ever since, DarkCloud Stealer has reemerged with a sophisticated new variant
SecurityOnline - Three Vulnerabilities Expose Apache IoTDB to Attacks
Apache IoTDB, a system designed for managing industrial IoT time-series data, faces a series of security vulnerabilities that
SecurityOnline - Fortinet Patches Critical TACACS+ Authentication Bypass (CVE-2025-22252) in FortiOS and FortiProxy
Fortinet has released patches for a critical vulnerability (CVE-2025-22252, CVSS 9.0) affecting multiple products, including FortiOS, FortiProxy, and
SecurityOnline - Interlock Ransomware Hits U.S. Defense Contractor AMTEC in Espionage-Driven Data Breach
A sophisticated ransomware campaign targeting National Defense Corporation (NDC) and its subsidiaries affected the defense supply chain, exposing
SecurityOnline