News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 18 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 16 |
| Sat 24 Oct | 13 | 4 |
| Sun 25 Oct | 13 | 2 |
| Mon 26 Oct | 76 | 20 |
| Tue 27 Oct | 95 | 18 |
| Wed 28 Oct | 87 | 15 |
| Today, Thu 29 Oct | 5 so far | 1 |
Developing
Fri 23 May 202575 articles
- Cityworks Zero-Day Exploited by Chinese Hackers in US Local Government Attacks
A Chinese threat actor exploited a zero-day vulnerability in Trimble Cityworks to hack local government entities in the US.
SecurityWeek - Operation Endgame Crushes DanaBot Malware, Shuts Down 150 C2 Servers and Halts 1,000 Daily Attacks
Operation Endgame II has delivered a devastating strike against DanaBot, a notorious malware that has plagued systems since its emergence in 2018. Initially designed as a banking trojan targeting financial credentials, DanaBot evolved into a multi-purpose…
gbhackers.com - Apple XNU Kernel Flaw Enables Attackers to Escalate Privileges
Apple has released urgent security patches addressing CVE-2025-31219, a high-severity vulnerability in its XNU kernel that underpins macOS, iOS, iPadOS, tvOS, watchOS, and visionOS. The flaw, which carries a CVSS score of 8.8 (vector:…
gbhackers.com - Inside LockBit: Data Leak Reveals Leading Affiliates and How They Operate
A massive data leak from the LockBit ransomware group, published on its hijacked leak site, has provided an unprecedented glimpse into the inner workings of one of the most notorious Ransomware-as-a-Service (RaaS) operations. The leaked data, spanning from…
gbhackers.com - ViciousTrap Hackers Breaches 5,500+ Edge Devices from 50+ Brands, Turns Them into Honeypots
A sophisticated cyber threat actor, dubbed ViciousTrap by Sekoia.io’s Threat Detection & Research (TDR) team, has compromised over 5,500 edge devices across more than 50 brands, transforming them into a massive honeypot-like network. This alarming operation,…
gbhackers.com - DanaBot Botnet Disrupted by Law Enforcement, 16 Suspects Charged
The DanaBot botnet ensnared over 300,000 devices and caused more than $50 million in damages before being disrupted.
SecurityWeek - Windows 11 Notepad gets AI-powered text writing capabilities
Microsoft is testing a new AI-powered text generation feature in Notepad that can let Windows Insiders create content based on custom prompts. [...]
BleepingComputer - Chinese Spies Exploit Ivanti Vulnerabilities Against Critical Sectors
A Chinese espionage group has been chaining two recent Ivanti EPMM vulnerabilities in attacks against organizations in multiple critical sectors.
SecurityWeek - Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation
The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov, 48, of Moscow, Russia, alleging he led the development and deployment of the notorious Qakbot malware. This action, announced on May 22, 2025, marks a…
gbhackers.com - DanaBot Takedown: 16 Indicted for $50M Malware Operation
The U.S. Department of Justice has unsealed charges against 16 individuals allegedly behind the DanaBot malware operation, a
SecurityOnline - Fortinet Zero-Day Under Attack: PoC Now Publicly Available
FortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products, including FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice. The vulnerability is a stack-based buffer overflow…
gbhackers.com - U.S. Dismantles DanaBot Malware Network, Charges 16 in $50M Global Cybercrime Operation
The U.S. Department of Justice (DoJ) on Thursday announced the disruption of the online infrastructure associated with DanaBot (aka DanaTools) and unsealed charges against 16 individuals for their alleged involvement in the development and deployment of the…
The Hacker News - Police takes down 300 servers in ransomware supply-chain crackdown
In the latest phase of Operation Endgame, an international law enforcement operation, national authorities from seven countries seized 300 servers and 650 domains used to launch ransomware attacks. [...]
BleepingComputer - Operation Endgame: Global Takedown Disrupts Major Ransomware Malware Infrastructure
Europol and Eurojust have dismantled the digital backbone of several major malware strains used in ransomware operations. Dubbed
SecurityOnline - Global Crackdown Nets 270 Dark Web Vendors in Major Arrests
A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the criminal underworld operating on the dark web. Coordinated by Europol and involving agencies across four continents, the operation resulted in the arrest of…
gbhackers.com - Chinese threat actors exploited Trimble Cityworks flaw to breach U.S. local government networks
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy Cobalt Strike and VShell. Cisco Talos researchers attribute the exploitation of the CVE-2025-0994 in Trimble Cityworks to Chinese-speaking threat actor…
Security Affairs - CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets
On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory regarding active cyber threat activity targeting its Metallic software-as-a-service (SaaS) application, which is hosted in the Microsoft Azure cloud environment.…
gbhackers.com - CISA Warns of Suspected Broader SaaS Attacks Exploiting App Secrets and Cloud Misconfigs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday revealed that Commvault is monitoring cyber threat activity targeting applications hosted in their Microsoft Azure cloud environment. "Threat actors may have accessed client secrets…
The Hacker News - GitLab Duo Vulnerability Enabled Attackers to Hijack AI Responses with Hidden Prompts
Cybersecurity researchers have discovered an indirect prompt injection flaw in GitLab's artificial intelligence (AI) assistant Duo that could have allowed attackers to steal source code and inject untrusted HTML into its responses, which could then be used…
The Hacker News - 184 Million Leaked Credentials Found in Open Database
Security researchers have identified a database containing a staggering 184 million account credentials—prompting yet another urgent reminder to
SecurityOnline - Pocket and Fakespot Apps Closing: Mozilla Discontinues Popular Services
Pocket, a pioneering “read-it-later” application first launched in 2007, was acquired in 2017 by the Mozilla Foundation with
SecurityOnline - Anthropic Unveils Claude 4: New AI Models Excel in Programming & Extended Thinking
Anthropic has officially unveiled its latest generation of AI models under the Claude 4 series, comprising the flagship
SecurityOnline - Microsoft Brings Seamless Cross-Device Resume to Windows 11
In a recent release of Windows 11 Preview Build 26100.4188, Microsoft introduced a cross-device resume feature akin to
SecurityOnline - Social Engineering Attack: Coinbase Customer Data Stolen, 70K Users Affected
The publicly listed U.S. cryptocurrency exchange Coinbase recently disclosed that it had fallen victim to a sophisticated social
SecurityOnline - Google’s Ultimatum: Publishers Must Share Data for AI Overviews or Lose Traffic
As previously mentioned, Google Search is in the process of integrating advertisements into its AI Overviews, which are
SecurityOnline - Claude 4 AI’s Dark Side: ‘Whistleblowing Mode’ and Blackmail Attempts Uncovered
The artificial intelligence industry is currently abuzz with discussions surrounding the newly released Claude 4 series models. These
SecurityOnline - Critical NETGEAR Router Flaw Enables Full Admin Access via Hidden Backdoor (PoC Included)
A newly disclosed and highly critical vulnerability, tracked as CVE-2025-4978 with a CVSSv4 score of 9.3, has been
SecurityOnline - Rhadamanthys Stealer Returns: Copyright Phishing Targets Europe
The Rhadamanthys stealer, a notorious information-stealing malware, has returned with a new wave of targeted phishing attacks sweeping
SecurityOnline - Stealthy Skimmer: New Formjacking Malware Targets WooCommerce Checkouts
The Wordfence Threat Intelligence Team has uncovered a new and deeply stealthy formjacking malware targeting WooCommerce, the widely-used
SecurityOnline - Print Security Warning: Canon Printers Exposed to Data Theft
Canon has issued a security advisory warning customers about two high-severity vulnerabilities—CVE-2025-3078 and CVE-2025-3079—that affect a range of
SecurityOnline - ModSecurity DoS Flaw: PoC Available for Apache Vulnerability (No Workaround, Patch Pending)
A newly disclosed vulnerability in ModSecurity’s Apache module, tracked as CVE-2025-47947, exposes web servers to a potentially severe
SecurityOnline - Destructive npm Packages Deleting Files, Hijacking Frameworks for 2+ Years
In a disturbing development for the JavaScript community, Socket’s Threat Research Team has uncovered a stealthy and destructive
SecurityOnline - Ivanti EPMM Under Attack: Zero-Day RCE Exploited by China-Linked Group UNC5221
A newly discovered zero-day vulnerability in Ivanti Endpoint Manager Mobile (EPMM) — CVE-2025-4428 — is being actively exploited
SecurityOnline - Malicious VS Code Extensions Deliver Spyware, Steal Crypto Credentials
In a detailed report published by Datadog Security Research, threat actor MUT-9332 has been linked to a new
SecurityOnline - Dark Web Alert: Genesis Market Returns with Stealthy Browser Extension Attack
The Genesis Market, a notorious dark web marketplace dismantled by law enforcement in early 2023, appears to return.
SecurityOnline