News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 17 |
| Thu 22 Oct | 84 | 11 |
| Fri 23 Oct | 68 | 15 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 1 |
| Mon 26 Oct | 75 | 13 |
| Today, Tue 27 Oct | 66 so far | 13 |
Developing
Wed 25 Jun 202597 articles
- British hacker 'IntelBroker' charged with $25M in cybercrime damages
A British national known online as "IntelBroker" has been charged by the U.S. for stealing and selling sensitive data from dozens of victims, causing an estimated $25 million in damages. [...]
BleepingComputer - Hackers turn ScreenConnect into malware using Authenticode stuffing
Threat actors are abusing the ConnectWise ScreenConnect installer to build signed remote access malware by modifying hidden settings within the client's Authenticode signature. [...]
BleepingComputer - British national “IntelBroker” charged with causing $25 million in damages; U.S. seeks his extradition from France
“IntelBroker” was arrested in France in February, 2025, but news of his arrest was first disclosed today by French authorities. Now the U.S. is revealing its charges against him as they seek his extradition from France. From the U.S. Attorney’s Office for…
DataBreaches - And Now Malware That Tells AI to Ignore It?
Though rudimentary and largely non-functional, the wryly named "Skynet" binary could be a harbinger of things to come on the malware front.
Dark Reading - Patch and Persist: Darktrace’s Detection of Blind Eagle (APT-C-36)
Since 2018, Blind Eagle has targeted Latin American organizations using phishing and RATs. Darktrace detected Bling Eagle activity on a customer network involving C2 connectivity, malicious payload downloads and data exfiltration. Without Autonomous…
darktrace.com - Hackers abuse Microsoft ClickOnce and AWS services for stealthy attacks
A sophisticated malicious campaign that researchers call OneClik has been leveraging Microsoft's ClickOnce software deployment tool and custom Golang backdoors to compromise organizations within the energy, oil, and gas sectors. [...]
BleepingComputer - New Malware Discovered Using Prompt Injection to Manipulate AI Models in the Wild
Researchers have uncovered a new malware sample in the wild that employs a unique and unconventional evasion tactic: prompt injection aimed at manipulating AI models used in malware analysis. Dubbed “Skynet” by its creator, this malware, discovered in early…
gbhackers.com - Facial recognition: Where and how you can opt out
Our remote team recently took a trip to our Estonian office. When we arrived from our various destinations, we started chatting about how our travel had been. Our senior privacy advocate, David Ruiz, mentioned that he’d opted out of facial recognition while…
Malwarebytes - Multiple Brother Device Vulnerabilities Allow Attackers to Execute Arbitrary HTTP Requests
A zero-day research project has uncovered eight new vulnerabilities in multifunction printers (MFPs) and related devices from Brother Industries, Ltd., affecting a staggering 748 models across five major vendors, including Brother, FUJIFILM Business…
gbhackers.com - Beware of Weaponized Wedding Invite Scams Delivering SpyMax RAT to Android Devices
A sophisticated Android phishing campaign, aptly named “Wedding Invitation,” has emerged as a significant threat targeting mobile users across India. According to a detailed report from K7 Computing, this malicious operation leverages the guise of digital…
gbhackers.com - New wave of ‘fake interviews’ use 35 npm packages to spread malware
A new wave of North Korea's 'Contagious Interview' campaign is targeting job seekers with malicious npm packages that infect dev's devices with infostealers and backdoors. [...]
BleepingComputer - INTERPOL Cautions of Significant Increase in Cyber Attacks on Western and Eastern Africa
The INTERPOL 2025 Africa Cyberthreat Assessment Report has raised alarms over a dramatic surge in cybercrime across Africa, with Western and Eastern regions reporting that over 30% of all documented criminal activities are now cyber-related. Two-thirds of…
gbhackers.com - France issues press statement about arrest of ShinyHunters members
French version. The English version is below. It’s interesting to note that IntelBroker was described as a British national who was arrested in France in February, 2025 and detained in pre-trial detention.
DataBreaches - Millions of Brother Printers Hit by Critical, Unpatchable Bug
A slew of vulnerabilities, including a critical CVSS 9.8 that enables an attacker to generate the default admin password, affect hundreds of printer, scanner, and label-maker models made by manufacturer Brother.
Dark Reading - North Korean Hackers Pose as Recruiters, Target Developers with 35 New Malicious npm Packages
A new cyber campaign orchestrated by North Korean threat actors has been exposed by the Socket Threat Research Team, revealing a sophisticated supply chain attack targeting software developers through the npm registry. Linked to the Contagious Interview…
gbhackers.com - Patients Allege Home Delivery Pharmacy Failed to Timely Notify Them of Data Breach
Jim Ruble writes: In January 2021, a nationwide mail-order pharmacy located in Massachusetts experienced a data breach. The pharmacy discovered the breach in May 2021 and investigated to determine its scope. Personally identifiable information (PII),…
DataBreaches - Hackers breach Norwegian dam, open valve at full capacity
Catalin Cimpanu reports: Unidentified hackers have breached the systems of a Norwegian dam and opened its water valve at full capacity in an incident this April. The incident took place at the Lake Risevatnet dam near the city of Svelgen in Southwest Norway.…
DataBreaches - Patient death at London hospital linked to cyber attack on NHS
Rebecca Whittaker reports: The death of a patient has been linked to a cyber-attack on the NHS last year. Cyber criminals attacked two major NHS trusts causing more than 1,000 cancer treatment delays, 2,000 outpatient appointments to be cancelled and more…
DataBreaches - CISA is Shrinking: What Does it Mean for Cyber?
Dark Reading Confidential Episode 7: Cyber experts Tom Parker and Jake Williams offer their views on the practical impact of cuts to the US Cybersecurity and Infrastructure Security Agency.
Dark Reading - Hackers deploy fake SonicWall VPN App to steal corporate credentials
Hackers spread a trojanized version of SonicWall VPN app to steal login credentials from users accessing corporate networks. Unknown threat actors are distributing a trojanized version of SonicWall NetExtender SSL VPN app to steal user credentials. The…
Security Affairs - Threat Brief: Escalation of Cyber Risk Related to Iran
Unit 42 details recent Iranian cyberattack activity, sharing direct observations. Tactical and strategic recommendations are provided for defenders.
Unit 42 - Google releases Gemini CLI with free Gemini 2.5 Pro
Google has released Gemini 2.5 Pro-powered Gemini CLI, which allows you to use Gemini inside your terminal, including Windows Terminal. [...]
BleepingComputer - Citrix warns of NetScaler vulnerability exploited in DoS attacks
Citrix is warning that a vulnerability in NetScaler appliances tracked as CVE-2025-6543 is being actively exploited in the wild, causing devices to enter a denial of service condition. [...]
BleepingComputer - Microsoft Named a Leader in the 2025 IDC CNAPP MarketScape: Key Takeaways for Security Buyers
The cloud-native application protection platform (CNAPP) market continues to evolve rapidly as organizations look to secure increasingly complex cloud environments. In the recently published 2025 IDC MarketScape for Worldwide CNAPP, Microsoft has been…
techcommunity.microsoft.com - nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After Discovery
New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications. Identity security company Semperis,…
The Hacker News - WinRAR patches bug letting malware launch from extracted archives
WinRAR has addressed a directory traversal vulnerability tracked as CVE-2025-6218 that, under certain circumstances, allows malware to be executed after extracting a malicious archive. [...]
BleepingComputer - Dire Wolf Ransomware Comes Out Snarling, Bites Technology, Manufacturing
The emerging group has already gotten its teeth into 16 victims since May with its double extortion tactics, claiming victims in 11 countries, including the US, Thailand, and Taiwan.
Dark Reading - New 'CitrixBleed 2' NetScaler flaw let hackers hijack sessions
A recent vulnerability in Citrix NetScaler ADC and Gateway is dubbed "CitrixBleed 2," after its similarity to an older exploited flaw that allowed unauthenticated attackers to hijack authentication session cookies from vulnerable devices. [...]
BleepingComputer - Hundreds of MCP Servers Expose AI Models to Abuse, RCE
The servers that connect AI with real-world data are occasionally wide-open channels for cyberattacks.
Dark Reading - Threat Actors Distribute Compromised SonicWall SSL VPN NetExtender to Steal Sensitive Data
Threat actors were discovered disseminating a malicious, altered version of SonicWall’s SSL VPN NetExtender application in a complex cyberattack that was discovered through a partnership between SonicWall and Microsoft Threat Intelligence (MSTIC).…
gbhackers.com - Citrix Releases Emergency Patches for Actively Exploited CVE-2025-6543 in NetScaler ADC
Citrix has released security updates to address a critical flaw affecting NetScaler ADC that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-6543, carries a CVSS score of 9.2 out of a maximum of 10.0. It has been described as a…
The Hacker News - BreachForums hacking forum operators reportedly arrested in France
The French police have reportedly arrested five operators of the BreachForum cybercrime forum, a website used by cybercriminals to leak and sell stolen data that exposed the sensitive information of millions. [...]
BleepingComputer - Generative AI Exacerbates Software Supply Chain Risks
Malicious actors are exploiting AI-fabricated software components — presenting a major challenge for securing software supply chains.
Dark Reading - Hacktivist Groups Target U.S. Companies and Military Domains in Retaliation for Iran Attacks
The United States has become a popular target for hacktivist groups in the escalating Israel-Iran conflict, following U.S. attacks on Iranian nuclear sites on June 21, 2025. Several pro-Iranian hacktivist collectives, including Mr Hamza, Team 313, Cyber…
gbhackers.com - Thousands of SaaS Apps Could Still Be Susceptible to nOAuth
New research suggests more than 10,000 SaaS apps could remain vulnerable to a nOAuth variant despite the basic issue being disclosed in June 2023.
SecurityWeek - Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure
Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface (GUI) for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions. The…
The Hacker News - Firefox 140 Launches with Critical Code Execution Bug Fix – Update Now
Mozilla has officially released Firefox 140, marking a significant update that addresses multiple security vulnerabilities, including a critical code execution flaw. Users are strongly urged to update their browsers immediately to protect against potential…
gbhackers.com - Windows 11 Configuration Bug Freezes Update Scanning Process
A recently discovered bug in Windows 11 has caused significant frustration among users, as the operating system’s update scanning process can freeze unexpectedly, leaving systems unable to check for or install critical updates. Microsoft has officially…
gbhackers.com - Microsoft Offers Free Windows 10 Extended Security Update Options as EOS Nears
With end of support scheduled for October 2025, Windows 10 users will be able to continue receiving important security updates.
SecurityWeek - XOR Marks the Flaw in SAP GUI
The company has patched two vulnerabilities in its Graphical User Interface that would have allowed attackers to grab data from a user's input history feature.
Dark Reading