News
Every CyberSIXT summary, newest first, with a link to its story and to the original report.
Articles per day, last 14 days
Most articles on Wed 21 Oct (96); 10–13 on weekend days.
- On CISA KEV CVEs
- Other coverage
- Closed-day average
Show as tableHide table
| Day | Articles | On CISA KEV CVEs |
|---|---|---|
| Tue 13 Oct | 85 | 11 |
| Wed 14 Oct | 86 | 25 |
| Thu 15 Oct | 78 | 15 |
| Fri 16 Oct | 61 | 12 |
| Sat 17 Oct | 10 | 1 |
| Sun 18 Oct | 10 | 0 |
| Mon 19 Oct | 60 | 12 |
| Tue 20 Oct | 86 | 16 |
| Wed 21 Oct | 96 | 0 |
| Thu 22 Oct | 84 | 3 |
| Fri 23 Oct | 68 | 8 |
| Sat 24 Oct | 13 | 3 |
| Sun 25 Oct | 13 | 0 |
| Mon 26 Oct | 75 | 5 |
| Today, Tue 27 Oct | 1 so far | 1 |
Developing
Mon 14 Jul 202570 articles
- Web-Inject Campaign Debuts Fresh Interlock RAT Variant
A cyber-threat campaign is using legitimate websites to inject victims with remote access Trojans belonging to the Interlock ransomware group, in order to gain control of devices.
Dark Reading - UK launches vulnerability research program for external experts
UK's National Cyber Security Centre (NCSC) has announced a new Vulnerability Research Initiative (VRI) that aims to strengthen relations with external cybersecurity experts. [...]
BleepingComputer - Military Veterans May Be What Cybersecurity Is Looking For
As demand for cybersecurity professionals continues to outpace supply, the ISC2 Cybersecurity Workforce Study notes talent shortages and skills gaps across the field, with nearly 16,000 international professionals surveyed indicating under-staffed and…
Dark Reading - Google Gemini AI Bug Allows Invisible, Malicious Prompts
A prompt-injection vulnerability in the AI assistant allows attackers to create messages that appear to be legitimate Google Security alerts but instead can be used to target users across various Google products with vishing and phishing.
Dark Reading - Interlock ransomware adopts FileFix method to deliver malware
Hackers have adopted the new technique called 'FileFix' in Interlock ransomware attacks to drop a remote access trojan (RAT) on targeted systems. [...]
BleepingComputer - Ransomware in Italy, strike at the Diskstation gang: hacker group leader arrested in Milan
Redazione reports: A 44-year-old man, a Romanian citizen, was arrested in Milan on charges of being the main director behind a series of cyber attacks orchestrated by the ‘Diskstation’ gang. This is a criminal organisation specialised in ransomware, active…
DataBreaches - Interlock ransomware group deploys new PHP-based RAT via FileFix
Interlock ransomware group deploys new PHP-based RAT via FileFix (a ClickFix variant) in a widespread campaign targeting multiple industries. The Interlock ransomware group is deploying a new PHP-based variant of the Interlock RAT in a broad campaign.…
Security Affairs - The Unusual Suspect: Git Repos
While phishing and ransomware dominate headlines, another critical risk quietly persists across most enterprises: exposed Git repositories leaking sensitive data. A risk that silently creates shadow access into core systems Git is the backbone of modern…
The Hacker News - New PHP-Based Interlock RAT Variant Uses FileFix Delivery Mechanism to Target Multiple Industries
Threat actors behind the Interlock ransomware group have unleashed a new PHP variant of its bespoke remote access trojan (RAT) as part of a widespread campaign using a variant of ClickFix called FileFix. "Since May 2025, activity related to the Interlock RAT…
The Hacker News - Is AI “healthy” to use? (Lock and Code S06E14)
This week on the Lock and Code podcast… “Health” isn’t the first feature that most anyone thinks about when trying out a new technology, but a recent spate of news is forcing the issue when it comes to artificial intelligence (AI). In June, The New York…
Malwarebytes - Gigabyte motherboards vulnerable to UEFI malware bypassing Secure Boot
Dozens of Gigabyte motherboard models run on UEFI firmware vulnerable to security issues that allow planting bootkit malware that is invisible to the operating system and can survive reinstalls. [...]
BleepingComputer - Improving IT efficiency with Microsoft Security Copilot in Microsoft Intune and Microsoft Entra
When Microsoft introduced Microsoft Security Copilot last year, our vision was to empower organizations with generative AI that helps security and IT teams simplify operations and respond faster. Since then, we’ve continuously innovated and learned alongside…
Microsoft - Train Hack Gets Proper Attention After 20 Years: Researcher
A vulnerability affecting systems named End-of-Train and Head-of-Train can be exploited by hackers to cause trains to brake.
SecurityWeek - CitrixBleed 2 Flaw Poses Unacceptable Risk: CISA
CISA considers the recently disclosed CitrixBleed 2 vulnerability an unacceptable risk and has added it to the KEV catalog.
SecurityWeek - The Dark Side of Global Power Shifts & Demographic Decline
As global power realigns and economies falter, the rise in cybercrime is no longer hypothetical — it's inevitable.
Dark Reading - Google Gemini Tricked Into Showing Phishing Message Hidden in Email
Google Gemini for Workspace can be tricked into displaying a phishing message when asked to summarize an email.
SecurityWeek - Gigabyte UEFI Firmware Vulnerability Allows Code Execution in SMM Privileged Mode
Critical security vulnerabilities in Gigabyte motherboard firmware have been disclosed that allow attackers to execute arbitrary code in System Management Mode (SMM), the most privileged execution level on x86 processors. The flaws, identified by security…
gbhackers.com - Global Louis Vuitton data breach impacts UK, South Korea, and Turkey
Louis Vuitton data breach affects customers in the UK, South Korea, Turkey, and possibly more countries, with notifications underway. Customers of French luxury retailer Louis Vuitton are being notified of a data breach affecting multiple countries,…
Security Affairs - ⚡ Weekly Recap: Scattered Spider Arrests, Car Exploits, macOS Malware, Fortinet RCE and More
In cybersecurity, precision matters—and there’s little room for error. A small mistake, missed setting, or quiet misconfiguration can quickly lead to much bigger problems. The signs we’re seeing this week highlight deeper issues behind what might look like…
The Hacker News - Malicious VSCode extension in Cursor IDE led to $500K crypto theft
A fake extension for the Cursor AI IDE code editor infected devices with remote access tools and infostealers, which, in one case, led to the theft of $500,000 in cryptocurrency from a Russian crypto developer. [...]
BleepingComputer - New Interlock RAT Variant Distributed via FileFix Attacks
The Interlock ransomware group has partnered with the KongTuke TDS to distribute a new RAT variant via FileFix attacks.
SecurityWeek - Microsoft Explains How to Find and Stop Processes Blocking Files in Windows
Microsoft has provided comprehensive guidance on resolving one of Windows users’ most frustrating issues: the dreaded “The process cannot access the file because it is being used by another process” error message. This common problem occurs when multiple…
gbhackers.com - Tible Partners with AccuKnox to Deploy Zero Trust CNAPP Solution
Bangalore, India, 14th July 2025, CyberNewsWire
SecurityOnline - Flaws in Gigabyte Firmware Allow Security Bypass, Backdoor Deployment
Vulnerabilities in Gigabyte firmware implementations could allow attackers to disable Secure Boot and execute code during the early boot phase.
SecurityWeek - Louis Vuitton Data Breach Hits Customers in Several Countries
Louis Vuitton customers in the UK, South Korea, Turkey and possibly other countries are being notified of a data breach.
SecurityWeek - Experts uncover critical flaws in Kigen eSIM technology affecting billions
Experts devised a new hack targeting Kigen eSIM tech, used in over 2B devices, exposing smartphones and IoT users to serious security risks. Researchers at Security Explorations uncovered a new hacking method exploiting flaws in Kigen’s eSIM tech, affecting…
Security Affairs - New Forensic Method Reveals Hidden Traces of RDP Exploits by Hackers
Cybersecurity researchers have unveiled advanced techniques for tracking attackers who use Remote Desktop Protocol (RDP) to move laterally through compromised networks, turning the very technology hackers rely on into a digital fingerprint that reveals their…
gbhackers.com - A year after cyber attack, Columbus could invest $23M in cybersecurity upgrades
There’s an update to the City of Columbus, Ohio cyberattack by Rhysida that affected 500,000 residents but also resulted in the city trying to muzzle a whistleblower who tried to inform the community of the true extent of the breach. Jordan Laird reports:…
DataBreaches - Gravity Forms Breach Hits 1M WordPress Sites
Victoria Mossi reports: In a startling revelation for the WordPress community, a critical security breach has been uncovered in the widely used Gravity Forms plugin, signaling a sophisticated supply chain attack. According to a detailed report by Patchstack,…
DataBreaches - Weaponized Games: Threat Actors Target Gen Z Gamers Through Popular Titles
Kaspersky security researchers have discovered sophisticated threat actor activities that take advantage of the digitally native Gen Z population, which was born between 1997 and 2012 and is heavily involved in gaming, streaming, and anime, for malevolent…
gbhackers.com - CNN, BBC, and CNBC websites impersonated to scam people
Researchers have uncovered a large campaign impersonating news websites, such as those from CNN, BBC, CNBC, News24, and ABC News, to promote investment scams. Adding a well known brand to your scammy site is a tale as old as time, and gives it an air of…
Malwarebytes - Hackers Weaponize Compiled HTML Help to Deliver Malicious Payload
Threat actors have exploited Microsoft Compiled HTML Help (CHM) files to distribute malware, with a notable sample named deklaracja.chm uploaded to VirusTotal from Poland. This CHM file, a binary container for compressed HTML and associated objects, serves…
gbhackers.com - Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
CL-STA-1020 targets Southeast Asian governments using a novel Microsoft backdoor we call HazyBeacon. It misuses AWS Lambda URLs for C2.
Unit 42 - Forensic journey: Breaking down the UserAssist artifact structure
Introduction As members of the Global Emergency Response Team (GERT), we work with forensic artifacts on a daily basis to conduct investigations, and one of the most valuable artifacts is UserAssist. It contains useful execution information that helps us…
securelist.com - Louis Vuitton Suffers Data Breach—Customer Information Stolen
Luxury fashion house Louis Vuitton has confirmed that customer data from its UK operations was compromised in a cyber-attack, marking the latest in a series of high-profile retail breaches targeting major brands. The incident, which occurred on July 2, 2025,…
gbhackers.com - Hackers Inject Malware Into Gravity Forms WordPress Plugin
Two Gravity Forms WordPress plugin versions available on the official download page were injected with malware in a supply chain attack.
SecurityWeek - RenderShock 0-Click Exploit Executes Payloads Silently via Background Process
A new class of cyberattack called RenderShock has been identified that can compromise enterprise systems without requiring any user interaction, exploiting the very productivity features designed to help workers preview and process files automatically.…
gbhackers.com - Threats Actors Use Sophisticated Hacking Tools to Destroy Organizations Critical Infrastructure
Threat actors, ranging from state-sponsored organizations to non-state actors, are using sophisticated cyber weapons to breach and destroy vital infrastructure in a time when digital and physical security are becoming more intertwined. These tools, often…
gbhackers.com